| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: NvBackend.exe Ungültiges BildWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.06.2015, 16:22
| #16 |
 |  NvBackend.exe Ungültiges Bild So die EsetLog ist auch fertig :-) Code:
ATTFilter # product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=3f57aaee3f15074687c627d197501fc8
# end=init
# utc_time=2015-06-24 05:47:41
# local_time=2015-06-24 07:47:41 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24473
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=3f57aaee3f15074687c627d197501fc8
# end=updated
# utc_time=2015-06-24 05:49:33
# local_time=2015-06-24 07:49:33 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=3f57aaee3f15074687c627d197501fc8
# engine=24473
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-24 07:24:38
# local_time=2015-06-24 09:24:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Anti-Virus'
# compatibility_mode=1303 16777213 100 100 6422 62709508 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 389491 186760528 0 0
# scanned=154559
# found=39
# cleaned=0
# scan_time=5704
sh=7502B48484E2E0FEC6CF2CDB3342E2F31F6BA58B ft=1 fh=92d319fc306ceca1 vn="Variante von Win32/Toolbar.CrossRider.CN evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe.vir"
sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\globalupdate.exe.vir"
sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdate.exe.vir"
sh=08976B0143D7A77694D2B3014053542C42F4774E ft=1 fh=67450ef68c8fc670 vn="Win32/AlteredSoftware.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateBroker.exe.vir"
sh=DD4605E26B48B7C231DBEBA5E8FAA91F33D21B2B ft=1 fh=bb1ffd2794ad6ec5 vn="Win32/AlteredSoftware.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateCrashHandler.exe.vir"
sh=FE3BD67B77BB38A3110091D17DE69012FAAD4FA6 ft=1 fh=67450ef6f68fd149 vn="Win32/AlteredSoftware.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateOnDemand.exe.vir"
sh=9923C1D4E94534A3D1ECE99B2CA1872ED46F5301 ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll.vir"
sh=BD08E733D803A193E4FA4118A6D52BCD0FC98F81 ft=1 fh=c71c0011371aa7ff vn="Variante von Win32/AlteredSoftware.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll.vir"
sh=9AE1636DE7E3CB630B3A2C11E41C76BF0B716CCD ft=1 fh=c71c0011864645d3 vn="Variante von Win32/AlteredSoftware.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll.vir"
sh=F8D59039847EE77BE9C962EE48EAA829689C806F ft=1 fh=cc6f023531ee23ed vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=F566CE2AAC5C4ED0602A4E5846785F2BEE36A402 ft=1 fh=f0dd5d7b05b4caf7 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPtool.dll.vir"
sh=31214110C723F7D61360C7AA88699A465A9F78C7 ft=1 fh=8631bb4d7b5b9501 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=E4E8364BBCA2DD1E5E64C0C70276769B229C4279 ft=1 fh=e03fffa271f94da9 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.pun.vir"
sh=5B4467C1CD63C1A3738D5995F2A5829EF9F189B7 ft=1 fh=98d36eb1becfccc9 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=BAC73F9D128F6DB644A7D67B2FD9E19E01FED7D9 ft=1 fh=34afcf22e7329042 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\RN32.dll.vir"
sh=89467BD8CFEEB5BB8C0EE68CE87E3856B8BCE85F ft=1 fh=a7449e050481ac1d vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPtool64.exe.vir"
sh=F86226DD81279472FD4CFC53B9E15D77BFBB0D03 ft=1 fh=180d826b3a1f81be vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32.dll.vir"
sh=EE07D9034652F0080D986984618061EC521A439D ft=1 fh=f508bd636dcd5d08 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll.vir"
sh=CCBCFDF24925FC8F08F1A4306BB6D012087FE598 ft=1 fh=abfbb948b170bbf4 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64.dll.vir"
sh=37CB5EADAAE6C8C01F2FD7320CC801540AB56D0F ft=1 fh=902aa0dd13f8ab19 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll.vir"
sh=341FAC15F9156D347D9F7BD09121B3CDDBD91784 ft=1 fh=b1f0f06b143efb0a vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=2095281E62ED6F9A1EEB8D4E5E5FCD936DDD4586 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Shop and Save Up\dbf280dd-a785-4397-a142-19b42a378157.xpi.vir"
sh=D6646D9106F4E1AADFE927E39DAF6BCD8B87F716 ft=1 fh=0fd366086610820f vn="Variante von Win64/Adware.AddLyrics.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ver5BlockAndSurf\x64\TandemRunner.exe.vir"
sh=4D11FBF9FE5C7751DA6BA64F7F4D80FBF275EB14 ft=1 fh=a684e2657dca30ec vn="Variante von Win64/Adware.AddLyrics.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ver7BlockAndSurf\x64\TandemRunner.exe.vir"
sh=41E9ACC842FD04691C7CF20BC6B5E5D99F064F46 ft=1 fh=2b2c49eda6864edc vn="Variante von MSIL/Adware.PullUpdate.J.gen Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\DesktopSearch\uninstall.exe.vir"
sh=9DF3638EE93AB2DB89A89AC6B67BF088DC64416B ft=1 fh=c71c00110e78363b vn="Variante von Win32/ELEX.BH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"
sh=6D2CF68F0985AF8537108809C981A1E2D7E81884 ft=1 fh=fe72414cd28c1f8b vn="Win32/VOPackage.BC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\AnyProtectScannerSetup.exe.vir"
sh=5532DFEBF54A511848D4D4AFA7BD083E7BCA2024 ft=1 fh=2cda3868f7119c9e vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\avabvbavad\avabvbavad.exe.vir"
sh=D17FA818E57DBB4907F2281428C4AA1A13725460 ft=1 fh=b188eaf84d07bfba vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\avabvbavad\pbqrmvbub.vir"
sh=32BE00C9B8BD83BF621E433EC87DE21B08F82098 ft=1 fh=a4fbdca8e8e73dc7 vn="Variante von Win32/PriceGong.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\SmartWeb\__u.exe.vir"
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=4CF9EF4D739C2F8A1F3909A2720274527EC29E1F ft=1 fh=c71c001143f2d9bd vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Roaming\vi-view\UninstallManager.exe.vir"
sh=37CB5EADAAE6C8C01F2FD7320CC801540AB56D0F ft=1 fh=902aa0dd13f8ab19 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\apppatch\apppatch64\vcldr64.dll.vir"
sh=EE07D9034652F0080D986984618061EC521A439D ft=1 fh=f508bd636dcd5d08 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\apppatch\nbin\VC32Loader.dll.vir"
sh=9CE5F659BDD89907624541CB98681224CA75D886 ft=1 fh=9b9a5086efdbb0a1 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=171D0DFAD4ABC8BFCFC3DE6AD9EB03DBA9CB60AC ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM"
sh=73012A0D84837157D4F5F2C9010736ABCE98DEEB ft=1 fh=49ea49b1d390ced9 vn="JS/Adware.Steganos.A Anwendung" ac=I fn="C:\Users\admin\AppData\Roaming\Steganos Updates\okayfreedom.exe"
sh=57B30CD4DEDFD62F5A155A5C4FDCF9614AA181A4 ft=1 fh=fba4b4626586a66d vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"
sh=7F3795654D67FD94D8A6FA946EA53A58419DDFA7 ft=1 fh=31e0e18677ed148a vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\Downloads\SpyBot Search Destroy - CHIP-Installer.exe"
Code:
ATTFilter Results of screen317's Security Check version 1.004
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Anti-Virus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Java 8 Update 31
Java version 32-bit out of Date!
