| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Ads by SalePlus - Wie werde ich das los?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
16.04.2015, 21:48
| #1 |
 |  Ads by SalePlus - Wie werde ich das los? Hey Leute, seit kurzer Zeit ist Chrome versucht worden. Überall sind Werbeanzeigen und es öffnen sich ungewünschte Pop-Ups. Zum Glück habe ich ABP, aber die Rahmen der Werbeanzeigen sind trotzdem da, ätzend. Wie werde ich diesen Virus los. Bitte helft mir weiter. Die Werbeanzeigen stammen von "Ads by SalePlus". Gruß Borgash |
|
16.04.2015, 21:51
| #2 |
| /// TB-Ausbilder /// Anleitungs-Guru  | Ads by SalePlus - Wie werde ich das los? Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das... 
 Hinweis:Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert. Adware & Co. können wir sehr gut entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean  bekommst.Los geht's: Schritt 1 Bitte deinstalliere folgende Programme: bestadblocker CommentBlocker SalePlus Versuche es bei Windows 8  mit der Windowstaste + X über  .Sollte das nicht gehen, lade Dir bitte Revo Uninstaller  hier herunter. Entpacke die zip-Datei auf den Desktop. Anleitung
Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter. Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus: Schritt 2 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 3  
Schritt 4   Bitte starte FRST erneut, markiere auch die checkbox  und drücke auf Scan. Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________ |
|
16.04.2015, 21:58
| #3 |
| | Ads by SalePlus - Wie werde ich das los? Hey,
__________________das ging schnell, Schritt 1 habe ich erledigt. Ich habe folgendes Problem bei Schritt 2, wenn ich auf suchen klicke erscheint eine Fehlermeldung: Geändert von Borgash (16.04.2015 um 22:00 Uhr) Grund: Ergänzung |
|
16.04.2015, 22:00
| #4 |
| /// TB-Ausbilder /// Anleitungs-Guru | Ads by SalePlus - Wie werde ich das los? Adwcleaner nochmal runterladen und auf dem Desktop speichern. Scan wiederholen
__________________ Gruß deeprybka  Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
16.04.2015, 22:04
| #5 |
| | Ads by SalePlus - Wie werde ich das los? Habs deinstalliert und auf den Desktop neu runtergeladen, geht immer noch nicht :O |
|
16.04.2015, 22:22
| #6 |
| | Ads by SalePlus - Wie werde ich das los? Ok Schritt 2 ließ sich jetzt doch ausführen und Schritt 3 läuft noch. Hier schonmal die Datei von AdwC: |
|
16.04.2015, 22:30
| #7 |
| | Ads by SalePlus - Wie werde ich das los? EDIT: Schritt 3 & 4, aber ich sehe immer noch Werbeanzeigen in Chrome ... Das Protection-log: Code:
ATTFilter <?xml version="1.0" encoding="UTF-8" ?>
<logs>
<record severity="debug" LoggingEventType="1" datetime="2015-04-16T23:17:59.414685+02:00" source="Manual" type="Update" username="SYSTEM" systemname="CALVINSPC" fromVersion="2015.2.25.1" last_modified_tag="620420e3-91b4-42c3-9826-2cfd9598e7b4" name="Rootkit Database" toVersion="2015.3.31.1"></record>
<record severity="debug" LoggingEventType="1" datetime="2015-04-16T23:17:59.422687+02:00" source="Manual" type="Update" username="SYSTEM" systemname="CALVINSPC" fromVersion="2015.3.9.1" last_modified_tag="352caa50-8453-4140-9251-621e613220b5" name="Remediation Database" toVersion="2015.4.6.2"></record>
<record severity="debug" LoggingEventType="1" datetime="2015-04-16T23:18:09.106297+02:00" source="Manual" type="Update" username="SYSTEM" systemname="CALVINSPC" fromVersion="2015.3.9.5" last_modified_tag="471a9de1-afbe-472f-9643-2967859e4333" name="Malware Database" toVersion="2015.4.16.5"></record>
<record severity="debug" scantype="threat" LoggingEventType="6" starttime="2015-04-16T23:18:43+02:00" datetime="2015-04-16T23:23:17.898275+02:00" source="Manual" type="Scan" username="SYSTEM" systemname="CALVINSPC" last_modified_tag="09ca5455-fe69-4ca7-949f-b2b7cae0db01" duration="257" malwaredetections="0" nonmalwaredetections="9" scanresult="completed"></record>
<record severity="debug" LoggingEventType="4" datetime="2015-04-16T23:23:56.396262+02:00" source="Protection" type="Error" username="SYSTEM" systemname="CALVINSPC" code="13" last_modified_tag="d32f7e77-0a5a-4982-ae1e-29d452066022" message="IsLicensed"></record>
<record severity="debug" LoggingEventType="2" datetime="2015-04-16T23:23:56.396262+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="CALVINSPC" last_modified_tag="744cf5de-e118-4284-ad35-477a4bf21f89" result="Stopping" subtype="Malware Protection"></record>
<record severity="debug" LoggingEventType="2" datetime="2015-04-16T23:23:56.396262+02:00" source="Protection" type="Protection" username="SYSTEM" systemname="CALVINSPC" last_modified_tag="0e43a5b4-28ea-4355-ad65-3b07f7ffb759" result="Stopped" subtype="Malware Protection"></record>
</logs>
Das mbam-log: Code:
ATTFilter <?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2015/04/16 23:18:43 +0200</date>
<logfile>mbam-log-2015-04-16 (23-18-41).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.01.4.1018</version>
<malware-database>v2015.04.16.05</malware-database>
<rootkit-database>v2015.03.31.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 8.1</osversion>
<arch>x64</arch>
<username>Calvin</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>334692</objects>
<time>257</time>
<processes>1</processes>
<modules>0</modules>
<keys>2</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>6</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>enabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<process><path>C:\ProgramData\{ba52643a-3dc7-41af-ba52-2643a3dc90e8}\GTA5FileCheck_SHA1.exe</path><vendor>PUP.Optional.MultiPlug</vendor><action>delete-on-reboot</action><pid>2660</pid><hash>6ed76c01dbaf9f97d28aa7a0df23ac54</hash></process>
<key><path>HKU\S-1-5-21-418541192-818026106-2851604207-1001_Classes\TYPELIB\{157B1AA6-3E5C-404A-9118-C1D91F537040}</path><vendor>PUP.Optional.MultiPlug</vendor><action>success</action><hash>be870b62c5c5bd79abb1252243bfff01</hash></key>
<key><path>HKU\S-1-5-21-418541192-818026106-2851604207-1001_Classes\INTERFACE\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}</path><vendor>PUP.Optional.MultiPlug</vendor><action>success</action><hash>be870b62c5c5bd79abb1252243bfff01</hash></key>
<file><path>C:\ProgramData\{ba52643a-3dc7-41af-ba52-2643a3dc90e8}\GTA5FileCheck_SHA1.exe</path><vendor>PUP.Optional.MultiPlug</vendor><action>delete-on-reboot</action><hash>6ed76c01dbaf9f97d28aa7a0df23ac54</hash></file>
<file><path>C:\Users\Calvin\AppData\Local\Temp\5964.tmp</path><vendor>PUP.Optional.Wajam.A</vendor><action>success</action><hash>64e19dd02268fc3a00e9e78c26dab947</hash></file>
<file><path>C:\Users\Calvin\AppData\Local\Temp\E530.exe</path><vendor>PUP.Optional.MultiPlug</vendor><action>success</action><hash>3114d19c791172c4dd7fa3a43bc7867a</hash></file>
<file><path>C:\Users\Calvin\AppData\Local\Temp\nsa50FA.tmp\install62293.exe</path><vendor>PUP.Optional.Somoto</vendor><action>success</action><hash>a89d8edf64268fa7e8552ea73fc6b947</hash></file>
<file><path>C:\Users\Calvin\AppData\Local\Temp\BB40\temp\GTA5FileCheck_SHA1.exe</path><vendor>PUP.Optional.MultiPlug</vendor><action>success</action><hash>be870b62c5c5bd79abb1252243bfff01</hash></file>
<file><path>C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences</path><vendor>PUP.Optional.Spigot.A</vendor><action>replaced</action><baddata> "homepage": "hxxp://de.search.yahoo.com/?fr=spigot-yhp-gcmac&ilc=12&type=967150",</baddata><gooddata></gooddata><hash>b392fb7223670531c5da2a17e71fa15f</hash></file>
</items>
</mbam-log>
