|
Plagegeister aller Art und deren Bekämpfung: Adware automatisch in neuen TabsWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
11.04.2015, 17:47 | #1 |
| Adware automatisch in neuen Tabs Hallo Liebe Community von Trojaner Board, Vorweg ich habe Windows 8.1. bei weiteren Fragen in die Details gerne fragen. ich habe seit ein paar Tagen ein Problem mit meine Browser Google Chrome. Ich denke jedoch das es nicht dabei bleibt. Unzwahr öffnet der Browser wenn er geöffnet ist, in abständen immer eine Art Adware die mit der Seite PTP24.com verküpft wird, die wie ich denke wie ADFly etc. funktioniert. Danach kommt halt immer eine Werbeseite wie z.B von "S.K.I.L.L" etc.. Ansich nicht weiter schlimm nervt jedoch einbisschen. Was ich nur komisch finde das bei jedem Neustart sagt mir "TuneUp 2015", dass Windows automatische Updates abgeschaltet wurde sowie das einige WAN Miniports (ich weiß nur das die irgendwas mit dem internet zutun haben) nicht ordnungsgemäß funktionieren. Habe mir schon andere Themen hier durch gelesen und habe mit dem "ADWCleaner" sowie mit dem " Malwarebytes Anti-Malware " tool einen durchlauf gemacht und die Funde gelöscht. Nach einem Neustart jedoch war alles genauso wie vorher und die WAN-Miniports waren immer noch beschädigt. Das Problem hatte ich vorher nie deswegen denke ich dass das was damit zutun hat. Meine Vermutung ist das sich eine Art "AdwareDropper" oder so, in diese Miniports einklingt und somit die Werbung im Internet anzeigt. Der Chrome Browser hat auch schon mehrmals angezeigt das unbefungt etwas verändert wurde und ich habe ihn zurückgesetzt. Mittlerweile bin ich echt verzweifelt und weiß nicht was ich noch machen soll.. Ich hoffe auf eure nette Hilfe Mit freundlichen Grüßen DJFly64 |
11.04.2015, 17:52 | #2 |
/// TB-Ausbilder /// Anleitungs-Guru | Adware automatisch in neuen TabsMein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...
Hinweis: Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert. Adware & Co. können wir sehr gut entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst. Los geht's: Schritt 1 Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff Posten in CODE-Tags: So gehts... Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
11.04.2015, 17:58 | #3 |
| Adware automatisch in neuen Tabs FRST Logfile:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015 Ran by Besitzer (administrator) on JONAS-PC on 11-04-2015 18:56:20 Running from C:\Users\Besitzer\Downloads Loaded Profiles: Besitzer (Available profiles: Besitzer) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Adobe Systems Incorporated) C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\opcddemg.exe (DEVGURU Co., LTD.) C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe (AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Saitek) C:\Program Files\SmartTechnology\Software\SaiMfd.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE15\csisyncclient.exe (Akamai Technologies, Inc.) C:\Users\Besitzer\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Besitzer\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\ProgramData\Microsoft\Windows\WER\wermgr.exe (Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2013-04-16] (Saitek) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557984 2014-08-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [wermgr] => C:\ProgramData\Microsoft\Windows\WER\wermgr.exe [6786560 2015-01-09] (Microsoft Corporation) HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31682144 2015-03-25] (Skype Technologies S.A.) HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Besitzer\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.) HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Run: [Spotify Web Helper] => C:\Users\Besitzer\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-04-03] (Spotify Ltd) HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Run: [Speech Recognition] => C:\WINDOWS\Speech\Common\sapisvr.exe [44032 2014-10-29] (Microsoft Corporation) HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Run: [Spotify] => C:\Users\Besitzer\AppData\Roaming\Spotify\Spotify.exe [7112248 2015-04-03] (Spotify Ltd) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-819627596-3724567892-276498191-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-819627596-3724567892-276498191-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.youtube.de/ hxxp://www.facebook.de/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.) BHO: BHOImpl Class -> {E1499FE7-129D-4B6E-B681-DDF21E14172C} -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\iToolsBHO64.dll [2015-04-05] (iTools.hk) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation) BHO-x32: CmjBrowserHelperObject Object -> {6FE6A929-59D1-4763-91AD-29B61CFFB35B} -> C:\Program Files (x86)\Mindjet\MindManager 10\Mm8InternetExplorer.dll [2012-02-27] (Mindjet) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-16] (Oracle Corporation) BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-16] (Oracle Corporation) BHO-x32: BHOImpl Class -> {E1499FE7-129D-4B6E-B681-DDF21E14172C} -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\iToolsBHO.dll [2015-04-05] (iTools.hk) Toolbar: HKLM - No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File Toolbar: HKLM-x32 - No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File Toolbar: HKU\S-1-5-21-819627596-3724567892-276498191-1001 -> No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-08] (Microsoft Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation) Hosts: Hosts file not detected in the default directory Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\3nwh8e47.default FF Plugin: @itools.hk/npiTools, version=1.0.0 -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\npiTools.dll [2015-04-05] () FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-02-08] (Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin-x32: @itools.hk/npiTools, version=1.0.0 -> C:\Program Files (x86)\ThinkSky\iTools 3\Extensions\npiTools.dll [2015-04-05] () FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-16] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-16] (Oracle Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2015-02-08] (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-819627596-3724567892-276498191-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File FF Extension: EazyZoom - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\3nwh8e47.default\Extensions\ca@sihjowg.com [2015-04-05] FF Extension: Firebug - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\3nwh8e47.default\Extensions\firebug@software.joehewitt.com.xpi [2015-01-23] FF Extension: Adblock Plus - C:\Users\Besitzer\AppData\Roaming\Mozilla\Firefox\Profiles\3nwh8e47.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-01-24] FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-11-01] FF HKLM-x32\...\Firefox\Extensions: [bdwteff@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff FF HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-16] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= CHR HomePage: Default -> https://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/", "hxxp://www.youtube.de/", "hxxp://www.facebook.de/" CHR DefaultSearchKeyword: Default -> ecosia.org CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-04] CHR Extension: (iCloud) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjhodfififgcgedifpkenofdhlaafokk [2014-08-11] CHR Extension: (YouTube) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-04] CHR Extension: (Adblock Plus) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-07-25] CHR Extension: (Google Search) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-04] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17] CHR Extension: (Google Wallet) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-04] CHR Extension: (Gmail) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-04] CHR Profile: C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1 CHR Extension: (Google Slides) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-30] CHR Extension: (Google Docs) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-30] CHR Extension: (Google Drive) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-30] CHR Extension: (Speedial) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bakijjialdiiboeaknfpmflphhmljfkd [2015-01-30] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-30] CHR Extension: (YouTube) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-30] CHR Extension: (Google Search) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-30] CHR Extension: (Google Sheets) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-30] CHR Extension: (Google Wallet) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-30] CHR Extension: (Gmail) - C:\Users\Besitzer\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-30] CHR HKLM-x32\...