Adobe Flash Player 17.0.0.190 Flash Player out of Date!
Adobe Reader XI
Mozilla Firefox (39.0)
````````Process Check: objlist.exe by Laurent````````
Spybot Teatimer.exe is disabled!
Kaspersky Lab Kaspersky Anti-Virus 15.0.2 avp.exe
Kaspersky Lab Kaspersky Anti-Virus 15.0.2 avpui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter
LastRegBack: 2015-06-23 06:47
==================== End of log ============================
|
|
24.06.2015, 16:26
| #17 |
| | NvBackend.exe Ungültiges Bild Problem besteht weiterhin :-( |
|
25.06.2015, 06:47
| #18 |
| | NvBackend.exe Ungültiges Bild Achso bei mir kam dann End of LOG als ich den letzten FRST SCAN gemacht habe,
__________________aber ich machs nochmal und hänge das Ergebnis gleich dran. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by admin (administrator) on ADMIN-PC on 25-06-2015 07:45:04
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\avpui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\WLMerger.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> none
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2014-09-26] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2014-09-26] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2014-09-26] ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKLM-x32 - Default Value = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2
FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\yj8crew8.default-1434747001289
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-06-24] ()
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2014-10-15] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-06-24] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll [2014-03-11] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-30] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-30] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker_663BE84DBCC949E88C7600F63CA7F098 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\content_blocker@kaspersky.com [2015-06-19] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_07402848C2F6470194F131B0F3DE025E -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-06-19] ()
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2014-10-15] (Adobe Systems)
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\yj8crew8.default-1434747001289\user.js [2015-06-22]
FF Extension: Adblock Plus - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\yj8crew8.default-1434747001289\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-06-19]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_663BE84DBCC949E88C7600F63CA7F098@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\content_blocker@kaspersky.com [2015-06-19]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_07402848C2F6470194F131B0F3DE025E@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-06-19]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 AVP15.0.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\avp.exe [194000 2015-06-22] (Kaspersky Lab ZAO)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-01] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [247016 2015-06-22] (Kaspersky Lab UK Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [64368 2015-06-22] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [159960 2015-06-22] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [225968 2015-06-22] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [850608 2015-06-22] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [39280 2015-06-22] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [40304 2015-06-22] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [39280 2015-06-22] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [24944 2015-06-22] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [65208 2015-06-22] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [85360 2015-06-22] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [190648 2015-06-22] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-04-22] (Duplex Secure Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-25 07:44 - 2015-06-25 07:44 - 00000000 ____D C:\Users\admin\Desktop\FRST-OlderVersion
2015-06-24 17:21 - 2015-06-25 07:45 - 00015059 _____ C:\Users\admin\Desktop\FRST.txt
2015-06-24 08:01 - 2015-06-24 08:01 - 00852662 _____ C:\Users\admin\Downloads\SecurityCheck.exe
2015-06-24 07:47 - 2015-06-24 07:47 - 02870984 _____ (ESET) C:\Users\admin\Downloads\esetsmartinstaller_deu.exe
2015-06-24 07:37 - 2015-06-24 17:23 - 00002296 _____ C:\Windows\PFRO.log
2015-06-24 07:37 - 2015-06-24 07:37 - 00000008 __RSH C:\ProgramData\ntuser.pol
2015-06-23 13:59 - 2015-06-25 07:39 - 00004128 _____ C:\Windows\IE11_main.log
2015-06-23 13:51 - 2015-06-23 13:52 - 00035809 _____ C:\Users\admin\Desktop\Addition.txt
2015-06-23 13:49 - 2015-06-23 13:49 - 00000000 ___SD C:\ComboFix
2015-06-23 11:03 - 2015-06-25 07:32 - 00000874 _____ C:\Windows\setupact.log
2015-06-23 11:03 - 2015-06-23 11:03 - 00000000 _____ C:\Windows\setuperr.log
2015-06-23 07:00 - 2015-06-23 07:00 - 00001401 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-06-23 07:00 - 2015-06-23 07:00 - 00001389 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-06-23 07:00 - 2015-06-23 07:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-06-23 07:00 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-06-23 06:58 - 2015-06-23 06:58 - 01198368 _____ C:\Users\admin\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-06-23 06:58 - 2015-06-23 06:58 - 00013848 _____ C:\Users\admin\Desktop\firefox.exe - Verknüpfung.lnk
2015-06-22 14:38 - 2015-06-22 14:38 - 00023846 _____ C:\ComboFix.txt
2015-06-22 14:04 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-22 14:04 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-22 14:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-22 14:03 - 2015-06-23 13:49 - 00000000 ____D C:\Qoobox
2015-06-22 14:03 - 2015-06-22 14:35 - 00000000 ____D C:\Windows\erdnt
2015-06-22 13:45 - 2015-06-22 13:45 - 00001274 _____ C:\Users\admin\Desktop\Revo Uninstaller.lnk
2015-06-22 13:45 - 2015-06-22 13:45 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2015-06-22 00:24 - 2015-06-23 13:47 - 05629494 ____R (Swearware) C:\Users\admin\Desktop\ComboFix.exe
2015-06-22 00:24 - 2015-06-22 00:24 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\admin\Desktop\revosetup95.exe
2015-06-21 03:40 - 2015-06-21 03:41 - 00000008 __RSH C:\Users\admin\ntuser.pol
2015-06-20 22:40 - 2015-06-25 07:45 - 00000000 ____D C:\FRST
2015-06-20 22:38 - 2015-06-25 07:44 - 02112512 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2015-06-20 01:42 - 2015-06-20 01:42 - 00262144 _____ C:\Windows\system32\config\elam
2015-06-20 01:15 - 2015-06-20 01:37 - 00000000 ____D C:\Users\admin\AppData\Local\DesktopSearch
2015-06-19 23:22 - 2015-06-19 23:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2015-06-19 23:22 - 2015-06-19 23:21 - 00002097 _____ C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2015-06-19 23:20 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2015-06-19 23:19 - 2015-06-19 23:19 - 00000000 ____D C:\Windows\ELAMBKUP
2015-06-19 23:18 - 2015-06-25 07:32 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-06-19 23:18 - 2015-06-19 23:18 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-06-19 23:12 - 2015-06-19 23:13 - 179560648 _____ (Kaspersky Lab) C:\Users\admin\Downloads\kav15.0.2.361de-de.exe