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-04-2015 04 Ran by Calvin (administrator) on CALVINSPC on 16-04-2015 23:30:15 Running from D:\Downloads Loaded Profiles: Calvin (Available profiles: Calvin) Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\System32\PnkBstrA.exe () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe () D:\Programme\Battle.net\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe (Razer, Inc.) C:\Program Files (x86)\Razer\InGameEngine\32bit\RazerIngameEngine.exe (Razer, Inc.) C:\Users\Calvin\AppData\Local\Razer\InGameEngine\cache\RzStats.Manager\RzCefRenderProcess.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Malwarebytes Corporation) D:\Programme\ Malwarebytes Anti-Malware \mbam.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe (Microsoft Corporation) C:\Windows\System32\prevhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [590144 2015-03-12] (Razer Inc.) HKU\S-1-5-21-418541192-818026106-2851604207-1001\...\Run: [Steam] => D:\Programme\Steam\steam.exe [2889408 2015-04-14] (Valve Corporation) HKU\S-1-5-21-418541192-818026106-2851604207-1001\...\Run: [GoogleChromeAutoLaunch_848C4000ABCA311BCEF8AFBBE29C4B86] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [809288 2015-03-30] (Google Inc.) Startup: C:\Users\Calvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GTA5FileCheck_SHA1.lnk ShortcutTarget: GTA5FileCheck_SHA1.lnk -> C:\ProgramData\{ba52643a-3dc7-41af-ba52-2643a3dc90e8}\GTA5FileCheck_SHA1.exe (No File) Startup: C:\Users\Calvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\My_AutoWarkey_Script.lnk ShortcutTarget: My_AutoWarkey_Script.lnk -> D:\Programme\Battle.net\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe () ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-418541192-818026106-2851604207-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-03-09] (Microsoft Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-03-09] (Microsoft Corporation) FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (ESN Social Software AB) FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB) FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2015-03-09] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-04-08] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-04-08] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin HKU\S-1-5-21-418541192-818026106-2851604207-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Calvin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-03-27] (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-418541192-818026106-2851604207-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-04-06] () Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR HomePage: Default -> hxxp://de.search.yahoo.com/?fr=spigot-yhp-gcmac&ilc=12&type=967150 CHR StartupUrls: Default -> "hxxp://www.spiegel.de/" CHR Profile: C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-06] CHR Extension: (Google Docs) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-06] CHR Extension: (Google Drive) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-06] CHR Extension: (YouTube) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-06] CHR Extension: (Adblock Plus) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-02-06] CHR Extension: (Google Search) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-06] CHR Extension: (Google Sheets) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-06] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-03] CHR Extension: (Google Wallet) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-06] CHR Extension: (Gmail) - C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-06] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-07-04] () S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [967040 2015-03-20] () S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344168 2015-03-06] (Intel Corporation) S2 MBAMService; D:\Programme\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation) S3 Origin Client Service; D:\Programme\Origin\OriginClientService.exe [1931632 2015-04-10] (Electronic Arts) R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2015-04-08] () R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75064 2015-04-08] () R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [187072 2015-02-05] () R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation) S2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-07-04] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-16] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation) R3 NVVADARM; C:\Windows\system32\drivers\nvvadarm.sys [39056 2015-04-09] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-03-13] (NVIDIA Corporation) R3 rzdaendpt; C:\Windows\System32\drivers\rzdaendpt.sys [33448 2014-12-30] (Razer Inc) R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-02-05] (Razer, Inc.) R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129600 2014-12-10] (Razer, Inc.) R3 rzvkeyboard; C:\Windows\System32\drivers\rzvkeyboard.sys [31912 2014-12-30] (Razer Inc) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation) S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation) S3 ALSysIO; \??\C:\Users\Calvin\AppData\Local\Temp\ALSysIO64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-16 23:23 - 2015-04-16 23:23 - 00006596 _____ () C:\Users\Calvin\Desktop\mbam-log-2015-04-16 (23-18-41).xml 2015-04-16 23:17 - 2015-04-16 23:24 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-04-16 23:17 - 2015-04-16 23:23 - 00002187 _____ () C:\Users\Calvin\Desktop\protection-log-2015-04-16.xml 2015-04-16 23:17 - 2015-04-16 23:17 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-04-16 23:17 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-04-16 23:17 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-04-16 23:17 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-04-16 23:07 - 2015-04-16 23:07 - 02217984 _____ () C:\Users\Calvin\Desktop\AdwCleaner_4.201.exe 2015-04-16 22:55 - 2015-04-16 23:11 - 00000000 ____D () C:\AdwCleaner 2015-04-16 22:41 - 2015-04-16 23:30 - 00000000 ____D () C:\FRST 2015-04-16 12:00 - 2015-01-06 05:01 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys 2015-04-16 12:00 - 2015-01-06 04:59 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys 2015-04-16 12:00 - 2015-01-06 03:12 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll 2015-04-16 12:00 - 2015-01-06 03:02 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll 2015-04-15 12:51 - 2015-04-08 22:32 - 00560968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2015-04-15 12:51 - 2015-03-23 23:59 - 07476032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-04-15 12:51 - 2015-03-23 23:59 - 01733952 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-04-15 12:51 - 2015-03-23 23:59 - 00360480 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll 2015-04-15 12:51 - 2015-03-23 23:58 - 01498872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-04-15 12:51 - 2015-03-23 23:45 - 00257216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll 2015-04-15 12:51 - 2015-03-20 06:12 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll 2015-04-15 12:51 - 2015-03-20 06:10 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-04-15 12:51 - 2015-03-20 06:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-04-15 12:51 - 2015-03-20 05:17 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe 2015-04-15 12:51 - 2015-03-20 04:41 - 00369152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe 2015-04-15 12:51 - 2015-03-20 04:40 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2015-04-15 12:51 - 2015-03-20 04:16 - 00749568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2015-04-15 12:51 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-04-15 12:51 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-04-15 12:51 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-04-15 12:51 - 2015-03-13 05:53 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-04-15 12:51 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-04-15 