\Chrome\Extension: [fabcmochhfpldjekobfaaggijgohadih] - https://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AdobeActiveFileMonitor13.0; C:\Program Files\Adobe\Elements 13 Organizer\PhotoshopElementsFileAgent.exe [231120 2015-01-30] (Adobe Systems Incorporated) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.) S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation) S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-18] (Hewlett-Packard Co.) [File not signed] R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-04-16] (Hewlett-Packard Company) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation) R2 opcddemg; C:\WINDOWS\opcddemg.exe [57344 2004-11-09] () [File not signed] R2 ss_conn_service; C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2604856 2015-02-25] (AVG Technologies) R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [44856 2015-02-25] (AVG Technologies) R2 UxTuneUp; C:\Windows\SysWOW64\uxtuneup.dll [36664 2015-02-25] (AVG Technologies) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-11] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation) R2 NPF; C:\WINDOWS\system32\drivers\npf.sys [35344 2014-07-25] (CACE Technologies, Inc.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) R0 PxHlpa64; C:\Windows\System32\drivers\PxHlpa64.sys [56336 2013-09-03] (Corel Corporation) R3 SaiK1709; C:\Windows\system32\DRIVERS\SaiK1709.sys [180544 2012-09-20] (Saitek) R3 SaiMini; C:\Windows\System32\drivers\SaiMini.sys [25120 2013-04-30] (Saitek) R3 SaiNtBus; C:\Windows\system32\drivers\SaiBus.sys [52640 2013-04-30] (Saitek) R3 SaiU1709; C:\Windows\System32\drivers\SaiU1709.sys [47168 2012-09-20] (Saitek) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-11-24] (TuneUp Software) U0 utomo; C:\Windows\System32\drivers\omawvjy.sys [79064 2015-04-10] (Malwarebytes Corporation) R1 vrvd5; C:\Windows\system32\DRIVERS\vrvd5.sys [13344 2014-10-02] (Rsupport Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation) S3 XSplit_Dummy; C:\Windows\system32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited) R2 {C5F942FD-1110-4664-86CE-0C6BDA305235}; C:\Program Files (x86)\CyberLink\PowerDVD14\Common\NavFilter\000.fcl [32456 2014-03-17] (CyberLink Corp.) S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X] S3 IntcAzAudAddService; \SystemRoot\system32\drivers\RTKVHD64.sys [X] S3 VBoxNetFlt; \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys [X] S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-11 03:36 - 2015-04-11 03:36 - 00034608 _____ () C:\Users\Besitzer\Downloads\Addition.txt 2015-04-11 03:35 - 2015-04-11 18:56 - 00020731 _____ () C:\Users\Besitzer\Downloads\FRST.txt 2015-04-11 03:35 - 2015-04-11 18:56 - 00000000 ____D () C:\FRST 2015-04-11 03:35 - 2015-04-11 03:35 - 02095616 _____ (Farbar) C:\Users\Besitzer\Downloads\FRST64.exe 2015-04-10 16:33 - 2015-04-10 16:33 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\omawvjy.sys 2015-04-10 16:26 - 2015-04-11 18:17 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-04-10 16:25 - 2015-04-10 16:25 - 00001114 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-04-10 16:25 - 2015-04-10 16:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-04-10 16:25 - 2015-04-10 16:25 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-04-10 16:25 - 2015-04-10 16:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-04-10 16:25 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-04-10 16:25 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-04-10 16:25 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-04-10 16:23 - 2015-04-10 16:23 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Besitzer\Downloads\mbam-setup-2.1.4.1018.exe 2015-04-09 19:00 - 2015-04-09 19:00 - 00001625 _____ () C:\Users\Public\Desktop\League of Legends.lnk 2015-04-09 19:00 - 2015-04-09 19:00 - 00000000 ____D () C:\Riot Games 2015-04-09 19:00 - 2015-04-09 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends 2015-04-09 18:59 - 2015-04-09 18:59 - 30668968 _____ (Riot Games) C:\Users\Besitzer\Downloads\LeagueofLegends_EUW_Installer_9_15_2014.exe 2015-04-09 18:13 - 2015-04-09 18:54 - 00080666 _____ () C:\WINDOWS\PFRO.log 2015-04-09 18:13 - 2015-04-09 18:54 - 00001044 _____ () C:\WINDOWS\setupact.log 2015-04-09 18:13 - 2015-04-09 18:13 - 00000000 _____ () C:\WINDOWS\setuperr.log 2015-04-09 18:10 - 2015-04-09 18:40 - 00000000 ____D () C:\AdwCleaner 2015-04-09 18:10 - 2015-04-09 18:10 - 02217984 _____ () C:\Users\Besitzer\Downloads\adwcleaner_4.201 .exe 2015-04-07 17:38 - 2015-04-07 17:45 - 1374690121 _____ () C:\Users\Besitzer\Downloads\iPhone5,3_7.1.2_11D257_Restore.ipsw 2015-04-07 13:06 - 2015-04-07 17:52 - 00000000 ____D () C:\Program Files (x86)\GadgetWide Cloud Control Service 2015-04-07 12:54 - 2015-04-07 12:54 - 00003150 _____ () C:\WINDOWS\System32\Tasks\{76D3D6D1-889E-4FE5-829F-6C2C77B64FAD} 2015-04-07 12:54 - 2015-04-07 12:54 - 00003150 _____ () C:\WINDOWS\System32\Tasks\{5A4EE172-52FB-4E50-85EE-8097CD20D192} 2015-04-06 13:28 - 2015-04-08 20:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\tdeviceservice Activator iCloud Vr1.0.3 2015-04-06 13:16 - 2015-04-06 13:16 - 00003148 _____ () C:\WINDOWS\System32\Tasks\{9A012406-CFF2-491E-A09E-697469B58B14} 2015-04-06 11:08 - 2015-04-06 11:20 - 1374379864 _____ () C:\Users\Besitzer\Downloads\iPhone5,4_7.1.2_11D257_Restore.ipsw 2015-04-06 10:48 - 2015-04-06 13:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare 2015-04-06 10:48 - 2015-04-06 10:48 - 00000000 ___HD () C:\Program Files (x86)\Dr.Fone_Temp 2015-04-06 10:48 - 2015-04-06 10:48 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\Wondershare 2015-04-06 10:48 - 2015-04-06 10:48 - 00000000 ____D () C:\ProgramData\Wondershare 2015-04-05 22:41 - 2015-04-05 22:41 - 00003166 _____ () C:\WINDOWS\System32\Tasks\{3A3A5A7F-3F50-48F7-979E-636304280365} 2015-04-05 22:40 - 2015-04-05 22:40 - 00003166 _____ () C:\WINDOWS\System32\Tasks\{547F115E-AEAC-4A58-AFB2-C163F0F86499} 2015-04-05 20:41 - 2015-04-05 20:43 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Opera Software 2015-04-05 20:41 - 2015-04-05 20:43 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\Opera Software 2015-04-05 15:49 - 2015-04-05 15:49 - 00001765 _____ () C:\Users\Public\Desktop\iTunes.lnk 2015-04-05 15:49 - 2015-04-05 15:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-04-05 15:49 - 2015-04-05 15:49 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-04-05 15:49 - 2015-04-05 15:49 - 00000000 ____D () C:\Program Files\iTunes 2015-04-05 15:49 - 2015-04-05 15:49 - 00000000 ____D () C:\Program Files\iPod 2015-04-05 15:49 - 2015-04-05 15:49 - 00000000 ____D () C:\Program Files (x86)\iTunes 2015-04-05 15:42 - 2015-04-05 15:42 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\TaiG 2015-04-05 14:50 - 2015-04-05 15:05 - 1608951729 _____ () C:\Users\Besitzer\Downloads\iPhone5,4_8.1.3_12B466_Restore.ipsw 2015-04-05 14:41 - 2015-04-05 14:49 - 1609510077 _____ () C:\Users\Besitzer\Downloads\iPhone5,3_8.1.3_12B466_Restore.ipsw 2015-04-05 14:16 - 2015-04-05 14:16 - 00001142 _____ () C:\Users\Besitzer\Desktop\iTools 3.lnk 2015-04-05 14:16 - 2015-04-05 14:16 