2015-06-19 22:51 - 2015-06-19 23:07 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-19 22:50 - 2015-06-19 22:50 - 00001112 _____ C:\Users\admin\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-19 22:50 - 2015-06-19 22:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-06-19 22:50 - 2015-06-19 22:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-19 22:50 - 2015-06-19 22:50 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-06-19 22:50 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-19 22:50 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-19 22:50 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-19 22:47 - 2015-06-19 22:47 - 01198368 _____ C:\Users\admin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2015-06-19 22:26 - 2015-06-25 07:39 - 00653510 _____ C:\Windows\WindowsUpdate.log
2015-06-19 21:53 - 2015-06-19 22:23 - 00000000 ____D C:\ProgramData\Avira
2015-06-19 21:42 - 2015-06-19 21:43 - 00000985 _____ C:\Users\admin\Desktop\CCleaner.lnk
2015-06-19 21:42 - 2015-06-19 21:42 - 04718584 _____ (Avira Operations GmbH & Co. KG) C:\Users\admin\Downloads\avira_de_av_5584709b202a5__ws.exe
2015-06-19 21:42 - 2015-06-19 21:42 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-06-19 21:42 - 2015-06-19 21:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-06-19 21:42 - 2015-06-19 21:42 - 00000000 ____D C:\Program Files\CCleaner
2015-06-19 21:41 - 2015-06-19 21:41 - 05313056 _____ (Piriform Ltd) C:\Users\admin\Downloads\ccsetup506_slim.exe
2015-06-19 21:38 - 2015-06-19 23:08 - 00003450 _____ C:\Windows\System32\Tasks\Unknevna
2015-06-19 21:15 - 2015-06-19 21:15 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-06-19 13:06 - 2015-06-19 13:06 - 00000000 ____D C:\Users\admin\AppData\Local\YouTubeToMp3
2015-06-19 12:38 - 2009-09-27 09:39 - 00415744 ___SH (The Public) C:\Windows\SysWOW64\avisynth.dll
2015-06-19 12:38 - 2005-07-14 12:31 - 00032256 ___SH C:\Windows\SysWOW64\AVSredirect.dll
2015-06-19 12:38 - 2004-02-22 10:11 - 00764416 ___SH (Abysmal Software) C:\Windows\SysWOW64\devil.dll
2015-06-19 12:38 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\yv12vfw.dll
2015-06-19 12:38 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\i420vfw.dll
2015-06-19 12:34 - 2015-06-19 12:54 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-06-19 12:21 - 2015-06-19 12:21 - 00000000 _____ C:\Users\admin\AppData\Local\Temp.dat
2015-06-19 12:04 - 2015-06-19 12:25 - 00000000 ____D C:\Users\admin\AppData\Local\Opera Software
2015-06-19 12:03 - 2015-06-19 12:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Opera Software
2015-06-19 12:00 - 2015-06-19 12:25 - 00000000 ____D C:\Program Files (x86)\Opera
2015-06-19 12:00 - 2014-11-05 03:02 - 00008122 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-06-19 11:59 - 2015-06-20 02:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\83EA6FB1-1434707985-8131-A962-804A74206928
2015-06-19 11:49 - 2015-06-20 01:11 - 00000000 ____D C:\ProgramData\{0454ec79-c46f-8a7a-0454-4ec79c46b1e7}
2015-06-19 09:21 - 2015-06-19 12:52 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2015-06-19 09:21 - 2004-10-10 09:50 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
2015-06-19 09:21 - 2004-07-02 17:33 - 00327749 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\drvc.dll
2015-06-19 09:02 - 2015-06-19 14:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Data Recovery Suite
2015-06-19 08:58 - 2015-06-19 08:58 - 00000000 ____D C:\ProgramData\OO Software
2015-06-18 10:21 - 2015-06-19 12:18 - 00000000 ____D C:\Program Files (x86)\SupervisionCam
2015-06-18 10:15 - 2015-06-18 10:15 - 00000000 ____D C:\Users\admin\AppData\Roaming\CrazyPixels
2015-06-17 06:45 - 2015-06-20 01:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-10 13:51 - 2015-06-10 13:51 - 00000000 ____D C:\04880cb472b061b0e55e9f0dd2
2015-06-10 12:56 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 12:56 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 12:55 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 12:55 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 12:55 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 12:55 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 12:55 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 12:55 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 12:55 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 12:55 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 12:55 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 12:55 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 12:55 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 12:55 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 12:55 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 12:55 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 12:55 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 12:55 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 12:55 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 12:55 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 12:55 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 12:55 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 12:55 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 12:55 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 12:55 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 12:55 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 12:55 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 12:55 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 12:55 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 12:55 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 12:55 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 12:55 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 12:54 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 12:54 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-07 14:39 - 2015-06-07 14:39 - 00000000 ____D C:\Users\admin\AppData\Roaming\TeamViewer
2015-06-06 16:19 - 2015-06-23 13:56 - 00000000 ____D C:\Users\admin\Desktop\Neue Musik
2015-06-06 15:54 - 2015-06-06 15:54 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2015-05-29 14:21 - 2015-05-29 14:21 - 00000000 ____D C:\found.000
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-25 07:43 - 2014-08-23 06:20 - 00000000 ____D C:\Users\admin\AppData\Local\Adobe
2015-06-25 07:40 - 2009-07-14 06:45 - 00039920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-25 07:40 - 2009-07-14 06:45 - 00039920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-25 07:35 - 2014-04-05 14:44 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-25 07:31 - 2014-07-14 20:01 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-25 07:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-24 07:37 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2015-06-24 07:35 - 2014-07-31 10:10 - 00000000 ____D C:\Users\admin\AppData\Local\CrashDumps
2015-06-24 07:35 - 2014-04-05 14:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-24 07:35 - 2014-04-05 14:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-24 07:35 - 2014-04-05 14:44 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-24 07:35 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2015-06-23 07:08 - 2014-07-29 09:04 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-06-23 07:00 - 2014-07-29 09:04 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-06-22 16:54 - 2015-05-18 22:16 - 00850608 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2015-06-22 16:54 - 2015-05-18 22:16 - 00064368 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kldisk.sys