12:51 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-04-15 12:51 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-04-15 12:51 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-04-15 12:51 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-04-15 12:51 - 2015-03-13 05:17 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-04-15 12:51 - 2015-03-13 05:16 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-04-15 12:51 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-04-15 12:51 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-04-15 12:51 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-04-15 12:51 - 2015-03-13 04:58 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2015-04-15 12:51 - 2015-03-13 04:50 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-04-15 12:51 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-04-15 12:51 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-04-15 12:51 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-04-15 12:51 - 2015-03-13 04:37 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2015-04-15 12:51 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-04-15 12:51 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-04-15 12:51 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-04-15 12:51 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-04-15 12:51 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-04-15 12:51 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-04-15 12:51 - 2015-03-04 12:25 - 00377152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys 2015-04-15 12:51 - 2015-03-04 05:04 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll 2015-04-15 12:51 - 2015-03-04 04:19 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll 2015-04-15 12:51 - 2015-02-24 10:32 - 00991552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys 2015-04-15 12:50 - 2015-04-09 02:58 - 31570064 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 30397072 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 25375048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 24053576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 15818528 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 15716232 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 14006752 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 12852784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 11380728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 10423952 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-04-15 12:50 - 2015-04-09 02:58 - 02896528 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 02573456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 01895568 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435012.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435012.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 01086424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 01047368 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 01037640 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00970568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00962192 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00927440 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00849552 _____ () C:\Windows\system32\nvmcumd.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00499344 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00402576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00346256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00175880 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00154256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00150648 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00128512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00100680 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcaparm.dll 2015-04-15 12:50 - 2015-04-09 02:58 - 00039056 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvadarm.sys 2015-04-14 23:59 - 2015-04-14 23:59 - 00000000 ____D () C:\Users\Calvin\AppData\Local\openvr 2015-04-14 21:53 - 2015-04-14 21:53 - 00000000 ____D () C:\ProgramData\ddamfopekkfljbjofianfknikcmpkfip 2015-04-14 21:53 - 2015-04-14 21:53 - 00000000 ____D () C:\ProgramData\15708857695418715502 2015-04-14 21:52 - 2015-04-16 23:23 - 00000000 ____D () C:\ProgramData\{ba52643a-3dc7-41af-ba52-2643a3dc90e8} 2015-04-14 20:08 - 2015-04-16 21:39 - 00000080 _____ () C:\Users\Calvin\AppData\Local剜捯獫慴慇敭屳呇⁁屖湥楴汴浥湥湩潦 2015-04-14 00:28 - 2015-04-14 00:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft 2015-04-12 00:50 - 2015-03-14 10:54 - 00133256 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2015-04-12 00:50 - 2015-03-14 03:56 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2015-04-12 00:50 - 2015-03-14 03:56 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2015-04-12 00:50 - 2015-03-14 03:51 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll 2015-04-12 00:50 - 2015-03-14 03:37 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll 2015-04-12 00:50 - 2015-03-14 03:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2015-04-12 00:50 - 2015-03-14 02:22 - 03678720 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2015-04-12 00:50 - 2015-03-14 02:12 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2015-04-12 00:50 - 2015-03-14 02:12 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2015-04-12 00:50 - 2015-03-14 02:09 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll 2015-04-12 00:50 - 2015-03-14 02:08 - 00408064 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2015-04-12 00:50 - 2015-03-14 02:08 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2015-04-12 00:50 - 2015-03-14 02:06 - 02373632 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2015-04-12 00:50 - 2015-03-14 02:06 - 00891392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2015-04-12 00:50 - 2015-03-14 02:02 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2015-04-12 00:50 - 2015-03-14 02:02 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2015-04-12 00:50 - 2015-03-14 01:59 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2015-04-12 00:50 - 2015-03-14 01:59 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2015-04-10 15:32 - 2015-04-15 00:56 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-04-10 15:32 - 2015-04-14 01:38 - 00000000 ____D () C:\Program Files\Rockstar Games 2015-04-10 15:32 - 2015-04-10 15:32 - 00000000 ____D () C:\Users\Calvin\AppData\Local\Rockstar Games 2015-04-10 15:32 - 2015-04-10 15:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games 2015-04-09 23:33 - 2015-04-09 23:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps 2015-04-09 17:45 - 2015-04-15 01:16 - 00000000 ____D () C:\Users\Calvin\AppData\Local\My Games 2015-04-09 17:41 - 2015-04-09 17:41 - 00000000 ____D () C:\Users\Calvin\AppData\Local\RzStats 2015-04-09 15:28 - 2015-04-10 11:41 - 00000000 ____D () C:\Users\Calvin\AppData\Roaming\NVIDIA 2015-04-09 15:06 - 2015-04-15 12:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2015-04-09 15:06 - 2015-04-09 15:06 - 00000000 ____D () C:\Users\Calvin\AppData\Local\NVIDIA Corporation 2015-04-09 15:06 - 2015-03-28 05:44 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2015-04-09 15:06 - 2015-03-28 05:44 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2015-04-09 15:06 - 2015-03-28 05:43 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll 2015-04-09 15:06 - 2015-03-28 05:43 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2015-04-09 15:05 - 2015-04-16 23:23 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-04-09 15:05 - 2015-04-09 02:58 - 17176128 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2015-04-09 15:05 - 2015-04-09 02:58 - 14617288 