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\ThinkSky 2015-04-05 14:16 - 2015-04-05 14:16 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iTools 3 2015-04-05 14:16 - 2015-04-05 14:16 - 00000000 ____D () C:\Program Files (x86)\ThinkSky 2015-04-05 09:21 - 2015-04-05 09:21 - 00000000 ___SD () C:\WINDOWS\SysWOW64\GWX 2015-04-05 09:21 - 2015-04-05 09:21 - 00000000 ___SD () C:\WINDOWS\system32\GWX 2015-03-31 11:39 - 2015-03-31 11:39 - 00000000 ____D () C:\Users\Public\Documents\CrashDump 2015-03-31 11:39 - 2015-03-31 11:39 - 00000000 ____D () C:\Program Files\SAMSUNG 2015-03-30 21:49 - 2015-03-30 21:49 - 00000000 ____D () C:\Users\Besitzer\Documents\SelfMV 2015-03-30 12:58 - 2015-04-09 18:07 - 00000000 ____D () C:\Users\Besitzer\Desktop\Stark 2015-03-30 12:53 - 2015-03-30 12:53 - 00000000 ___RD () C:\Users\Besitzer\Documents\Notes 2015-03-29 17:49 - 2015-03-29 17:49 - 00002217 _____ () C:\Users\Public\Desktop\CyberLink PowerDVD 14.lnk 2015-03-29 17:49 - 2015-03-29 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 14 2015-03-29 17:48 - 2015-03-29 17:48 - 00000000 ____D () C:\Program Files (x86)\CyberLink 2015-03-29 13:44 - 2015-03-29 13:44 - 00001985 _____ () C:\Users\Besitzer\Desktop\Skype.lnk 2015-03-29 13:43 - 2015-03-29 13:43 - 00000000 ____D () C:\Users\Besitzer\Tracing 2015-03-29 13:37 - 2014-04-16 01:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll 2015-03-29 13:37 - 2014-04-16 01:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll 2015-03-29 13:35 - 2015-03-29 13:35 - 00000000 ____D () C:\Users\Besitzer\AppData\Temp 2015-03-29 11:21 - 2015-03-29 16:05 - 00000000 ____D () C:\Users\Besitzer\Documents\MK-LOL 2015-03-29 11:20 - 2015-03-29 11:20 - 00000817 _____ () C:\Users\Besitzer\Desktop\MKJogo.lnk 2015-03-29 11:20 - 2015-03-29 11:20 - 00000000 ____D () C:\Users\Besitzer\Documents\MKJogo 2015-03-29 11:13 - 2015-03-06 12:41 - 00789131 _____ () C:\Users\Besitzer\Desktop\AntiTwin.exe 2015-03-27 21:53 - 2015-03-27 21:53 - 00000058 _____ () C:\WINDOWS\JQHApp.dat 2015-03-27 21:52 - 2015-04-05 11:11 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MKJogo 2015-03-24 19:48 - 2015-03-11 04:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2015-03-24 19:48 - 2015-03-11 00:08 - 01107456 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2015-03-24 19:48 - 2015-03-11 00:08 - 00943104 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2015-03-24 19:48 - 2015-03-11 00:08 - 00760320 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2015-03-24 19:48 - 2015-03-11 00:08 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2015-03-24 19:48 - 2015-03-11 00:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2015-03-24 19:48 - 2015-03-11 00:08 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-03-16 19:57 - 2015-03-16 19:57 - 00000000 ____D () C:\Program Files (x86)\Java 2015-03-12 00:53 - 2015-02-04 01:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2015-03-12 00:53 - 2015-02-04 01:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2015-03-12 00:53 - 2015-02-04 01:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2015-03-12 00:53 - 2015-02-03 01:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll 2015-03-12 00:53 - 2015-02-03 01:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll 2015-03-12 00:53 - 2015-01-27 05:44 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe 2015-03-12 00:53 - 2015-01-24 03:51 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe 2015-03-12 00:52 - 2015-03-06 04:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll 2015-03-12 00:52 - 2015-03-06 04:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll 2015-03-12 00:52 - 2015-02-26 01:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2015-03-12 00:52 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-03-12 00:52 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-03-12 00:52 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2015-03-12 00:52 - 2015-02-21 02:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2015-03-12 00:52 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-03-12 00:52 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2015-03-12 00:52 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2015-03-12 00:52 - 2015-02-20 05:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2015-03-12 00:52 - 2015-02-20 04:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2015-03-12 00:52 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-03-12 00:52 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-03-12 00:52 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2015-03-12 00:52 - 2015-02-20 04:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-03-12 00:52 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2015-03-12 00:52 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-03-12 00:52 - 2015-02-20 04:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2015-03-12 00:52 - 2015-02-20 04:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2015-03-12 00:52 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-03-12 00:52 - 2015-02-20 04:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2015-03-12 00:52 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll 2015-03-12 00:52 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2015-03-12 00:52 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-03-12 00:52 - 2015-02-20 03:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2015-03-12 00:52 - 2015-02-20 03:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-03-12 00:52 - 2015-02-20 03:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2015-03-12 00:52 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-03-12 00:52 - 2015-02-20 03:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2015-03-12 00:52 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-03-12 00:52 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-03-12 00:52 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-03-12 00:52 - 2015-02-20 03:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2015-03-12 00:52 - 2015-02-20 03:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2015-03-12 00:52 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-03-12 00:52 - 2015-02-20 03:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2015-03-12 00:52 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2015-03-12 00:52 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-03-12 00:52 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-03-12 00:52 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2015-03-12 00:52 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-03-12 00:52 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-03-12 00:52 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2015-03-12 00:52 - 2015-02-12 19:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2015-03-12 00:52 - 2015-02-12 19:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2015-03-12 00:52 - 2015-02-08 01:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll 2015-03-12 00:52 - 2015-02-08 01:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll 2015-03-12 00:52 - 2015-02-07 01:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2015-03-12 00:52 - 2015-02-06 03:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2015-03-12 00:52 - 2015-02-06 03:08 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2015-03-12 00:52 - 2015-02-05 22:24 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2015-03-12 00:52 - 2015-02-03 02:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll 2015-03-12 00:52 - 2015-02-03 02:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll 2015-03-12 00:52 - 2015-01-31 01:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll 2015-03-12 00:52 - 2015-01-31 01:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll 2015-03-12 00:52 - 2015-01-31 01:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll 2015-03-12 00:52 - 2015-01-30 05:01 - 00097792 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys 2015-03-12 00:52 - 2015-01-30 04:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll 2015-03-12 00:52 - 2015-01-30 04:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll 2015-03-12 00:52 - 2015-01-30 04:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll 2015-03-12 00:52 - 2015-01-30 03:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll 2015-03-12 00:52 - 2015-01-30 03:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll 2015-03-12 00:52 - 2015-01-30 03:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll 2015-03-12 00:52 - 2015-01-30 03:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll 2015-03-12 00:52 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll 2015-03-12 00:52 - 2015-01-30 03:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll 2015-03-12 00:52 - 2015-01-30 03:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll 2015-03-12 00:52 - 2015-01-30 03:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll 2015-03-12 00:52 - 2015-01-30 03:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll 2015-03-12 00:52 - 2015-01-30 03:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll 2015-03-12 00:52 - 2015-01-29 20:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll 2015-03-12 00:52 - 2015-01-29 20:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll 2015-03-12 00:52 - 2015-01-29 03:58 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll 2015-03-12 00:52 - 2015-01-29 03:29 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll 2015-03-12 00:52 - 2015-01-29 03:11 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2015-03-12 00:52 - 2015-01-29 03:04 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2015-03-12 00:52 - 2015-01-29 03:04 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2015-03-12 00:52 - 2015-01-29 03:00 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2015-03-12 00:52 - 2015-01-29 02:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2015-03-12 00:52 - 2015-01-29 02:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2015-03-12 00:52 - 2015-01-29 02:50 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2015-03-12 00:52 - 2015-01-29 02:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2015-03-12 00:52 - 2015-01-28 17:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-03-12 00:52 - 2015-01-28 17:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2015-03-12 00:52 - 2015-01-28 17:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2015-03-12 00:52 - 2015-01-28 04:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll 2015-03-12 00:52 - 2015-01-28 03:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll 2015-03-12 00:52 - 2015-01-28 03:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll 2015-03-12 00:52 - 2015-01-28 03:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll 2015-03-12 00:52 - 2015-01-28 01:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2015-03-12 00:52 - 2015-01-28 01:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2015-03-12 00:52 - 2015-01-27 06:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2015-03-12 00:52 - 2015-01-27 04:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2015-03-12 00:52 - 2015-01-23 09:17 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll 2015-03-12 00:52 - 2015-01-23 07:02 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll 2015-03-12 00:52 - 2015-01-21 07:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll 2015-03-12 00:52 - 2015-01-21 07:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll 2015-03-12 00:52 - 2014-12-11 07:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-11 18:51 - 2014-07-25 19:25 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Skype 2015-04-11 18:39 - 2014-07-04 22:21 - 01294065 _____ () C:\WINDOWS\WindowsUpdate.log 2015-04-11 18:32 - 2014-08-06 17:34 - 00616448 ___SH () C:\Users\Besitzer\Downloads\Thumbs.db 2015-04-11 18:27 - 2015-03-01 21:00 - 00005150 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for JONAS-PC-Besitzer Jonas-PC 2015-04-11 18:20 - 2014-07-04 22:29 - 00003942 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{34A4EA82-B57E-4B37-882E-EDC6AB4A8CFE} 2015-04-11 18:17 - 2014-07-04 22:30 - 00001136 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-11 18:16 - 2014-11-06 18:50 - 00000000 _____ () C:\WINDOWS\system32\Drivers\lvuvc.hs 2015-04-11 18:16 - 2014-07-04 22:30 - 00001132 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-04-11 18:16 - 2014-07-04 22:28 - 00000000 __RDO () C:\Users\Besitzer\OneDrive 2015-04-11 18:16 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-04-11 12:29 - 2014-07-04 23:59 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Spotify 2015-04-11 12:24 - 2014-07-05 00:01 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\Spotify 2015-04-11 11:21 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache 2015-04-11 03:29 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2015-04-11 02:00 - 2014-08-10 01:41 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\Adobe 2015-04-11 00:54 - 2014-07-04 22:33 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-819627596-3724567892-276498191-1001 2015-04-10 16:33 - 2014-08-12 19:02 - 00000000 ____D () C:\WINDOWS\AutoKMS 2015-04-09 19:00 - 2014-03-18 12:03 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-04-09 19:00 - 2014-03-18 11:25 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat 2015-04-09 19:00 - 2014-03-18 11:25 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat 2015-04-09 18:57 - 2014-07-05 17:08 - 00000000 __SHD () C:\WINDOWS\SysWOW64\AI_RecycleBin 2015-04-09 18:54 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-04-09 18:53 - 2013-08-22 15:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2015-04-09 18:43 - 2014-11-06 18:50 - 00014767 _____ () C:\WINDOWS\system32\lvcoinst.log 2015-04-07 16:35 - 2014-07-04 22:26 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\Packages 2015-04-05 23:39 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2015-04-05 21:36 - 2014-07-04 22:37 - 00003248 _____ () C:\WINDOWS\System32\Tasks\SamsungMagician 2015-04-05 21:09 - 2014-07-25 19:24 - 00000000 ____D () C:\ProgramData\Skype 2015-04-05 21:09 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-04-05 20:43 - 2014-07-04 22:26 - 00001450 _____ () C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-04-05 15:49 - 2014-08-26 14:03 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2015-04-05 15:49 - 2014-07-04 23:06 - 00000000 ____D () C:\Program Files\Common Files\Apple 2015-04-05 15:33 - 2014-09-21 22:07 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\redsn0w 2015-04-05 11:09 - 2014-12-25 00:32 - 00000000 ____D () C:\ProgramData\Temp 2015-04-05 09:32 - 2014-07-07 19:01 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\iFunbox_UserCache 2015-04-04 17:20 - 2014-09-19 15:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-04-03 19:36 - 2015-03-10 22:07 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\TS3Client 2015-04-03 18:24 - 2014-07-05 00:01 - 00001866 _____ () C:\Users\Besitzer\Desktop\Spotify.lnk 2015-04-03 18:24 - 2014-07-05 00:01 - 00001852 _____ () C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2015-04-03 17:24 - 2014-11-01 18:03 - 00018960 _____ (Logitech, Inc.) C:\WINDOWS\system32\Drivers\LNonPnP.sys 2015-03-31 11:38 - 2014-07-04 22:32 - 00000000 ____D () C:\ProgramData\Samsung 2015-03-29 17:50 - 2014-12-25 00:43 - 00000000 ____D () C:\Users\Besitzer\Documents\CyberLink 2015-03-29 17:49 - 2014-12-25 00:35 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\CyberLink 2015-03-29 17:49 - 2014-07-06 18:29 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-03-29 17:48 - 2014-12-25 02:04 - 00000000 ____D () C:\ProgramData\SUPPORTDIR 2015-03-29 17:47 - 2014-12-25 00:33 - 00000000 ____D () C:\ProgramData\CyberLink 2015-03-29 17:47 - 2014-12-25 00:33 - 00000000 ____D () C:\ProgramData\CLSK 2015-03-29 15:12 - 2015-01-23 23:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-03-29 13:43 - 2014-07-04 22:24 - 00000000 ____D () C:\Users\Besitzer 2015-03-29 13:41 - 2014-09-19 15:10 - 00000000 ___RD () C:\Program Files (x86)\Skype 