2015-06-22 16:54 - 2014-11-28 18:19 - 00159960 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2015-06-22 16:54 - 2014-11-22 14:12 - 00085360 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwtp.sys
2015-06-22 16:54 - 2014-11-10 17:48 - 00190648 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2015-06-22 16:54 - 2014-10-30 04:22 - 00040304 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2015-06-22 16:54 - 2014-10-22 21:13 - 00225968 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2015-06-22 16:54 - 2014-10-10 17:02 - 00039280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2015-06-22 16:54 - 2014-10-09 12:31 - 00065208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kltdi.sys
2015-06-22 16:54 - 2014-03-31 10:47 - 00478392 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2015-06-22 16:54 - 2013-08-08 16:11 - 00039280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klmouflt.sys
2015-06-22 16:54 - 2013-04-12 14:34 - 00024944 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klpd.sys
2015-06-22 16:53 - 2013-01-14 20:10 - 00247016 _____ (Kaspersky Lab UK Ltd) C:\Windows\system32\Drivers\cm_km_w.sys
2015-06-22 14:38 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-06-22 14:30 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-21 17:25 - 2013-06-10 07:45 - 00699092 _____ C:\Windows\system32\perfh007.dat
2015-06-21 17:25 - 2013-06-10 07:45 - 00149232 _____ C:\Windows\system32\perfc007.dat
2015-06-21 17:25 - 2009-07-14 07:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-21 03:41 - 2007-08-28 01:56 - 00000000 ____D C:\Users\admin
2015-06-21 03:33 - 2015-01-23 19:53 - 00002614 _____ C:\Users\Public\Desktop\Logitech Webcam Software.lnk
2015-06-20 01:49 - 2014-09-17 11:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-20 01:11 - 2015-04-03 17:46 - 00000000 ____D C:\ProgramData\{311b518e-e658-8319-311b-b518ee65463b}
2015-06-19 23:00 - 2014-07-29 12:54 - 00000000 ____D C:\AdwCleaner
2015-06-19 22:23 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-19 22:21 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-19 22:04 - 2014-08-15 12:00 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-19 21:47 - 2015-01-22 19:36 - 00000000 ____D C:\Program Files\VideoLAN
2015-06-19 21:46 - 2014-11-01 01:11 - 00000000 ____D C:\Program Files (x86)\Steam
2015-06-19 21:45 - 2007-08-28 01:57 - 00001417 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-19 13:25 - 2015-03-29 00:26 - 00000000 ____D C:\Users\admin\AppData\Roaming\vlc
2015-06-19 13:05 - 2014-10-07 20:21 - 00001294 _____ C:\Users\admin\Desktop\MediaHuman YouTube to MP3 Converter.lnk
2015-06-19 12:52 - 2014-08-16 12:14 - 00000000 ____D C:\Users\admin\AppData\Roaming\uTorrent
2015-06-19 12:48 - 2015-03-10 23:44 - 00000000 ____D C:\Users\admin\Tracing
2015-06-19 12:17 - 2015-04-26 11:02 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-06-19 12:17 - 2015-03-29 00:10 - 00000983 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-06-19 12:17 - 2015-03-10 23:41 - 00002717 _____ C:\Users\Public\Desktop\Skype.lnk
2015-06-19 12:17 - 2015-01-24 21:28 - 00002605 _____ C:\Users\Public\Desktop\iSpy64.lnk
2015-06-19 12:17 - 2015-01-11 22:24 - 00001156 _____ C:\Users\admin\Desktop\Blur.lnk
2015-06-19 12:17 - 2014-11-01 01:11 - 00000991 _____ C:\Users\Public\Desktop\Steam.lnk
2015-06-19 12:05 - 2009-07-14 04:34 - 00000505 _____ C:\Windows\win.ini
2015-06-18 18:51 - 2015-01-22 19:28 - 00000000 ____D C:\Users\admin\AppData\Roaming\iSpy
2015-06-17 06:11 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-11 16:40 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 16:03 - 2009-07-14 06:45 - 00416688 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 08:46 - 2015-01-24 16:06 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 08:46 - 2014-04-22 20:44 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-10 13:51 - 2014-04-05 15:58 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 13:51 - 2014-04-05 15:58 - 00000000 ____D C:\Windows\system32\MRT
2015-06-07 14:39 - 2015-03-29 00:10 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-06-07 14:38 - 2015-03-29 00:10 - 00000977 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
==================== Files in the root of some directories =======
2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM
2015-04-23 21:35 - 2015-04-23 21:36 - 0011602 _____ () C:\Users\admin\AppData\Local\Temp-log.txt
2015-06-19 12:21 - 2015-06-19 12:21 - 0000000 _____ () C:\Users\admin\AppData\Local\Temp.dat
2014-07-14 19:30 - 2014-07-14 19:30 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-23 06:47
==================== End of log ============================
|
|
25.06.2015, 18:58
| #19 |
| /// the machine /// TB-Ausbilder    | NvBackend.exe Ungültiges Bild Java und Flash updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM
C:\Users\admin\AppData\Roaming\Steganos Updates\okayfreedom.exe
C:\Users\admin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
C:\Users\admin\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de NVIDIA Software neu installieren. Downloadverhalten überdenken: CHIP-Installer - was ist das? - Anleitungen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.06.2015, 00:29
| #20 |
| | NvBackend.exe Ungültiges BildCode:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by admin at 2015-06-25 21:21:02 Run:2
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM
C:\Users\admin\AppData\Roaming\Steganos Updates\okayfreedom.exe
C:\Users\admin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
C:\Users\admin\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
Emptytemp:
*****************
C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM => moved successfully.
C:\Users\admin\AppData\Roaming\Steganos Updates\okayfreedom.exe => moved successfully.
C:\Users\admin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe => moved successfully.
C:\Users\admin\Downloads\SpyBot Search Destroy - CHIP-Installer.exe => moved successfully.
EmptyTemp: => 26.3 MB temporary data Removed.
The system needed a reboot..
==== End of Fixlog 21:21:21 ====
Immer noch keine Veränderung :/ [QUOTE=Tafstar;1482196] Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by admin at 2015-06-25 21:21:02 Run:2
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM
C:\Users\admin\AppData\Roaming\Steganos Updates\okayfreedom.exe
C:\Users\admin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
C:\Users\admin\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
Emptytemp:
*****************
C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM => moved successfully.
C:\Users\admin\AppData\Roaming\Steganos Updates\okayfreedom.exe => moved successfully.
C:\Users\admin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe => moved successfully.
C:\Users\admin\Downloads\SpyBot Search Destroy - CHIP-Installer.exe => moved successfully.
EmptyTemp: => 26.3 MB temporary data Removed.
The system needed a reboot..
==== End of Fixlog 21:21:21 ====
In meiner Liste befindet sich kein Chrome ? Ich habe nun Mozilla restauriert, Updates gemacht, NVIDIA Treiber neu installiert aber leider immer noch keine Veränderung. Meldung erscheint nach wie vor 4-5 mal nach einem Neustart. Liebe Grüße |
|
26.06.2015, 10:06
| #21 |
| /// the machine /// TB-Ausbilder | NvBackend.exe Ungültiges Bild Nicht die Treiber neu installieren, die Software von NVIDIA  NVIDIA GeForce Experience Hast Du das neu installiert?