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2015-04-09 15:05 - 2015-04-09 02:58 - 12689592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2015-04-09 15:05 - 2015-04-09 02:58 - 03317344 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2015-04-09 15:05 - 2015-04-09 02:58 - 02935416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2015-04-09 15:05 - 2015-04-09 02:58 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvmcvadgenco64.dll 2015-04-09 15:05 - 2015-04-09 02:58 - 00029329 _____ () C:\Windows\system32\nvinfo.pb 2015-04-09 15:05 - 2015-04-08 23:30 - 06841488 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2015-04-09 15:05 - 2015-04-08 23:30 - 03478344 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2015-04-09 15:05 - 2015-04-08 23:30 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2015-04-09 15:05 - 2015-04-08 23:30 - 00936264 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2015-04-09 15:05 - 2015-04-08 23:30 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2015-04-09 15:05 - 2015-04-08 23:30 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2015-04-09 15:05 - 2015-04-08 19:52 - 04336074 _____ () C:\Windows\system32\nvcoproc.bin 2015-04-09 15:05 - 2015-03-13 21:41 - 01896136 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434788.dll 2015-04-09 15:05 - 2015-03-13 21:41 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434788.dll 2015-04-09 15:05 - 2015-03-13 21:41 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2015-04-09 15:05 - 2015-03-13 21:41 - 00035472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2015-04-09 15:05 - 2015-03-13 21:41 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2015-04-09 15:04 - 2015-04-09 15:04 - 00000000 ____D () C:\NVIDIA 2015-04-09 15:01 - 2015-04-09 15:09 - 00000000 ____D () C:\Users\Calvin\AppData\Local\NVIDIA 2015-04-09 14:44 - 2015-04-15 12:51 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2015-04-09 14:44 - 2015-04-09 15:06 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2015-04-08 22:22 - 2015-04-08 22:22 - 00000000 ____D () C:\Users\Calvin\Documents\Benutzerdefinierte Office-Vorlagen 2015-04-08 21:48 - 2015-04-08 21:48 - 00000000 __RHD () C:\MSOCache 2015-04-08 18:38 - 2015-04-16 22:31 - 00000000 ____D () C:\ProgramData\Origin 2015-04-08 11:40 - 2015-03-23 00:45 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-04-08 11:40 - 2015-03-23 00:09 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-04-08 11:40 - 2015-03-23 00:09 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-04-08 11:40 - 2015-03-23 00:09 - 00769024 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-04-08 11:40 - 2015-03-23 00:09 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-04-08 11:40 - 2015-03-23 00:09 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-04-08 11:40 - 2015-03-23 00:09 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll 2015-04-08 11:40 - 2015-02-21 01:49 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\lsm.dll 2015-04-08 11:28 - 2015-04-08 11:32 - 00000000 ____D () C:\Users\Calvin\Documents\BFBC2 2015-04-08 11:25 - 2015-04-08 18:42 - 02434856 _____ () C:\Windows\SysWOW64\pbsvc.exe 2015-04-07 02:02 - 2015-04-08 23:41 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe 2015-04-06 21:40 - 2015-04-06 21:44 - 00000000 ____D () C:\Program Files (x86)\Origin 2015-04-06 21:30 - 2015-04-06 21:32 - 00000000 ____D () C:\Users\Calvin\Documents\Battlefield 4 2015-04-06 21:26 - 2015-04-06 21:26 - 00000000 ___SD () C:\Windows\SysWOW64\GWX 2015-04-06 21:26 - 2015-04-06 21:26 - 00000000 ___SD () C:\Windows\system32\GWX 2015-04-06 19:42 - 2015-04-06 19:42 - 00000000 ____D () C:\Users\Calvin\AppData\Roaming\Unity 2015-04-06 19:30 - 2015-04-06 19:30 - 00000000 ____D () C:\Users\Calvin\AppData\Local\Unity 2015-03-25 15:32 - 2015-03-14 10:20 - 01385256 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll 2015-03-25 15:32 - 2015-03-14 10:13 - 01124352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 24802928 _____ (Intel Corporation) C:\Windows\system32\igdumdim64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 17761872 _____ () C:\Windows\system32\igd11dxva64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 17285440 _____ () C:\Windows\SysWOW64\igd11dxva32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 15982080 _____ (Intel Corporation) C:\Windows\system32\igdfcl64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 10853888 _____ (Intel Corporation) C:\Windows\SysWOW64\igdfcl32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 09504256 _____ (Intel Corporation) C:\Windows\system32\ig75icd64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 07484416 _____ (Intel Corporation) C:\Windows\SysWOW64\ig75icd32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 06021437 _____ () C:\Windows\system32\igdclbif.bin 2015-03-22 16:04 - 2015-03-06 16:59 - 04877240 _____ (Intel Corporation) C:\Windows\system32\Drivers\igdkmd64.sys 2015-03-22 16:04 - 2015-03-06 16:59 - 03550208 _____ (Intel Corporation) C:\Windows\system32\igdrcl64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 03320320 _____ (Intel Corporation) C:\Windows\SysWOW64\igdrcl32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 02945216 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiVAD64.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 02776408 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiAAC64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 01513304 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiSecureSourceFilter64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 01402336 _____ (Intel Corporation) C:\Windows\system32\iglhsip64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 01399240 _____ (Intel Corporation) C:\Windows\SysWOW64\iglhsip32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 01131008 _____ (Intel Corporation) C:\Windows\system32\GfxResources.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 01028200 _____ (Intel Corporation) C:\Windows\system32\Gfxv4_0.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 01025128 _____ (Intel Corporation) C:\Windows\system32\Gfxv2_0.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00979800 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiWinNextAgent64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00671352 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiAudioFilter64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00636016 _____ (Intel Corporation) C:\Windows\system32\igdmd64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00615544 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiMux64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00515488 _____ (Intel Corporation) C:\Windows\SysWOW64\igdmd32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00472168 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiUMS64.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00448104 _____ (Intel Corporation) C:\Windows\system32\GfxUIEx.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00398848 _____ (Intel Corporation) C:\Windows\system32\igdbcl64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00391784 _____ () C:\Windows\system32\igfxTray.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00385024 _____ (Intel Corporation) C:\Windows\system32\igfxOSP.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00372224 _____ (Intel Corporation) C:\Windows\system32\IntelOpenCL64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00354136 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiSilenceFilter64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00350208 _____ (Intel Corporation) C:\Windows\SysWOW64\igdbcl32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00338536 _____ (Intel Corporation) C:\Windows\system32\DPTopologyApp.