2015-03-29 13:39 - 2015-01-24 15:49 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\uTorrent 2015-03-29 10:51 - 2014-12-19 23:18 - 00000000 ____D () C:\Users\Besitzer\AppData\Local\Sony 2015-03-29 10:49 - 2014-07-12 17:16 - 00000000 ____D () C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames 2015-03-29 10:45 - 2014-08-27 16:38 - 00000000 ____D () C:\Users\Besitzer\Documents\Eigene Scans 2015-03-28 20:13 - 2014-10-01 18:26 - 00000000 ____D () C:\Users\Besitzer\Desktop\Pc Tweaker 2015-03-26 18:37 - 2015-01-16 23:10 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Games 2015-03-25 16:55 - 2014-12-12 18:25 - 00000000 ____D () C:\WINDOWS\system32\appraiser 2015-03-25 16:55 - 2014-07-12 10:37 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2015-03-19 21:09 - 2014-12-28 23:35 - 00488824 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2015-03-19 19:03 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2015-03-19 19:03 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-03-19 19:03 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-03-19 19:03 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-03-19 19:03 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore 2015-03-19 19:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender 2015-03-19 19:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2015-03-19 18:20 - 2014-07-08 20:44 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-03-19 18:17 - 2014-07-08 20:44 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-03-17 19:24 - 2015-02-08 19:09 - 00000000 ____D () C:\Program Files\Microsoft Office 15 2015-03-17 15:05 - 2014-03-18 11:40 - 00000000 ____D () C:\Program Files\Windows Journal 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___SD () C:\WINDOWS\system32\dsc 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\sppui 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\setup 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\migwiz 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\Com 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\WinBioPlugIns 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\SystemResetPlatform 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sppui 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\setup 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\migwiz 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\Com 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\IME 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Portable Devices 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Multimedia Platform 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\System 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer 2015-03-17 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Multimedia Platform 2015-03-17 15:05 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\oobe 2015-03-17 15:05 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\Dism 2015-03-17 15:05 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep 2015-03-17 15:05 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\oobe 2015-03-17 15:05 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Dism 2015-03-17 15:05 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\servicing 2015-03-16 22:34 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\WindowsPowerShell 2015-03-16 19:58 - 2014-07-24 12:17 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2015-03-16 19:58 - 2014-07-24 12:17 - 00000000 ____D () C:\ProgramData\Oracle 2015-03-16 19:58 - 2014-07-24 12:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-03-16 19:48 - 2015-02-08 19:34 - 00003102 _____ () C:\WINDOWS\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-819627596-3724567892-276498191-1001 ==================== Files in the root of some directories ======= 2014-09-06 12:20 - 2014-09-06 12:20 - 0099384 _____ () C:\Users\Besitzer\AppData\Roaming\inst.exe 2014-09-06 12:20 - 2014-09-06 12:20 - 0007859 _____ () C:\Users\Besitzer\AppData\Roaming\pcouffin.cat 2014-09-06 12:20 - 2014-09-06 12:20 - 0001167 _____ () C:\Users\Besitzer\AppData\Roaming\pcouffin.inf 2014-09-06 12:21 - 2014-09-06 12:21 - 0000074 _____ () C:\Users\Besitzer\AppData\Roaming\pcouffin.log 2014-09-06 12:20 - 2014-09-06 12:20 - 0082816 _____ (VSO Software) C:\Users\Besitzer\AppData\Roaming\pcouffin.sys 2014-08-04 17:09 - 2014-08-04 17:09 - 0000865 _____ () C:\Users\Besitzer\AppData\Local\recently-used.xbel 2014-09-06 12:16 - 2014-09-06 12:16 - 0000085 ___SH () C:\ProgramData\.zreglib 2015-03-06 11:39 - 2015-03-06 11:39 - 0594994 _____ () C:\ProgramData\1425634602.bdinstall.bin 2014-12-25 02:04 - 2014-12-25 02:04 - 0000032 _____ () C:\ProgramData\Temp.log Some content of TEMP: ==================== C:\Users\Besitzer\AppData\Local\Temp\optprosetup.exe C:\Users\Besitzer\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_64.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-04-11 00:54 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015 Ran by Besitzer at 2015-04-11 03:36:07 Running from C:\Users\Besitzer\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\uTorrent) (Version: 3.4.2.38758 - BitTorrent Inc.) Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) Advanced Archive Password Recovery (HKLM-x32\...\{01011662-76A8-41E8-B1A8-4F8821570AC5}) (Version: 4.54.48.1338 - Elcomsoft Co. Ltd.) Akamai NetSession Interface (HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Akamai) (Version: - Akamai Technologies, Inc) Apple Application Support (32-Bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.) Apple Application Support (64-Bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) AVG PC TuneUp 2015 (de-DE) (x32 Version: 15.0.1001.403 - AVG Technologies) Hidden AVG PC TuneUp 2015 (HKLM-x32\...\AVG PC TuneUp) (Version: 15.0.1001.403 - AVG Technologies) AVG PC TuneUp 2015 (x32 Version: 15.0.1001.403 - AVG Technologies) Hidden Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) BufferChm (x32 Version: 130.0.327.000 - Hewlett-Packard) Hidden CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4954 - CDBurnerXP) CloneDVD 7 Ultimate 7.0.0.10 (HKLM-x32\...\CloneDVD 7 Ultimate_is1) (Version: - Copyright (C) 2003-2013 CloneDVD Studio.) CyberLink PowerDVD 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.3917.58 - CyberLink Corp.) Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden DVDFab 9.1.7.5 (21/11/2014) (HKLM-x32\...\DVDFab 9_is1) (Version: - Fengtao Software Inc.) Free Studio version 6.4.0.1111 (HKLM-x32\...\Free Studio_is1) (Version: 6.4.0.1111 - DVDVideoSoft Ltd.) Free YouTube to MP3 Converter version 3.12.43.806 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.43.806 - DVDVideoSoft Ltd.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.) Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden GPBaseService2 (x32 Version: 130.0.367.000 - Hewlett-Packard) Hidden HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP) HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP) HP Scanjet G2710 (HKLM\...\{15220096-5EA9-4C53-89ED-ADBD38BCA32C}) (Version: 13.0 - HP) HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP) HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard) hpg2710 (x32 Version: 13.0.0.0 - Ihr Firmenname) Hidden HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPProductAssistant (x32 Version: 130.0.367.000 - Hewlett-Packard) Hidden iTools 3 (HKLM-x32\...\ThinkSky) (Version: - Shenzhen Thinksky Technology Co., Ltd.) iTunes (HKLM\...\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.) Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation) League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games ) League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden LightScribe System Software (HKLM-x32\...