__________________ --> NvBackend.exe Ungültiges Bild |
|
26.06.2015, 11:05
| #22 |
| | NvBackend.exe Ungültiges Bild Ja das hatte ich gemacht heute morgen. Ich werde den PC gleich mal neu starten und dann mal schauen ob es nochmal kommt. Ich habe nämlich als ich den PC vorhin angemacht habe keine Meldung bekommen. Ich habe ebenfalls alle Virenprogramme gelöscht die ich vorher drauf hatte und habe mir zwei aus Filepony geladen. Allerdings bekomme ich Kaspersky nicht mehr runter da ich "angeblich" keine rechte dafür habe ? Komisch fürs drauf machen brauchte ich keine Rechte aber fürs runterschmeißen von dem Schrott. Auch nicht mit Revo Ja Problem besteht weiterhin.... |
|
27.06.2015, 08:12
| #23 |
| /// the machine /// TB-Ausbilder | NvBackend.exe Ungültiges Bild Das Programm von Nvidia ansich können wir nicht reparieren, das ist denen ihr Ding. Ich kann es aus dem Autostart nehmen, dann sollte die Meldung weg sein. Frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.06.2015, 15:11
| #24 |
| | NvBackend.exe Ungültiges BildCode:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by admin (administrator) on ADMIN-PC on 27-06-2015 16:05:26
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NETGATE Technologies s.r.o.) C:\Program Files\NETGATE\Amiti Antivirus\AmitiAvSrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NETGATE Technologies s.r.o.) C:\Program Files\NETGATE\Amiti Antivirus\AmitiAv.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Apple Inc.) C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe [9549808 2015-06-24] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\...\Run: [AmitiAntivirus] => C:\Program Files\NETGATE\Amiti Antivirus\AmitiAv.exe [1866560 2013-05-27] (NETGATE Technologies s.r.o.)
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\...\Run: [GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-06-20] (Google Inc.)
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> none
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2014-09-26] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2014-09-26] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2014-09-26] ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2086946254-1975008648-3401415134-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKLM-x32 - Default Value = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-25] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-25] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2
FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\3z19yr6u.default-1435260728013
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_194.dll [2015-06-25] ()
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2014-10-15] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-06-25] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll [2014-03-11] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-25] (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-26] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-06-26] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2014-10-15] (Adobe Systems)
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\3z19yr6u.default-1435260728013\user.js [2015-06-25]
FF Extension: Adblock Plus - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\3z19yr6u.default-1435260728013\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-06-25]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
Chrome:
=======
CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-26]
CHR Extension: (Google Docs) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-26]
CHR Extension: (Google Drive) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-26]
CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-26]
CHR Extension: (Adblock Plus) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-06-26]
CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-26]
CHR Extension: (Google Sheets) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-26]
CHR Extension: (Avira Browser Safety) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-06-26]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-26]
CHR Extension: (Google Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-26]
CHR Extension: (Gmail) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-26]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 amitiavsrv; C:\Program Files\NETGATE\Amiti Antivirus\AmitiAvSrv.exe [830784 2013-05-27] (NETGATE Technologies s.r.o.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe [716664 2015-06-24] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-01] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 AVP15.0.2; "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\avp.exe" -r [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 AmitiAvGuard; C:\Windows\System32\Drivers\amitiav_guard.sys [19264 2013-05-23] (NETGATE Technologies s.r.o.)
R3 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2015-01-06] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2015-01-06] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2015-01-06] (BitDefender)
R1 BdfNdisf; c:\program files\lavasoft\ad-aware antivirus\firewall engine\1.6.0.0\drivers\bdfndisf6.sys [93160 2015-01-06] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Firewall Engine\1.6.0.0\Drivers\bdfwfpf.sys [102992 2015-01-06] (BitDefender LLC)
R3 gzflt; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.98.0\gzflt.sys [155912 2015-01-22] (BitDefender LLC)
U5 KL1; C:\Windows\System32\Drivers\KL1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [64368 2015-06-22] (Kaspersky Lab ZAO)
S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [39280 2015-06-22] (Kaspersky Lab ZAO)
S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [24944 2015-06-22] (Kaspersky Lab ZAO)
S1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [65208 2015-06-22] (Kaspersky Lab ZAO)
S1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [85360 2015-06-22] (Kaspersky Lab ZAO)
S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [190648 2015-06-22] (Kaspersky Lab ZAO)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-04-22] (Duplex Secure Ltd.)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-01-22] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S1 SpyEmrg; System32\Drivers\spyemrg.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-27 16:05 - 2015-06-27 16:08 - 00015100 _____ C:\Users\admin\Desktop\FRST.txt
2015-06-26 12:03 - 2015-06-26 12:03 - 00000000 ____D C:\Users\Administrator\AppData\Local\NVIDIA Corporation
2015-06-26 12:02 - 2015-06-26 12:02 - 00000000 ____D C:\Users\Administrator\AppData\Local\NVIDIA
2015-06-26 12:01 - 2015-06-26 12:02 - 00000000 ____D C:\Users\Administrator
2015-06-26 12:01 - 2015-06-26 12:01 - 00001419 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-26 12:01 - 2015-06-26 12:01 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Vorlagen
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Startmenü
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Verlauf
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Anwendungsdaten
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2015-06-26 12:01 - 2015-06-26 12:01 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2015-06-26 12:01 - 2014-04-05 14:44 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Macromedia
2015-06-26 12:01 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-06-26 12:01 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-06-26 10:54 - 2015-06-26 11:09 - 00000000 ____D C:\Users\admin\Desktop\Juli 2015