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00338024 _____ (Intel Corporation) C:\Windows\system32\DPTopologyAppv2_0.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00304128 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelOpenCL32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00282696 _____ (Intel Corporation) C:\Windows\system32\igd10idpp64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00279144 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00275800 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiUtils64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00263120 _____ (Intel Corporation) C:\Windows\SysWOW64\igd10idpp32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00255488 _____ () C:\Windows\system32\igfxCPL.cpl 2015-03-22 16:04 - 2015-03-06 16:59 - 00229888 _____ (Intel Corporation) C:\Windows\system32\igfxDTCM.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00227328 _____ () C:\Windows\system32\igdde64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00220432 _____ (Intel Corporation) C:\Windows\system32\iglhcp64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00217704 _____ (Intel Corporation) C:\Windows\system32\igfxext.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00211656 _____ (Intel Corporation) C:\Windows\system32\igfxcmrt64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00197464 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiDDEAgent64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00187392 _____ () C:\Windows\SysWOW64\igdde32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00184352 _____ (Intel Corporation) C:\Windows\SysWOW64\iglhcp32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00183296 _____ (Intel Corporation) C:\Windows\system32\igfxCoIn_v4156.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00178672 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmrt32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00169984 _____ (Intel Corporation) C:\Windows\system32\igdail64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00156264 _____ (Intel Corporation) C:\Windows\system32\difx64.exe 2015-03-22 16:04 - 2015-03-06 16:59 - 00152064 _____ (Intel Corporation) C:\Windows\SysWOW64\igdail32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00135000 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiMCUMD64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00127320 _____ (Intel Corporation) C:\Windows\system32\IntelWiDiLogServer64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00086528 _____ (Khronos Group) C:\Windows\SysWOW64\Intel_OpenCL_ICD32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00086528 _____ () C:\Windows\system32\igfxCUIServicePS.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00082432 _____ (Khronos Group) C:\Windows\system32\Intel_OpenCL_ICD64.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00069632 _____ ( ) C:\Windows\system32\igfxDHLibv2_0.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00059904 _____ ( ) C:\Windows\system32\igfxDHLib.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00036616 _____ (Intel Corporation) C:\Windows\system32\igfxexps.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00035328 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxexps32.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00010752 _____ ( ) C:\Windows\system32\igfxDILibv2_0.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00010752 _____ ( ) C:\Windows\system32\igfxDILib.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00010240 _____ ( ) C:\Windows\system32\igfxEMLibv2_0.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00010240 _____ ( ) C:\Windows\system32\igfxEMLib.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00005120 _____ ( ) C:\Windows\system32\igfxLHMLibv2_0.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00005120 _____ ( ) C:\Windows\system32\igfxLHMLib.dll 2015-03-22 16:04 - 2015-03-06 16:59 - 00004016 _____ () C:\Windows\system32\iglhxs64.vp 2015-03-19 13:28 - 2015-03-19 13:28 - 00000000 ____D () C:\Users\Calvin\AppData\Roaming\LolClient ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-16 23:29 - 2014-03-18 12:04 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-04-16 23:29 - 2014-03-18 11:25 - 00764340 _____ () C:\Windows\system32\perfh007.dat 2015-04-16 23:29 - 2014-03-18 11:25 - 00159160 _____ () C:\Windows\system32\perfc007.dat 2015-04-16 23:24 - 2015-02-06 18:46 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-04-16 23:24 - 2015-01-26 21:09 - 00000000 __RDO () C:\Users\Calvin\OneDrive 2015-04-16 23:23 - 2014-03-18 03:51 - 00023414 _____ () C:\Windows\PFRO.log 2015-04-16 23:23 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore 2015-04-16 23:23 - 2013-08-22 16:46 - 00098993 _____ () C:\Windows\setupact.log 2015-04-16 23:23 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-16 23:12 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2015-04-16 23:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru 2015-04-16 22:51 - 2015-02-06 18:46 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-16 22:30 - 2015-01-28 19:33 - 00000000 ____D () C:\Users\Calvin\AppData\Roaming\TS3Client 2015-04-16 21:38 - 2015-01-26 21:07 - 00000000 ____D () C:\Users\Calvin 2015-04-16 19:51 - 2015-01-26 21:05 - 01097572 _____ () C:\Windows\WindowsUpdate.log 2015-04-16 18:23 - 2015-01-26 21:12 - 00003938 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4BEE06BE-F2A3-416C-9DA7-C4F7CD2D84B9} 2015-04-16 12:00 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-04-16 00:13 - 2015-01-27 15:35 - 00000000 ____D () C:\Users\Calvin\AppData\Local\Battle.net 2015-04-15 23:02 - 2015-01-26 21:14 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-418541192-818026106-2851604207-1001 2015-04-15 12:55 - 2015-01-28 20:21 - 00000000 ____D () C:\Windows\system32\MRT 2015-04-15 12:54 - 2015-01-28 20:21 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-04-15 02:22 - 2015-03-13 01:53 - 00226680 _____ () C:\Windows\SysWOW64\PnkBstrB.exe 2015-04-15 01:05 - 2015-03-13 02:01 - 00000000 ____D () C:\Users\Calvin\Documents\My Games 2015-04-15 00:58 - 2015-01-28 12:14 - 00423963 _____ () C:\Windows\DirectX.log 2015-04-15 00:22 - 2015-03-13 02:02 - 00281688 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr 2015-04-15 00:22 - 2015-03-13 01:53 - 00281688 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0 2015-04-14 01:39 - 2015-02-12 22:27 - 00000000 ____D () C:\Program Files (x86)\Rockstar Games 2015-04-14 01:24 - 2013-08-22 17:38 - 00792056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-04-14 01:24 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-04-13 14:35 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache 2015-04-11 03:28 - 2015-03-13 02:02 - 00000000 ____D () C:\Users\Calvin\AppData\Local\PunkBuster 2015-04-10 15:32 - 2015-02-12 22:28 - 00000000 ____D () C:\Users\Calvin\Documents\Rockstar Games 2015-04-09 21:43 - 2015-01-28 19:40 - 00000000 ____D () C:\Users\Calvin\AppData\Roaming\Skype 2015-04-09 17:54 - 2015-03-13 01:53 - 00000000 ____D () C:\Users\Calvin\AppData\Local\Ubisoft Game Launcher 2015-04-09 17:41 - 2015-01-26 22:06 - 00000000 ____D () C:\Users\Calvin\AppData\Local\Razer 2015-04-09 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppCompat 2015-04-09 15:06 - 2015-03-13 15:42 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2015-04-09 15:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Help 2015-04-08 18:42 - 2015-03-13 01:53 - 00075064 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2015-04-08 11:40 - 2015-01-28 20:43 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-04-08 11:40 - 2015-01-28 20:43 - 00000000 ____D () C:\Windows\system32\appraiser 