\{10427BCB-0742-43BE-81E2-3920972946F5}) (Version: 1.18.23.1 - LightScribe) Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech) Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation) Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation) Microsoft OneDrive (HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM-x32\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{6F29F195-B11C-3EAD-B883-997BB29DFA17}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{4fd02573-5f12-4ae4-8027-c63f8e1115af}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) Mindjet MindManager 2012 (HKLM-x32\...\{B1FD6060-8DF9-4C67-AF5E-7D25A54D1854}) (Version: 10.1.459 - Mindjet) OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP) Office 15 Click-to-Run Extensibility Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden Office 15 Click-to-Run Localization Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.) Samsung Kies3 (x32 Version: 3.2.15024.8 - Samsung Electronics Co., Ltd.) Hidden Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.5.1 - Samsung Electronics) SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.) Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.) Smart Technology Programming Software 7.0.27.13 (HKLM\...\{C9193CBB-C31A-412A-A074-AD08F0F2CF3D}) (Version: 7.0.27.13 - Mad Catz) SolutionCenter (x32 Version: 130.0.369.000 - Hewlett-Packard) Hidden Spotify (HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\Spotify) (Version: 1.0.3.101.gbfa97dfe - Spotify AB) TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer) TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden UnderCoverXP 1.23 (HKLM-x32\...\UnderCoverXP_is1) (Version: - Wicked & Wild Inc.) WebReg (x32 Version: 130.0.128.017 - Hewlett-Packard) Hidden WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH) WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - ) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-819627596-3724567892-276498191-1001_Classes\CLSID\{0E7BE950-4ACC-47CB-834B-41A8B96BBFF9}\InprocServer32 -> C:\Users\Besitzer\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Sidebar7.gadget\Release\Sidebar7.64.dll (Helmut Buhler) CustomCLSID: HKU\S-1-5-21-819627596-3724567892-276498191-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Besitzer\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation) ==================== Restore Points ========================= 07-04-2015 12:53:51 GadgetWide Cloud Control Service wird installiert 09-04-2015 18:57:46 Removed League of Legends ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {079C03E4-40E9-4358-92A9-B2A68C741AE6} - System32\Tasks\Microsoft Office 15 Sync Maintenance for JONAS-PC-Besitzer Jonas-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation) Task: {08F1E23F-204A-48AD-A642-7AA96EA4D33C} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation) Task: {091BC294-24E8-44BA-BD4F-B56B872E208B} - System32\Tasks\{547F115E-AEAC-4A58-AFB2-C163F0F86499} => pcalua.exe -a C:\Users\Besitzer\Desktop\notfall\InstMsiA.exe -d C:\Users\Besitzer\Desktop\notfall Task: {17B79FB0-C460-4B57-87AD-54D1D720FBE3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe Task: {1C48FCED-49F3-4503-B5F3-DE46B2404174} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-07] (Google Inc.) Task: {20D307C9-BDBB-4912-9668-99E3E9C2B209} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation) Task: {37B15117-3D12-4AE7-A4E0-FC16549666AB} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-wjonas@hotmail.de => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-08-27] (Adobe Systems Incorporated) Task: {3D929921-9982-4052-8370-4602C2374364} - System32\Tasks\{3A3A5A7F-3F50-48F7-979E-636304280365} => pcalua.exe -a C:\Users\Besitzer\Desktop\notfall\InstMsiW.exe -d C:\Users\Besitzer\Desktop\notfall Task: {4197491D-E393-4602-A630-D21D69B47FA5} - System32\Tasks\{31F33664-A3A6-4523-AAD1-68991C68C935} => pcalua.exe -a D:\win\cdsplash.exe -d D:\ Task: {483CF42B-80F4-4E81-B8F2-03A93F66BBA3} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation) Task: {4F87433E-24CE-4149-9585-4EBFB4533AE3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-07] (Google Inc.) Task: {5513BD3E-AD11-4D01-B9AB-760BD921213F} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation) Task: {86066639-41B4-41A9-811D-B985DCF05493} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {86095A4B-540F-40BE-A1A6-42AB1F0107F1} - System32\Tasks\{6E215ED5-FEB8-4658-89B2-46E60D54B4E6} => pcalua.exe -a D:\win\cdsplash.exe -d D:\ Task: {916098DB-69DF-4964-AC33-2770836C9E62} - System32\Tasks\{76D3D6D1-889E-4FE5-829F-6C2C77B64FAD} => pcalua.exe -a "C:\Users\Besitzer\AppData\Local\Temp\Temp1_gwcc1.2.6 (1).zip\InstMsiA.exe" Task: {95FB5DBB-3C8B-4113-B399-5B3BBCC493DC} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {A648480F-F446-4775-B267-6046FF1339C1} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation) Task: {A74093FD-70E1-4546-B051-62480C392970} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe [2015-02-25] (AVG Technologies) Task: {A7A6E6D4-3F0A-4CCF-8AEC-BA980789D85B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {B3A39E8F-FD77-4CCB-ABCC-1C90C0944518} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-819627596-3724567892-276498191-1001 Task: {B4CFC514-B3C2-4289-A009-B0B2EF46CDE4} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation) Task: {CE4D85DD-1C49-4A30-B405-CE4B94FB4CE4} - System32\Tasks\Games\UpdateCheck_S-1-5-21-819627596-3724567892-276498191-1001 Task: {D03595D3-13ED-4DD2-B5B6-45E0BAA45859} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2013-05-30] (Hewlett-Packard) Task: {D6236B7D-6968-4D84-8602-DAD4453D8B1A} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe [2014-09-28] (Samsung Electronics.) Task: {E205C7F6-30FB-4956-AA1B-FFA74E239448} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-03-07] (Oracle Corporation) Task: {EA05951D-8A21-4955-90DA-40B77C55C678} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-819627596-3724567892-276498191-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe Task: {EB2C0399-D3E2-4FA8-B64E-72C7598CAFB5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-19] (Microsoft Corporation) Task: {EE4917DB-27C7-46CE-A096-5B8E6D1FBE3E} - System32\Tasks\{497BA095-A1A6-472B-A529-73B7835E9D2A} => pcalua.exe -a C:\Users\Besitzer\Downloads\Range_RAT9_SD7_0_20_0_64Bit_Drivers_NonWHQL.exe -d C:\Users\Besitzer\Downloads Task: {EFE9D4B6-B38A-495C-9CA1-E3512B2A28EB} - System32\Tasks\{9A012406-CFF2-491E-A09E-697469B58B14} => pcalua.exe -a C:\ProgramData\eazyzoom\1.1.0.30\Uninstaller.exe -c /ga=1503 /ai=119 /bi=4 Task: {F8CD7867-16D8-4224-A9E5-EEB683E3BCAB} - System32\Tasks\{5A4EE172-52FB-4E50-85EE-8097CD20D192} => pcalua.exe -a "C:\Users\Besitzer\AppData\Local\Temp\Temp1_gwcc1.2.6 (1).zip\InstMsiW.exe" Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============== 2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-02-13 04:20 - 2015-02-13 04:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2015-02-08 19:09 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll 2004-11-09 17:35 - 2004-11-09 17:35 - 00057344 _____ () C:\WINDOWS\opcddemg.exe 2015-02-25 10:25 - 2015-02-25 10:25 - 00712504 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll 2014-07-04 22:21 - 2015-02-04 04:21 - 00115400 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2015-02-25 10:25 - 2015-02-25 10:25 - 00855864 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\tulnga.dll 2015-02-08 19:15 - 2015-02-08 19:24 - 00393376 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE15\AppVIsvStream64.dll 2014-11-25 22:09 - 2014-11-25 22:09 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\ErrorReporting.dll 2015-04-10 23:34 - 2015-03-27 21:51 - 01092296 _____ () F:\Programme\MKJogo\MK IM\Bin\btyqp.exe 2012-06-14 21:11 - 2012-06-14 21:11 - 00325968 _____ () C:\ProgramData\Microsoft\Windows\WER\lua5.1.dll 2014-07-04 22:37 - 2014-09-28 18:59 - 00019872 _____ () C:\Program Files (x86)\Samsung Magician\SAMSUNG_SSD.dll 2015-04-04 22:17 - 2015-03-30 23:07 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libglesv2.dll 2015-04-04 22:17 - 2015-03-30 23:07 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libegl.dll 2015-04-04 22:18 - 2015-03-30 23:07 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll 2015-03-29 11:19 - 2015-03-27 21:51 - 00799232 _____ () F:\Programme\MKJogo\MK IM\Bin\sqlite3.dll 2015-03-29 11:19 - 2015-03-27 21:51 - 01721856 _____ () F:\Programme\MKJogo\MK IM\Bin\RLib.dll 2015-03-29 11:19 - 2015-03-27 21:51 - 01191936 _____ () F:\Programme\MKJogo\MK IM\Bin\ACE.dll 2015-03-29 11:19 - 2015-03-27 21:51 - 00923848 _____ () F:\Programme\MKJogo\MK IM\LOL\AddonSkin-LOL.