2015-06-26 10:48 - 2015-06-26 10:48 - 00002257 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-26 10:48 - 2015-06-26 10:48 - 00000000 ____D C:\Users\admin\AppData\Local\Google
2015-06-26 10:48 - 2015-06-26 10:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-26 10:47 - 2015-06-27 15:52 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-26 10:47 - 2015-06-27 15:49 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-26 10:47 - 2015-06-26 10:48 - 00000000 ____D C:\Program Files (x86)\Google
2015-06-26 10:47 - 2015-06-26 10:47 - 00931408 _____ (Google Inc.) C:\Users\admin\Downloads\ChromeSetup.exe
2015-06-26 10:47 - 2015-06-26 10:47 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-06-26 10:47 - 2015-06-26 10:47 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-06-26 06:56 - 2015-06-26 06:56 - 00000000 ____D C:\ProgramData\BitDefender
2015-06-25 22:25 - 2015-06-25 22:25 - 00000982 _____ C:\Users\Public\Desktop\Amiti Antivirus.lnk
2015-06-25 22:25 - 2015-06-25 22:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Amiti Antivirus
2015-06-25 22:25 - 2015-06-25 22:25 - 00000000 ____D C:\ProgramData\NETGATE
2015-06-25 22:25 - 2015-06-25 22:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amiti Antivirus
2015-06-25 22:25 - 2015-06-25 22:25 - 00000000 ____D C:\Program Files\NETGATE
2015-06-25 22:25 - 2013-05-23 17:41 - 00019264 _____ (NETGATE Technologies s.r.o.) C:\Windows\system32\Drivers\amitiav_guard.sys
2015-06-25 22:24 - 2015-06-25 22:24 - 00000000 ____D C:\Users\admin\AppData\Roaming\LavasoftStatistics
2015-06-25 22:24 - 2015-01-06 13:47 - 01061776 _____ (BitDefender S.R.L.) C:\Windows\system32\bdsmtpp.dll
2015-06-25 22:24 - 2015-01-06 13:47 - 00209984 _____ (BitDefender) C:\Windows\system32\BdFirewallSDK.dll
2015-06-25 22:24 - 2015-01-06 13:47 - 00195016 _____ (BitDefender) C:\Windows\system32\httproxy.dll
2015-06-25 22:24 - 2015-01-06 13:47 - 00156936 _____ C:\Windows\system32\bdfwcore.dll
2015-06-25 22:24 - 2015-01-06 13:47 - 00155912 _____ (BitDefender S.R.L.) C:\Windows\system32\bdpop3p.dll
2015-06-25 22:24 - 2015-01-06 13:47 - 00122928 _____ (BitDefender) C:\Windows\system32\OEMbdpredir.dll
2015-06-25 22:24 - 2015-01-06 13:47 - 00096160 _____ (BitDefender) C:\Windows\system32\bdpredir.dll
2015-06-25 22:24 - 2015-01-06 13:37 - 02084072 _____ (Bitdefender) C:\Windows\system32\bdnc.dll
2015-06-25 22:23 - 2015-06-27 15:47 - 00002327 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-06-25 22:23 - 2015-06-25 22:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-06-25 22:15 - 2015-06-25 22:15 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-06-25 22:12 - 2015-06-25 22:12 - 00000000 ____D C:\Program Files\Lavasoft
2015-06-25 22:09 - 2015-06-25 22:09 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2015-06-25 22:08 - 2015-06-25 22:08 - 07979640 _____ (NETGATE Technologies s.r.o. ) C:\Users\admin\Downloads\aa-setup-ngt_1.0.195.0.exe
2015-06-25 22:08 - 2015-06-25 22:08 - 00000000 ____D C:\ProgramData\Lavasoft
2015-06-25 22:07 - 2015-06-25 22:07 - 02071768 _____ C:\Users\admin\Downloads\AdAware116WebInstaller.exe
2015-06-25 22:02 - 2015-06-25 22:02 - 00000085 _____ C:\Windows\wininit.ini
2015-06-25 21:59 - 2015-02-04 04:21 - 06782152 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-06-25 21:59 - 2015-02-04 04:21 - 03522376 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-06-25 21:59 - 2015-02-04 04:21 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-06-25 21:59 - 2015-02-04 04:21 - 00932040 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-06-25 21:59 - 2015-02-04 04:21 - 00384200 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-06-25 21:59 - 2015-02-04 04:21 - 00062792 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-06-25 21:59 - 2015-02-04 02:00 - 00608072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-06-25 21:59 - 2015-02-03 18:18 - 04229086 _____ C:\Windows\system32\nvcoproc.bin
2015-06-25 21:58 - 2015-02-04 05:56 - 00072904 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-06-25 21:58 - 2015-02-04 05:56 - 00059592 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 31515280 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 24198856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 22993224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 18634072 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 17559432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 16128576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 15294280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 14497568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 13916280 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 13828032 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 12894024 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-06-25 21:54 - 2015-02-04 05:56 - 11272240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 11209192 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 04244680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 03987600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 03209736 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 02823992 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 01907400 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434144.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 01555656 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434144.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 00944328 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 00907464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 00902344 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 00870032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-06-25 21:54 - 2015-02-04 05:56 - 00026155 _____ C:\Windows\system32\nvinfo.pb
2015-06-25 21:51 - 2015-06-25 21:51 - 00000000 ____D C:\NVIDIA
2015-06-25 21:47 - 2015-06-25 21:49 - 283376896 _____ (NVIDIA Corporation) C:\Users\admin\Downloads\341.44-desktop-win8-win7-winvista-64bit-international-whql.exe
2015-06-25 21:44 - 2015-06-25 21:44 - 00000000 ____D C:\Windows\Sun
2015-06-24 07:37 - 2015-06-27 15:45 - 00008916 _____ C:\Windows\PFRO.log
2015-06-24 07:37 - 2015-06-24 07:37 - 00000008 __RSH C:\ProgramData\ntuser.pol
2015-06-23 13:59 - 2015-06-27 01:04 - 00011008 _____ C:\Windows\IE11_main.log
2015-06-23 13:49 - 2015-06-23 13:49 - 00000000 ___SD C:\ComboFix
2015-06-23 11:03 - 2015-06-27 15:45 - 00002517 _____ C:\Windows\setupact.log
2015-06-23 11:03 - 2015-06-23 11:03 - 00000000 _____ C:\Windows\setuperr.log
2015-06-22 14:04 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-22 14:04 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-22 14:04 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-22 14:04 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-22 14:03 - 2015-06-23 13:49 - 00000000 ____D C:\Qoobox
2015-06-22 14:03 - 2015-06-22 14:35 - 00000000 ____D C:\Windows\erdnt
2015-06-22 13:45 - 2015-06-22 13:45 - 00001274 _____ C:\Users\admin\Desktop\Revo Uninstaller.lnk
2015-06-22 13:45 - 2015-06-22 13:45 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2015-06-21 03:40 - 2015-06-21 03:41 - 00000008 __RSH C:\Users\admin\ntuser.pol
2015-06-20 22:40 - 2015-06-27 16:06 - 00000000 ____D C:\FRST
2015-06-20 22:38 - 2015-06-25 07:44 - 02112512 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2015-06-20 01:42 - 2015-06-20 01:42 - 00262144 _____ C:\Windows\system32\config\elam
2015-06-20 01:15 - 2015-06-20 01:37 - 00000000 ____D C:\Users\admin\AppData\Local\DesktopSearch
2015-06-19 23:19 - 2015-06-19 23:19 - 00000000 ____D C:\Windows\ELAMBKUP