2015-04-06 19:24 - 2015-02-14 13:03 - 00000000 ____D () C:\ProgramData\Package Cache 2015-04-06 19:24 - 2015-02-01 15:05 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins 2015-04-06 18:06 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-03-22 16:06 - 2015-02-14 13:06 - 00019152 _____ () C:\Windows\system32\results.xml 2015-03-22 16:05 - 2015-01-26 22:06 - 00000401 _____ () C:\Windows\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat 2015-03-22 16:04 - 2015-02-14 13:05 - 00000724 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel(R) HD Graphics Control Panel.lnk 2015-03-19 12:05 - 2013-08-22 16:44 - 00480376 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-03-18 15:32 - 2015-03-09 00:09 - 00000000 ____D () C:\Program Files\Microsoft Office 15 ==================== Files in the root of some directories ======= 2015-01-27 14:57 - 2015-02-19 04:04 - 0007627 _____ () C:\Users\Calvin\AppData\Local\Resmon.ResmonCfg 2015-04-16 22:53 - 2015-04-16 22:54 - 0011748 _____ () C:\Users\Calvin\AppData\Local\Temp-log.txt Some content of TEMP: ==================== C:\Users\Calvin\AppData\Local\Temp\GTA_V_PreLauncher_1_0_0_1.exe C:\Users\Calvin\AppData\Local\Temp\nvSCPAPI.dll C:\Users\Calvin\AppData\Local\Temp\nvSCPAPI64.dll C:\Users\Calvin\AppData\Local\Temp\nvStInst.exe C:\Users\Calvin\AppData\Local\Temp\Quarantine.exe C:\Users\Calvin\AppData\Local\Temp\SkypeSetup.exe C:\Users\Calvin\AppData\Local\Temp\sonarinst.exe C:\Users\Calvin\AppData\Local\Temp\sqlite3.dll C:\Users\Calvin\AppData\Local\Temp\ubiFF4.tmp.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-04-07 19:24 ==================== End Of Log ============================ das Addition-log: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-04-2015 04
Ran by Calvin at 2015-04-16 23:30:30
Running from D:\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Arma 2 (HKLM-x32\...\Steam App 33910) (Version: - Bohemia Interactive)
Arma 2: DayZ Mod (HKLM-x32\...\Steam App 224580) (Version: - Bohemia Interactive)
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version: - Bohemia Interactive)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.4.2.25648 - Electronic Arts)
Battlefield: Bad Company™ 2 (HKLM-x32\...\{3AC8457C-0385-4BEA-A959-E095F05D6D67}) (Version: 1.0.1.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.0 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version: - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version: - )
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)
CPUID HWMonitor 1.27 (HKLM\...\CPUID HWMonitor_is1) (Version: - )
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Far Cry 3 Blood Dragon (HKLM-x32\...\{A071F478-73E0-4143-AE55-4DD6BABD74F5}) (Version: 1.01 - Ubisoft)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version: - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
Fraps (HKLM-x32\...\Fraps) (Version: - )
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
Ghost Recon Advanced Warfighter (HKLM-x32\...\{EFC97089-04D6-42CE-A707-A343B4A7D2CD}) (Version: 1.00.000 - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Grand Theft Auto V (HKLM-x32\...\{E01FA564-2094-4833-8F2F-1FFEC6AFCC46}) (Version: "1.00.0000" - Rockstar Games)
Half-Life 2: Deathmatch (HKLM-x32\...\Steam App 320) (Version: - Valve)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Heroes & Generals (HKLM-x32\...\Steam App 227940) (Version: - Reto-Moto)
Insurgency (HKLM-x32\...\Steam App 222880) (Version: - New World Interactive)
Intel(R) Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4156 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
Killing Floor (HKLM-x32\...\Steam App 1250) (Version: - Tripwire Interactive)
L.A. Noire (HKLM-x32\...\Steam App 110800) (Version: - Team Bondi)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)
Magicka (HKLM-x32\...\Steam App 42910) (Version: - Arrowhead Game Studios)
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Need for Speed: Hot Pursuit (HKLM-x32\...\Steam App 47870) (Version: - Criterion Games)
NVIDIA 3D Vision Controller-Treiber 349.95 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 349.95 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 350.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 350.12 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.1.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.1.21 - NVIDIA Corporation)
NVIDIA Grafiktreiber 350.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 350.12 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA Miracast Virtueller Ton 350.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 350.12 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.15.0324 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0324 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 9.5.5.2850 - Electronic Arts, Inc.)
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
PAYDAY: The Heist (HKLM-x32\...\Steam App 24240) (Version: - OVERKILL Software)
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version: - Sony Online Entertainment)
PlanetSide 2 (HKU\S-1-5-21-418541192-818026106-2851604207-1001\...\SOE-PlanetSide 2) (Version: - Sony Online Entertainment)
Portal (HKLM-x32\...\Steam App 400) (Version: - Valve)
Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.988 - Even Balance, Inc.)
Ratz Instagib 2.0 (HKLM-x32\...\Steam App 338170) (Version: - Lino Slahuschek)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.19.24735 - Razer Inc.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.5.6 - Rockstar Games)
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.1.21 - NVIDIA Corporation) Hidden
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
Star Wars - Battlefront II (HKLM-x32\...\Steam App 6060) (Version: - Pandemic Studios)
Star Wars Republic Commando (HKLM-x32\...\Steam App 6000) (Version: - LucasArts)
Star Wars: Empire at War Gold (HKLM-x32\...\Steam App 32470) (Version: - Petroglyph)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKU\S-1-5-21-418541192-818026106-2851604207-1001\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Unity Web Player (HKU\S-1-5-21-418541192-818026106-2851604207-1001\...\UnityWebPlayer) (Version: 5.0.1f1 - Unity Technologies ApS)
Unturned (HKLM-x32\...\Steam App 304930) (Version: - Nelson Sexton)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
Warcraft III (HKLM-x32\...\Warcraft III) (Version: - Blizzard Entertainment)
Warkeys 1.21.0.0b (HKLM-x32\...\Warkeys) (Version: 1.21.0.0b - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-418541192-818026106-2851604207-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
25-03-2015 14:35:09 Windows Update
06-04-2015 19:17:40 Installiert Far Cry
08-04-2015 11:24:41 DirectX wurde installiert
10-04-2015 15:32:03 Installiert Grand Theft Auto V
14-04-2015 00:25:44 Installiert Ghost Recon Advanced Warfighter
15-04-2015 00:56:10 Installiert Far Cry 3 Blood Dragon
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {2F26A0FA-29DF-475C-A44A-ABB617FF535B} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {33992544-2AF5-42DF-AF54-33CDB9354F4B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-06] (Google Inc.)
Task: {3B4E39AC-6589-49D2-959C-E78857EF1E83} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {405644D7-0F60-421B-BA66-6F65107491B6} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-04-15] (Microsoft Corporation)
Task: {64EBDF14-F54E-456B-9596-AE90BB973F19} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {77A520F3-A57A-425B-9C25-90CBA6202F55} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {806FE4E3-6460-46FC-8C6C-FCE31E525147} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {81D8478D-AE18-41F3-9B43-9EBBC9CEA8ED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-06] (Google Inc.)