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\Besitzer\OneDrive:ms-properties AlternateDataStreams: C:\Users\Besitzer\OneDrive.old:ms-properties AlternateDataStreams: C:\Users\Besitzer\Downloads\adwcleaner_4.201 .exe:BDU ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tammgF119.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tammgR119.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tammgF119.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tammgR119.sys => ""="Driver" ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-819627596-3724567892-276498191-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Besitzer\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.0.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\Run: => "ProfilerU" HKLM\...\StartupApproved\Run32: => "Adobe ARM" HKLM\...\StartupApproved\Run32: => "BDRegion" HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\StartupApproved\StartupFolder: => "Sidebar424.lnk" HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\StartupApproved\StartupFolder: => "hqghumeaylnlf.lnk" HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\StartupApproved\Run: => "Spotify Web Helper" HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\StartupApproved\Run: => "Bitdefender-Geldbörse-Agent" HKU\S-1-5-21-819627596-3724567892-276498191-1001\...\StartupApproved\Run: => "Spotify" ==================== Accounts: ============================= Administrator (S-1-5-21-819627596-3724567892-276498191-500 - Administrator - Disabled) Besitzer (S-1-5-21-819627596-3724567892-276498191-1001 - Administrator - Enabled) => C:\Users\Besitzer Gast (S-1-5-21-819627596-3724567892-276498191-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-819627596-3724567892-276498191-1003 - Limited - Enabled) ==================== Faulty Device Manager Devices ============= Name: pcouffin device ... Description: pcouffin device ... Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: WAN-Miniport (Netzwerkmonitor) Description: WAN-Miniport (Netzwerkmonitor) Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: NdisWan Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. Name: WAN-Miniport (IP) Description: WAN-Miniport (IP) Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: NdisWan Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. Name: WAN-Miniport (IPv6) Description: WAN-Miniport (IPv6) Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: NdisWan Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (04/11/2015 00:55:31 AM) (Source: Perflib) (EventID: 1008) (User: ) Description: WmiApRplC:\WINDOWS\system32\wbem\wmiaprpl.dll8 Error: (04/11/2015 00:54:05 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (04/10/2015 11:37:24 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: LolClient.exe, Version: 0.0.0.0, Zeitstempel: 0x515663e0 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54504ade Ausnahmecode: 0x40010006 Fehleroffset: 0x00014598 ID des fehlerhaften Prozesses: 0x11f0 Startzeit der fehlerhaften Anwendung: 0xLolClient.exe0 Pfad der fehlerhaften Anwendung: LolClient.exe1 Pfad des fehlerhaften Moduls: LolClient.exe2 Berichtskennung: LolClient.exe3 Vollständiger Name des fehlerhaften Pakets: LolClient.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LolClient.exe5 Error: (04/10/2015 06:03:54 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Explorer.EXE, Version 6.3.9600.17667 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: c38 Startzeit: 01d073a78f100c88 Endzeit: 0 Anwendungspfad: C:\WINDOWS\Explorer.EXE Berichts-ID: 2532a23a-df9b-11e4-82b3-001fd0dbb842 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (04/09/2015 06:34:30 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm chrome.exe, Version 41.0.2272.118 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1c4c Startzeit: 01d072e1e4b27e01 Endzeit: 4294967295 Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Berichts-ID: 4a9b94ee-ded6-11e4-82b2-001fd0dbb842 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (04/09/2015 06:34:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: JONAS-PC) Description: Die App „DefaultBrowser_NOPUBLISHERID+Chrome“ wurde nicht innerhalb der vorgesehenen Zeit gestartet. Error: (04/09/2015 06:20:13 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Explorer.EXE, Version 6.3.9600.17667 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 7cc Startzeit: 01d072e01524e20d Endzeit: 0 Anwendungspfad: C:\WINDOWS\Explorer.EXE Berichts-ID: 45993cf8-ded4-11e4-82b1-001fd0dbb842 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (04/09/2015 06:19:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: LolClient.exe, Version: 0.0.0.0, Zeitstempel: 0x515663e0 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54504ade Ausnahmecode: 0x40010006 Fehleroffset: 0x00014598 ID des fehlerhaften Prozesses: 0x16f8 Startzeit der fehlerhaften Anwendung: 0xLolClient.exe0 Pfad der fehlerhaften Anwendung: LolClient.exe1 Pfad des fehlerhaften Moduls: LolClient.exe2 Berichtskennung: LolClient.exe3 Vollständiger Name des fehlerhaften Pakets: LolClient.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LolClient.exe5 Error: (04/09/2015 06:13:15 PM) (Source: ESENT) (EventID: 455) (User: ) Description: taskhostex (556) WebCacheLocal: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\Users\Besitzer\AppData\Local\Microsoft\Windows\WebCache\V0100005.log. Error: (04/08/2015 09:56:25 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: JONAS-PC) Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2147024865. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. System errors: ============= Error: (04/10/2015 06:58:58 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT) Description: Fehler beim Lesen der Datei für lokale Hosts. Error: (04/10/2015 04:26:04 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT) Description: Fehler beim Lesen der Datei für lokale Hosts. Error: (04/10/2015 04:23:21 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung vom Remoteendpunkt empfangen. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 80. Error: (04/10/2015 04:20:19 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT) Description: Fehler beim Lesen der Datei für lokale Hosts. Error: (04/09/2015 06:54:05 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT) Description: Fehler beim Lesen der Datei für lokale Hosts. Error: (04/09/2015 06:45:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Bitdefender Desktop Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/09/2015 06:24:38 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT) Description: Fehler beim Lesen der Datei für lokale Hosts. Error: (04/09/2015 06:13:15 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT-AUTORITÄT) Description: Fehler beim Lesen der Datei für lokale Hosts. Error: (04/09/2015 06:12:15 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts. Error: (04/09/2015 06:12:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Microsoft Office Sessions: ========================= Error: (04/11/2015 00:55:31 AM) (Source: Perflib) (EventID: 1008) (User: ) Description: WmiApRplC:\WINDOWS\system32\wbem\wmiaprpl.dll8 Error: (04/11/2015 00:54:05 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: System-reserviertFalscher Parameter. (0x80070057) Error: (04/10/2015 11:37:24 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: LolClient.exe0.0.0.0515663e0KERNELBASE.dll6.3.9600.1741554504ade400100060001459811f001d073d6370b9e6aC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.139\deploy\LolClient.exeC:\WINDOWS\SYSTEM32\KERNELBASE.dllc6784523-dfc9-11e4-82b3-001fd0dbb842 Error: (04/10/2015 06:03:54 