2015-06-19 23:18 - 2015-06-26 10:59 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-06-19 23:18 - 2015-06-26 07:09 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-06-19 22:50 - 2015-06-19 22:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-19 22:26 - 2015-06-27 16:07 - 00944989 _____ C:\Windows\WindowsUpdate.log
2015-06-19 21:53 - 2015-06-19 22:23 - 00000000 ____D C:\ProgramData\Avira
2015-06-19 21:38 - 2015-06-19 23:08 - 00003450 _____ C:\Windows\System32\Tasks\Unknevna
2015-06-19 21:15 - 2015-06-19 21:15 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-06-19 13:06 - 2015-06-19 13:06 - 00000000 ____D C:\Users\admin\AppData\Local\YouTubeToMp3
2015-06-19 12:38 - 2009-09-27 09:39 - 00415744 ___SH (The Public) C:\Windows\SysWOW64\avisynth.dll
2015-06-19 12:38 - 2005-07-14 12:31 - 00032256 ___SH C:\Windows\SysWOW64\AVSredirect.dll
2015-06-19 12:38 - 2004-02-22 10:11 - 00764416 ___SH (Abysmal Software) C:\Windows\SysWOW64\devil.dll
2015-06-19 12:38 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\yv12vfw.dll
2015-06-19 12:38 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\i420vfw.dll
2015-06-19 12:34 - 2015-06-19 12:54 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-06-19 12:21 - 2015-06-19 12:21 - 00000000 _____ C:\Users\admin\AppData\Local\Temp.dat
2015-06-19 12:04 - 2015-06-19 12:25 - 00000000 ____D C:\Users\admin\AppData\Local\Opera Software
2015-06-19 12:03 - 2015-06-19 12:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Opera Software
2015-06-19 12:00 - 2015-06-19 12:25 - 00000000 ____D C:\Program Files (x86)\Opera
2015-06-19 12:00 - 2014-11-05 03:02 - 00008122 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-06-19 11:59 - 2015-06-20 02:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\83EA6FB1-1434707985-8131-A962-804A74206928
2015-06-19 11:49 - 2015-06-20 01:11 - 00000000 ____D C:\ProgramData\{0454ec79-c46f-8a7a-0454-4ec79c46b1e7}
2015-06-19 09:21 - 2015-06-19 12:52 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2015-06-19 09:21 - 2004-10-10 09:50 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
2015-06-19 09:21 - 2004-07-02 17:33 - 00327749 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\drvc.dll
2015-06-19 09:02 - 2015-06-19 14:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Data Recovery Suite
2015-06-19 08:58 - 2015-06-19 08:58 - 00000000 ____D C:\ProgramData\OO Software
2015-06-18 10:21 - 2015-06-19 12:18 - 00000000 ____D C:\Program Files (x86)\SupervisionCam
2015-06-18 10:15 - 2015-06-18 10:15 - 00000000 ____D C:\Users\admin\AppData\Roaming\CrazyPixels
2015-06-10 13:51 - 2015-06-10 13:51 - 00000000 ____D C:\04880cb472b061b0e55e9f0dd2
2015-06-10 12:56 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 12:56 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 12:55 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 12:55 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 12:55 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 12:55 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 12:55 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 12:55 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 12:55 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 12:55 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 12:55 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 12:55 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 12:55 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 12:55 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 12:55 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 12:55 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 12:55 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 12:55 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 12:55 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 12:55 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 12:55 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 12:55 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 12:55 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 12:55 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 12:55 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 12:55 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 12:55 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 12:55 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 12:55 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 12:55 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 12:55 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 12:55 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 12:55 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 12:55 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 12:55 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 12:55 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 12:55 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 12:55 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 12:55 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 12:54 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 12:54 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-07 14:39 - 2015-06-07 14:39 - 00000000 ____D C:\Users\admin\AppData\Roaming\TeamViewer
2015-06-06 16:19 - 2015-06-26 11:33 - 00000000 ____D C:\Users\admin\Desktop\Juni 2015
2015-06-06 15:54 - 2015-06-06 15:54 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf
2015-05-29 14:21 - 2015-05-29 14:21 - 00000000 ____D C:\found.000
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-27 15:56 - 2009-07-14 06:45 - 00039920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-27 15:56 - 2009-07-14 06:45 - 00039920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-27 15:45 - 2014-07-14 20:01 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-27 15:45 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-26 15:35 - 2014-04-05 14:44 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-26 15:21 - 2013-06-10 07:45 - 00699092 _____ C:\Windows\system32\perfh007.dat
2015-06-26 15:21 - 2013-06-10 07:45 - 00149232 _____ C:\Windows\system32\perfc007.dat
2015-06-26 15:21 - 2009-07-14 07:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-26 12:02 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-26 07:08 - 2014-08-23 06:20 - 00000000 ____D C:\Users\admin\AppData\Local\Adobe
2015-06-25 22:55 - 2014-07-29 09:04 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-06-25 22:02 - 2014-07-29 09:04 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-06-25 22:02 - 2014-04-05 14:49 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2015-06-25 22:00 - 2014-09-21 17:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-06-25 21:59 - 2014-07-14 20:01 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-06-25 21:59 - 2014-07-14 19:59 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-06-25 21:59 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Help
2015-06-25 21:57 - 2014-07-14 19:59 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-06-25 21:50 - 2014-04-05 14:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-25 21:50 - 2014-04-05 14:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-25 21:50 - 2014-04-05 14:44 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-25 21:46 - 2014-04-22 20:22 - 00000000 ____D C:\ProgramData\Oracle
2015-06-25 21:44 - 2014-08-16 12:40 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-06-25 21:44 - 2014-04-05 14:44 - 00000000 ____D C:\Program Files (x86)\Java
2015-06-25 21:21 - 2015-04-22 22:57 - 00000000 ____D C:\Users\admin\AppData\Roaming\Steganos Updates
2015-06-25 21:21 - 2014-07-31 10:10 - 00000000 ____D C:\Users\admin\AppData\Local\CrashDumps