Task: {8DFA7898-A381-47C8-B742-6EDB3F320C81} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-02-03] (Microsoft Corporation)
Task: {A3F016F9-25DB-4F0B-A524-467240464C49} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-02-03] (Microsoft Corporation)
Task: {B0017E37-01A7-4B44-B1FE-1185D95107C2} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {EB787148-B776-4E87-A81E-A50DA15E6100} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-04-09 15:05 - 2015-04-08 23:30 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-26 21:10 - 2013-07-04 04:32 - 00936728 ____N () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
2015-03-09 00:09 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-04-07 02:02 - 2015-04-08 23:41 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe
2015-02-05 02:24 - 2015-02-05 02:25 - 00187072 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2009-09-25 20:57 - 2009-09-25 20:57 - 00245248 _____ () D:\Programme\Battle.net\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe
2015-04-09 15:06 - 2015-03-28 05:45 - 00721552 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\gamecaster64.dll
2015-04-09 15:06 - 2015-03-28 05:45 - 00854160 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\twitchsdk64.dll
2015-03-14 07:49 - 2015-03-14 07:49 - 00291840 _____ () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
2015-01-26 21:10 - 2015-04-16 23:23 - 00035472 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\PEbiosinterface32.dll
2015-01-26 21:10 - 2013-07-04 04:32 - 00104448 ____N () C:\Program Files (x86)\ASUS\AXSP\1.01.02\ATKEX.dll
2015-04-09 15:08 - 2015-03-28 05:45 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-04-06 18:51 - 2015-03-30 23:07 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
2015-04-06 18:51 - 2015-03-30 23:07 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\libegl.dll
2015-04-06 18:51 - 2015-03-30 23:07 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\pdf.dll
2015-02-05 11:20 - 2015-02-05 11:20 - 00137728 _____ () C:\ProgramData\Razer\Synapse\CrashReporter\CrashRpt1402.dll
2015-04-06 18:51 - 2015-03-30 23:07 - 14974280 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll
2015-04-09 17:41 - 2014-11-26 04:12 - 40622592 _____ () C:\Users\Calvin\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libcef.dll
2015-04-09 17:41 - 2014-11-26 04:12 - 00911360 _____ () C:\Users\Calvin\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libglesv2.dll
2015-04-09 17:41 - 2014-11-26 04:12 - 00134144 _____ () C:\Users\Calvin\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libegl.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Calvin\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-418541192-818026106-2851604207-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Calvin\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\galaxy_01.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-418541192-818026106-2851604207-1001\...\StartupApproved\Run: => "Steam"
==================== Accounts: =============================
Administrator (S-1-5-21-418541192-818026106-2851604207-500 - Administrator - Disabled)
Calvin (S-1-5-21-418541192-818026106-2851604207-1001 - Administrator - Enabled) => C:\Users\Calvin
Gast (S-1-5-21-418541192-818026106-2851604207-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-418541192-818026106-2851604207-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: PCI-Kommunikationscontroller (einfach)
Description: PCI-Kommunikationscontroller (einfach)
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/16/2015 11:11:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CALVINSPC)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/16/2015 09:38:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm GTA5.exe, Version 1.0.323.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2d9c
Startzeit: 01d0787bce1a5ddc
Endzeit: 4294967295
Anwendungspfad: D:\Programme\Grand Theft Auto V\GTA5.exe
Berichts-ID: 1735f1dd-e470-11e4-82c4-60a44cb5f1e6
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (04/16/2015 09:30:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm GTA5.exe, Version 1.0.323.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 2280
Startzeit: 01d07864dac08375
Endzeit: 4294967295
Anwendungspfad: D:\Programme\Grand Theft Auto V\GTA5.exe
Berichts-ID: 01cae74a-e46f-11e4-82c4-60a44cb5f1e6
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (04/16/2015 09:16:51 PM) (Source: Chrome) (EventID: 1) (User: NT-AUTORITÄT)
Description: Chrome has encountered a fatal error.
ver=41.0.2272.118;lang=;guid=6AC4FA80DD834FF398B8904CB05B05C8;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\db1b473e-bdb3-40f7-9bb8-4e2027d475f1.dmp
Error: (04/16/2015 06:06:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: GTA5.exe, Version: 1.0.323.1, Zeitstempel: 0x5527f187
Name des fehlerhaften Moduls: GTA5.exe, Version: 1.0.323.1, Zeitstempel: 0x5527f187
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000011352f4
ID des fehlerhaften Prozesses: 0x16dc
Startzeit der fehlerhaften Anwendung: 0xGTA5.exe0
Pfad der fehlerhaften Anwendung: GTA5.exe1
Pfad des fehlerhaften Moduls: GTA5.exe2
Berichtskennung: GTA5.exe3
Vollständiger Name des fehlerhaften Pakets: GTA5.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: GTA5.exe5
Error: (04/16/2015 06:06:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CALVINSPC)
Description: Bei der Aktivierung der App „microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/16/2015 02:20:02 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (04/16/2015 00:01:16 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (04/16/2015 01:02:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm GTA5.exe, Version 1.0.323.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1f30
Startzeit: 01d077c965694cf3
Endzeit: 934
Anwendungspfad: D:\Programme\Grand Theft Auto V\GTA5.exe
Berichts-ID: 6ce7ff41-e3c3-11e4-82c1-60a44cb5f1e6
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (04/15/2015 07:01:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 41.0.2272.118, Zeitstempel: 0x55199d5a
Name des fehlerhaften Moduls: chrome.dll, Version: 41.0.2272.118, Zeitstempel: 0x55199942
Ausnahmecode: 0x80000003
Fehleroffset: 0x005163f5
ID des fehlerhaften Prozesses: 0x40b4
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
Vollständiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5
System errors:
=============
Error: (04/16/2015 11:23:50 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x12
Error: (04/16/2015 11:23:27 PM) (Source: DCOM) (EventID: 10010) (User: CALVINSPC)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (04/16/2015 11:23:27 PM) (Source: DCOM) (EventID: 10010) (User: CALVINSPC)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (04/16/2015 11:12:32 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x12
Error: (04/16/2015 11:12:06 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (04/16/2015 11:11:36 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/16/2015 11:11:36 PM) (Source: DCOM) (EventID: 10010) (User: CALVINSPC)
Description: Microsoft.WindowsLive.Mail.AppXchpnq3xrg3grbgjnhp88jn3v9r1xskxr.mca
Error: (04/16/2015 11:11:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (04/16/2015 11:11:36 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Microsoft Office-Klick-und-Los-Dienst" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/16/2015 11:11:36 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (04/16/2015 11:11:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CALVINSPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1-2144927141
Error: (04/16/2015 09:38:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: GTA5.exe1.0.323.12d9c01d0787bce1a5ddc4294967295D:\Programme\Grand Theft Auto V\GTA5.exe1735f1dd-e470-11e4-82c4-60a44cb5f1e6
Error: (04/16/2015 09:30:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: GTA5.exe1.0.323.1228001d07864dac083754294967295D:\Programme\Grand Theft Auto V\GTA5.exe01cae74a-e46f-11e4-82c4-60a44cb5f1e6
Error: (04/16/2015 09:16:51 PM) (Source: Chrome) (EventID: 1) (User: NT-AUTORITÄT)
Description: Chrome has encountered a fatal error.