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Explorer.EXE6.3.9600.17667c3801d073a78f100c880C:\WINDOWS\Explorer.EXE2532a23a-df9b-11e4-82b3-001fd0dbb842 Error: (04/09/2015 06:34:30 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: chrome.exe41.0.2272.1181c4c01d072e1e4b27e014294967295C:\Program Files (x86)\Google\Chrome\Application\chrome.exe4a9b94ee-ded6-11e4-82b2-001fd0dbb842 Error: (04/09/2015 06:34:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: JONAS-PC) Description: DefaultBrowser_NOPUBLISHERID+Chrome Error: (04/09/2015 06:20:13 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Explorer.EXE6.3.9600.176677cc01d072e01524e20d0C:\WINDOWS\Explorer.EXE45993cf8-ded4-11e4-82b1-001fd0dbb842 Error: (04/09/2015 06:19:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: LolClient.exe0.0.0.0515663e0KERNELBASE.dll6.3.9600.1741554504ade400100060001459816f801d072e0ac95f3cfF:\Programme\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.139\deploy\LolClient.exeC:\WINDOWS\SYSTEM32\KERNELBASE.dll348e0a21-ded4-11e4-82b1-001fd0dbb842 Error: (04/09/2015 06:13:15 PM) (Source: ESENT) (EventID: 455) (User: ) Description: taskhostex556WebCacheLocal: C:\Users\Besitzer\AppData\Local\Microsoft\Windows\WebCache\V0100005.log-1811 (0xfffff8ed) Error: (04/08/2015 09:56:25 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: JONAS-PC) Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2147024865 ==================== Memory info =========================== Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz Percentage of memory in use: 37% Total physical RAM: 4094.48 MB Available physical RAM: 2541.17 MB Total Pagefile: 6183.04 MB Available Pagefile: 3772.32 MB Total Virtual: 131072 MB Available Virtual: 131071.79 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:111.45 GB) (Free:41.89 GB) NTFS Drive f: (Daten) (Fixed) (Total:232.83 GB) (Free:225.46 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: F908D888) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 232.8 GB) (Disk ID: 23F12D67) Partition 1: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
11.04.2015, 18:16 | #4 | |
/// TB-Ausbilder /// Anleitungs-Guru | Adware automatisch in neuen Tabs Hi, für was brauchst Du denn dieses TuneUp-Zeug, das würde ich als erstes deinstallieren. Bzgl. WAN: Zitat:
Bitte mach mal neue Scans: Schritt 1
Schritt 2
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
11.04.2015, 18:36 | #5 |
| Adware automatisch in neuen TabsCode:
ATTFilter # AdwCleaner v4.201 - Bericht erstellt 11/04/2015 um 19:33:13 # Aktualisiert 08/04/2015 von Xplode # Datenbank : 2015-04-08.1 [Server] # Betriebssystem : Windows 8.1 (x64) # Benutzername : Besitzer - JONAS-PC # Gestarted von : C:\Users\Besitzer\Downloads\adwcleaner_4.201 .exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Geplante Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local> ***** [ Internetbrowser ] ***** -\\ Internet Explorer v11.0.9600.17416 -\\ Mozilla Firefox v -\\ Google Chrome v41.0.2272.118 ************************* AdwCleaner[R0].txt - [8576 Bytes] - [09/04/2015 18:10:49] AdwCleaner[R1].txt - [1026 Bytes] - [09/04/2015 18:39:28] AdwCleaner[R2].txt - [1086 Bytes] - [11/04/2015 19:22:47] AdwCleaner[R3].txt - [1145 Bytes] - [11/04/2015 19:26:48] AdwCleaner[R4].txt - [1205 Bytes] - [11/04/2015 19:32:30] AdwCleaner[S0].txt - [7497 Bytes] - [09/04/2015 18:12:13] AdwCleaner[S1].txt - [1125 Bytes] - [11/04/2015 19:33:13] ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1184 Bytes] ########## |
11.04.2015, 18:41 | #6 |
/// TB-Ausbilder /// Anleitungs-Guru | Adware automatisch in neuen Tabs OK.
__________________ --> Adware automatisch in neuen Tabs |
11.04.2015, 18:46 | #7 |
| Adware automatisch in neuen Tabs habe mit Malewarebytes den Scan nun durchgeführt, wurde aber nichts gefunden Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 11.04.2015 Suchlauf-Zeit: 19:37:15 Logdatei: ghjk.txt Administrator: Ja Version: 2.01.4.1018 Malware Datenbank: v2015.04.11.04 Rootkit Datenbank: v2015.03.31.01 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Besitzer Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 389474 Verstrichene Zeit: 6 Min, 50 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) |
11.04.2015, 18:48 | #8 |
/// TB-Ausbilder /// Anleitungs-Guru | Adware automatisch in neuen Tabs Gut, dann schauen wir noch mit ESET bevor es Chrome an den Kragen geht... Schritt 1 ESET Online Scanner
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
11.04.2015, 19:23 | #9 |
| Adware automatisch in neuen Tabs 4 Sachen wurden wurden gefunden ! das ist der Log dazu : Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=72e8cb75a12e6541aa2e324f2782c5b2 # engine=23334 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2015-04-11 06:20:11 # local_time=2015-04-11 08:20:11 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.2.9200 NT # compatibility_mode_1='' # compatibility_mode=5893 16776574 100 94 1991808 53657704 0 0 # scanned=281541 # found=4 # cleaned=4 # scan_time=1579 sh=78B8293173E219D632F0C53CC191CFCFD5CFFE25 ft=1 fh=18e76e8487fd4e12 vn="Variante von Win32/Adware.AddLyrics.DY Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\version14CheckMeUp\temp\Uninstall.exe.vir" sh=5887884230F0A12401A97E2906BCB929202106E8 ft=1 fh=b676b1f0417faf9b vn="Variante von Win64/Adware.PennyBee.D Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\WINDOWS\System32\drivers\tammgf119.sys.vir" sh=C79C31A9B10D851A33EC0C5A08D66539A26163B6 ft=1 fh=124396f14067a6cf vn="Win64/Adware.PennyBee.D Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\WINDOWS\System32\drivers\tammgr119.sys.vir" sh=F8700E46CCBDC534FE8571AB7829614A2D5EFD10 ft=1 fh=b9dcc85acb1b71c0 vn="Variante von Win32/SProtector.Q evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Besitzer\AppData\Local\Temp\optprosetup.exe" |
12.04.2015, 10:13 | #10 |
/// TB-Ausbilder /// Anleitungs-Guru | Adware automatisch in neuen Tabs Dann bitte Chrome mit Revo deinstallieren. (Lesezeichen falls nötig vorher sichern) Schritt 1 Lade Dir bitte Revo Uninstallerhier herunter. Entpacke die zip-Datei auf den Desktop. Anleitung
Neu installieren: https://www.google.de/chrome/browser/desktop/ Wie schauts jetzt aus?
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
13.04.2015, 19:03 | #11 |
| Adware automatisch in neuen Tabs Ich muss leider sagen das sich immer noch nichts verändert hat auch nach mehrmaligem Suchlauf von Antimalware und dem Revo Uninstaller. Hatte auch heute mal den normalen Internet Explorer benutzt und dort kam das gleiche auch |
13.04.2015, 20:19 | #12 |
/// TB-Ausbilder /// Anleitungs-Guru | Adware automatisch in neuen Tabs Das Problem besteht also identisch bei allen Browsern?
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
13.04.2015, 20:32 | #13 |
| Adware automatisch in neuen Tabs Ja, ich denke die haben sich halt in meinen Wan-Miniports eingeklickt. Dadurch öffnen immer diese Seiten. Was auch interessant ist wenn ich z.B League of Legends spiele und plötzlich der PC meint die Werbung zu öffnen, hat nicht mehr Priorität außer diese Werbung und minimiert alles und öffnet den Browser. Solangsam wird das echt lästig. |
13.04.2015, 20:37 | #14 |
/// TB-Ausbilder /// Anleitungs-Guru | Adware automatisch in neuen Tabs Gibts denn nen anderen PC mit dem Du Dich auf die gleiche Weise verbinden könntest wie mit dem "infizierten"? Also gleicher Router etc.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
13.04.2015, 21:36 | #15 |
| Adware automatisch in neuen Tabs Ich bin mir noch nicht so sicher was sie meinen, aber alle unsere PCs im Haus sind in einem Heimnetzwerk und mit Netgear Ethernet Routern verbunden. Nur mein PC hat dieses Problem die anderen im Haus nicht. MfG DJFly64 |
Themen zu Adware automatisch in neuen Tabs |
.com, adware, anti-malware, automatisch, automatische, automatische updates, browser, chrome automatisch tab öffnung virus, frage, fragen, google, internet, malwarebytes, neue, neuen, neustart, problem, seite, tab, tool, trojaner, trojaner board, updates, werbung, windows, öffnet |