2015-06-24 07:37 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2015-06-24 07:35 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2015-06-22 16:54 - 2015-05-18 22:16 - 00064368 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kldisk.sys
2015-06-22 16:54 - 2014-11-22 14:12 - 00085360 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwtp.sys
2015-06-22 16:54 - 2014-11-10 17:48 - 00190648 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2015-06-22 16:54 - 2014-10-10 17:02 - 00039280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2015-06-22 16:54 - 2014-10-09 12:31 - 00065208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kltdi.sys
2015-06-22 16:54 - 2014-03-31 10:47 - 00478392 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2015-06-22 16:54 - 2013-04-12 14:34 - 00024944 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klpd.sys
2015-06-22 16:53 - 2013-01-14 20:10 - 00247016 _____ (Kaspersky Lab UK Ltd) C:\Windows\system32\Drivers\cm_km_w.sys
2015-06-22 14:38 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2015-06-22 14:30 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-21 03:41 - 2007-08-28 01:56 - 00000000 ____D C:\Users\admin
2015-06-21 03:33 - 2015-01-23 19:53 - 00002614 _____ C:\Users\Public\Desktop\Logitech Webcam Software.lnk
2015-06-20 01:11 - 2015-04-03 17:46 - 00000000 ____D C:\ProgramData\{311b518e-e658-8319-311b-b518ee65463b}
2015-06-19 23:00 - 2014-07-29 12:54 - 00000000 ____D C:\AdwCleaner
2015-06-19 22:23 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-19 22:04 - 2014-08-15 12:00 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-19 21:47 - 2015-01-22 19:36 - 00000000 ____D C:\Program Files\VideoLAN
2015-06-19 21:46 - 2014-11-01 01:11 - 00000000 ____D C:\Program Files (x86)\Steam
2015-06-19 21:45 - 2007-08-28 01:57 - 00001417 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-19 13:05 - 2014-10-07 20:21 - 00001294 _____ C:\Users\admin\Desktop\MediaHuman YouTube to MP3 Converter.lnk
2015-06-19 12:52 - 2014-08-16 12:14 - 00000000 ____D C:\Users\admin\AppData\Roaming\uTorrent
2015-06-19 12:48 - 2015-03-10 23:44 - 00000000 ____D C:\Users\admin\Tracing
2015-06-19 12:17 - 2015-04-26 11:02 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-06-19 12:17 - 2015-03-29 00:10 - 00000983 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-06-19 12:17 - 2015-03-10 23:41 - 00002717 _____ C:\Users\Public\Desktop\Skype.lnk
2015-06-19 12:17 - 2015-01-24 21:28 - 00002605 _____ C:\Users\Public\Desktop\iSpy64.lnk
2015-06-19 12:17 - 2015-01-11 22:24 - 00001156 _____ C:\Users\admin\Desktop\Blur.lnk
2015-06-19 12:17 - 2014-11-01 01:11 - 00000991 _____ C:\Users\Public\Desktop\Steam.lnk
2015-06-19 12:05 - 2009-07-14 04:34 - 00000505 _____ C:\Windows\win.ini
2015-06-18 18:51 - 2015-01-22 19:28 - 00000000 ____D C:\Users\admin\AppData\Roaming\iSpy
2015-06-17 06:11 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-11 16:40 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 16:03 - 2009-07-14 06:45 - 00416688 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 08:46 - 2015-01-24 16:06 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 08:46 - 2014-04-22 20:44 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-10 13:51 - 2014-04-05 15:58 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 13:51 - 2014-04-05 15:58 - 00000000 ____D C:\Windows\system32\MRT
2015-06-07 14:39 - 2015-03-29 00:10 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-06-07 14:38 - 2015-03-29 00:10 - 00000977 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
==================== Files in the root of some directories =======
2015-04-23 21:35 - 2015-04-23 21:36 - 0011602 _____ () C:\Users\admin\AppData\Local\Temp-log.txt
2015-06-19 12:21 - 2015-06-19 12:21 - 0000000 _____ () C:\Users\admin\AppData\Local\Temp.dat
2014-07-14 19:30 - 2014-07-14 19:30 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\admin\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\admin\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\admin\AppData\Local\Temp\nvStInst.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-23 06:47
==================== End of log ============================
|
|
28.06.2015, 12:15
| #25 |
| /// the machine /// TB-Ausbilder | NvBackend.exe Ungültiges Bild Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
Task: {2837587A-F0A5-48E1-9AD2-5D764387031C} - System32\Tasks\{3C7045C7-B4F9-410D-B94F-AE25B111302D} => pcalua.exe -a C:\Users\admin\Downloads\trilogyi.exe -d C:\Users\admin\Downloads
Task: {FA3F4B31-85A4-4EC3-88B2-C596EA7F5347} - System32\Tasks\Unknevna => C:\ProgramData\Unknevna\1.0.1.0\eiiuhimu.exe
C:\ProgramData\Unknevna
Task: C:\Windows\Tasks\IVRaAuPZ53HmhODfZcM.job => C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM.exe <==== ATTENTION
C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM.exe
Hosts:
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.06.2015, 16:26
| #26 |
| | NvBackend.exe Ungültiges BildCode:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:24-06-2015
Ran by admin at 2015-06-29 17:21:07 Run:4
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin & Administrator)
Boot Mode: Normal
==============================================
fixlist content:
*****************
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
Task: {2837587A-F0A5-48E1-9AD2-5D764387031C} - System32\Tasks\{3C7045C7-B4F9-410D-B94F-AE25B111302D} => pcalua.exe -a C:\Users\admin\Downloads\trilogyi.exe -d C:\Users\admin\Downloads
Task: {FA3F4B31-85A4-4EC3-88B2-C596EA7F5347} - System32\Tasks\Unknevna => C:\ProgramData\Unknevna\1.0.1.0\eiiuhimu.exe
C:\ProgramData\Unknevna
Task: C:\Windows\Tasks\IVRaAuPZ53HmhODfZcM.job => C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM.exe <==== ATTENTION
C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM.exe
Hosts:
Emptytemp:
*****************
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\NvBackend => value not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2837587A-F0A5-48E1-9AD2-5D764387031C} => key not found.
C:\Windows\System32\Tasks\{3C7045C7-B4F9-410D-B94F-AE25B111302D} not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{3C7045C7-B4F9-410D-B94F-AE25B111302D} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA3F4B31-85A4-4EC3-88B2-C596EA7F5347} => key not found.
C:\Windows\System32\Tasks\Unknevna not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Unknevna => key not found.
"C:\ProgramData\Unknevna" => File/Folder not found.
C:\Windows\Tasks\IVRaAuPZ53HmhODfZcM.job not found.
"C:\Users\admin\AppData\Roaming\IVRaAuPZ53HmhODfZcM.exe" => File/Folder not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully.
Hosts restored successfully.
EmptyTemp: => 154.6 MB temporary data Removed.
The system needed a reboot..
==== End of Fixlog 17:21:26 ====
|
|
30.06.2015, 06:27
| #27 |
| /// the machine /// TB-Ausbilder | NvBackend.exe Ungültiges Bild Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.06.2015, 22:01
| #28 |
| | NvBackend.exe Ungültiges Bild bis jetzt ist keine Meldung mehr gekommen. Was genau ist der Hintergrund warum diese Meldung nicht mehr kommt? |
|
01.07.2015, 11:36
| #29 |
| /// the machine /// TB-Ausbilder | NvBackend.exe Ungültiges Bild Wie oben schon erwähnt, wir haben es aus dem Autostart genommen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu NvBackend.exe Ungültiges Bild |
| angezeigt, ausführung, bild, ccleaner, daten, daten wiederherstellen, deinstalliert, entgültig, enthält, erhalte, erneut, gestern, installieren, installiert, kaspersky, langsam, mögliche, nvbackend, programm, programme, troja, trojaner, unterstützung, viren, virus, welchem, wiederherstellen, windows |
Linear-Darstellung