ver=41.0.2272.118;lang=;guid=6AC4FA80DD834FF398B8904CB05B05C8;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\db1b473e-bdb3-40f7-9bb8-4e2027d475f1.dmp
Error: (04/16/2015 06:06:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: GTA5.exe1.0.323.15527f187GTA5.exe1.0.323.15527f187c000000500000000011352f416dc01d0785088368398D:\Programme\Grand Theft Auto V\GTA5.exeD:\Programme\Grand Theft Auto V\GTA5.exe9a52f195-e452-11e4-82c4-60a44cb5f1e6
Error: (04/16/2015 06:06:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CALVINSPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2147023170
Error: (04/16/2015 02:20:02 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System-reserviertFalscher Parameter. (0x80070057)
Error: (04/16/2015 00:01:16 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed continue stopping. [5]
Error: (04/16/2015 01:02:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: GTA5.exe1.0.323.11f3001d077c965694cf3934D:\Programme\Grand Theft Auto V\GTA5.exe6ce7ff41-e3c3-11e4-82c1-60a44cb5f1e6
Error: (04/15/2015 07:01:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe41.0.2272.11855199d5achrome.dll41.0.2272.1185519994280000003005163f540b401d0779db8c55cb2C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\chrome.dll00de8118-e391-11e4-82bf-60a44cb5f1e6
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz
Percentage of memory in use: 24%
Total physical RAM: 8129.41 MB
Available physical RAM: 6120.92 MB
Total Pagefile: 9409.41 MB
Available Pagefile: 6924.38 MB
Total Virtual: 131072 MB
Available Virtual: 131071.82 MB
==================== Drives ================================
Drive c: (SSD_01) (Fixed) (Total:118.9 GB) (Free:8.53 GB) NTFS
Drive d: (HDD_01) (Fixed) (Total:931.39 GB) (Free:580.38 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 9CB2192F)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=118.9 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Geändert von Borgash (16.04.2015 um 22:41 Uhr) |
|
16.04.2015, 22:35
| #8 |
| /// TB-Ausbilder /// Anleitungs-Guru | Ads by SalePlus - Wie werde ich das los? Das ist nicht das Malwarebytes Log was ich sehen will...  Malwarebytes Anti-Malware Logfile finden - Anleitungen Und die FRST Logs bitte in CodeTags posten. Danke. Lesestoff Posten in CODE-Tags: So gehts... Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
16.04.2015, 22:56
| #9 |
| | Ads by SalePlus - Wie werde ich das los? Und das MAMW-log: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 16.04.2015 Suchlauf-Zeit: 23:38:55 Logdatei: Administrator: Ja Version: 2.01.4.1018 Malware Datenbank: v2015.04.16.05 Rootkit Datenbank: v2015.03.31.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Calvin Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 334632 Verstrichene Zeit: 4 Min, 15 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 1 PUP.Optional.Spigot.A, C:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences, Gut: (), Schlecht: ( "homepage": "hxxp://de.search.yahoo.com/?fr=spigot-yhp-gcmac&ilc=12&type=967150",), Ersetzt,[073ed8959af0989e1d82f34ef412d12f] Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Das Problem besteht weiterhin. Egal welche Internetseite, nach kurzer Zeit sind links, rechts, oben und unten Werbeanzeigen. Zwar sind diese ohne Inhalt wegen ABP, aber trotzdem nervt das tierisch. Was kann ich noch machen? |
|
16.04.2015, 23:00
| #10 |
| /// TB-Ausbilder /// Anleitungs-Guru | Ads by SalePlus - Wie werde ich das los? Chrome mit Revo deinstallieren, alle Reste löschen (Lesezeichen usw. vorher sichern). Dann neu installieren: https://www.google.de/chrome/browser/desktop/
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
16.04.2015, 23:09
| #11 |
| | Ads by SalePlus - Wie werde ich das los? DANKEEEEEE! Superlieb das ihr mir geholfen habt, endlich wieder schneller surfen und kein unnötiges warten auf irgendwelche besch***** Werbeanzeigen! keep it up /closed |
|
16.04.2015, 23:18
| #12 |
| /// TB-Ausbilder /// Anleitungs-Guru | Ads by SalePlus - Wie werde ich das los? Ne, ne...wir sind dann fertig wenn ich es sage... Suchscan mit ESET: Schritt 1 ESET Online Scanner
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
17.04.2015, 00:21
| #13 |
| | Ads by SalePlus - Wie werde ich das los? Oh, da war ich wohl etwas übereifrig. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=3583ce6ce414fd4bbb5ceae28f58544c
# engine=23423
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-16 11:20:10
# local_time=2015-04-17 01:20:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 48442 6308802 0 0
# scanned=236173
# found=4
# cleaned=0
# scan_time=2895
sh=18302A8A7EB07BDECB853138B6BF7DE23D563F7B ft=1 fh=c71c00117c219ee1 vn="Variante von Win32/BHOUninstaller.AB evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaliePlus\SaliePlus.exe.vir"
sh=F2A97313B9F7FA98EE04783DBB28D2CB68C28FE5 ft=1 fh=1c2f0716f1061631 vn="Variante von MSIL/Wajam.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WajIntEnhance\WajIntEnhance Internet Enhancer\InternetEnhancer.exe.vir"
sh=D85995C486EE5C62153DBD933E332983061A7884 ft=1 fh=c71c0011018b2642 vn="Variante von Win32/Wajam.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WajIntEnhance\WajIntEnhance Internet Enhancer\InternetEnhancerService.exe.vir"
sh=333BEB35A70772F1757E99F0154D59964B921D3F ft=1 fh=534a19fe0349cbc1 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Calvin\AppData\Local\Temp\DMR\dmr_72.exe"
|
|
17.04.2015, 00:27
| #14 |
| /// TB-Ausbilder /// Anleitungs-Guru | Ads by SalePlus - Wie werde ich das los? Du sollst den Scan vollständig durchführen, sonst macht das keinen Sinn! Muss ja nicht heute fertig werden.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
17.04.2015, 10:07
| #15 |
| | Ads by SalePlus - Wie werde ich das los? Ich hab soweit alles gescannt. Genauer gesagt auf Start geklickt und dann einfach gewartet. 4 Dateien wurden detected. Also ESET nochmal downloaden und nochmal scannen lassen? |
|
| Themen zu Ads by SalePlus - Wie werde ich das los? |
| ads, chrome, helft, kurzer, leute, ungewünschte, versuch, versucht, virus, werbeanzeigen, öffnen |
dann auf 
und dann auf 
.
Hybrid-Darstellung
