| |
| |||||||
Log-Analyse und Auswertung: Windows 8: URLs/Subdomains können temporär nicht erreicht werdenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.10.2015, 11:10
| #1 |
 |  Windows 8: URLs/Subdomains können temporär nicht erreicht werden Hallo, leider kann ich mit meinem Rechner einige URLs temporär nicht erreichen. Der Browser spielt hier wohl keine Rolle. Manchmal sind ganze Seiten nicht erreichbar, und manchmal nur Subdomains wie rover.eb**y.de. Alles ist aber nur temporär. Mit einem Proxy habe ich übrigens gar keine Probleme. Ich habe mir mal meine "hosts"-Datei angeschaut, aber die ist sauber. Sonst hat meine Avira-Firewall auch einen (Port?)-Scan gemeldet, aber die Meldung ist leider nicht im Log hängen geblieben. Vorab schonmal vielen Dank für Eure Hilfe hier!!!! Ich habe die Anleitung einmal durchgearbeitet: Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:00 on 03/10/2015 (N***)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-09-2015 Ran by N*** (administrator) on S****** (03-10-2015 11:07:14) Running from C:\Users\M*\Desktop Loaded Profiles: N*** & (Available Profiles: N***) Platform: Windows 8.1 Pro (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ACD Systems) D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (CyberGhost S.R.L.) C:\Program Files\CyberGhost 5\CyberGhost.exe () D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe (Suunto) C:\Users\M*\AppData\Local\Apps\2.0\MAHMQXVP.AEE\8B91HD6N.209\move..tion_391e8feca7b0cf78_0001.0003_5445a9a08ee15d6c\Moveslink2.exe (Learnpulse) C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Nullsoft) D:\Program Files (x86)\Winamp\winamp.exe (Mozilla Corporation) D:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (The OpenVPN Project) C:\Program Files\CyberGhost 5\Data\OpenVPN\openvpn.exe (Malwarebytes Corporation) D:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Windows\System32\calc.exe () C:\Users\M*\Desktop\Defogger.exe (Avira Operations GmbH & Co. KG) D:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor) HKLM\...\Run: [ACPW08DE] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\acdIDInTouch2.exe [1813776 2014-09-17] (ACD Systems) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-09-19] (Adobe Systems Incorporated) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-03] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [avgnt] => D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737712 2015-08-26] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.) HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd) HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Moveslink2] => C:\Users\M*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] () HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Run: [Screenpresso] => C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse) HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Moveslink2] => C:\Users\M*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] () HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Screenpresso] => C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [CyberGhost] => C:\Program Files\CyberGhost 5\CyberGhost.exe [430048 2015-05-21] (CyberGhost S.R.L.) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Moveslink2] => C:\Users\M*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Suunto\Moveslink2.appref-ms -auto HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [ACDSeeCommanderPro8] => D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe [2141192 2014-12-17] () HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Screenpresso] => C:\Users\M*\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [11928080 2015-08-10] (Learnpulse) HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {de9d60c1-dad0-11e4-82de-002522ccc8b0} - "G:\iLinker.exe" HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: [S-1-5-21-750122456-1480246655-3734385838-1001] => Proxy is enabled. ProxyServer: [S-1-5-21-750122456-1480246655-3734385838-1001] => http=127.0.0.1:8887;https=127.0.0.1:8887 ProxyEnable: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => Proxy is enabled. ProxyServer: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => http=127.0.0.1:8887;https=127.0.0.1:8887 ProxyEnable: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1] => Proxy is enabled. ProxyServer: [S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1] => http=127.0.0.1:8887;https=127.0.0.1:8887 Tcpip\Parameters: [DhcpNameServer] 95.169.183.219 89.41.60.38 37.221.175.198 Tcpip\..\Interfaces\{07206F4B-DD46-4FF7-8312-D22C976ECBD4}: [NameServer] 95.169.183.219,89.41.60.38 Tcpip\..\Interfaces\{07206F4B-DD46-4FF7-8312-D22C976ECBD4}: [DhcpNameServer] 95.169.183.219 89.41.60.38 37.221.175.198 Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [NameServer] 95.169.183.219,89.41.60.38 Tcpip\..\Interfaces\{269BA231-1594-4ADF-80A5-067D3C7CD184}: [DhcpNameServer] 192.168.0.1 192.168.0.2 Internet Explorer: ================== HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-10-15] (Oracle Corporation) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-15] (Oracle Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\M*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-21] () FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-15] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-15] (Oracle Corporation) FF Plugin: @videolan.org/vlc,version=2.1.5 -> d:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-09-19] (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-21] () FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-07] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-07] (NVIDIA Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-09-19] (Adobe Systems) FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\M*\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\M*\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\M*\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-11-11] (Unity Technologies ApS) FF Extension: Delete Bookmark Icons - C:\Users\M*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{04514a2c-a3ab-4f47-8688-55f911b0fe75}.xpi [2015-03-05] FF Extension: Adblock Plus - C:\Users\M*\AppData\Roaming\Mozilla\Firefox\Profiles\nn48y589.default-1425506034672\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-07] StartMenuInternet: FIREFOX.EXE - d:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirFirewallService; D:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1054976 2015-08-26] (Avira Operations GmbH & Co. KG) R2 AntiVirMailService; D:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [835616 2015-08-26] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [456528 2015-08-26] (Avira Operations GmbH & Co. KG) R2 AntiVirService; D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [456528 2015-08-26] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; D:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1013264 2015-08-26] (Avira Operations GmbH & Co. KG) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation) R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [63968 2015-05-21] (CyberGhost S.R.L) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-23] (NVIDIA Corporation) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed] S2 MBAMService; d:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-06-03] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23007376 2015-06-03] (NVIDIA Corporation) S2 SkypeUpdate; D:\Program Files (x86)\Skype\Updater\Updater.exe [327296 2015-06-03] (Skype Technologies) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 avfwim; C:\Windows\system32\DRIVERS\avfwim.sys [114608 2014-12-08] (Avira GmbH) R1 avfwot; C:\Windows\system32\DRIVERS\avfwot.sys [141376 2014-12-08] (Avira GmbH) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [137288 2015-08-26] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [148632 2015-08-26] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-03] (Avira Operations GmbH & Co. KG) S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation) S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-10-03] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation) S3 nuviocir; C:\Windows\system32\DRIVERS\nuviocir_x64.sys [39704 2013-07-15] (Nuvoton Technology Corp.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-06-03] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2015-04-03] (NVIDIA Corporation) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-10-03 11:07 - 2015-10-03 11:07 - 00019905 _____ C:\Users\M*\Desktop\FRST.txt 2015-10-03 11:07 - 2015-10-03 11:07 - 00000000 ____D C:\FRST 2015-10-03 11:05 - 2015-10-03 11:05 - 02192384 _____ (Farbar) C:\Users\M*\Desktop\FRST64.exe 2015-10-03 11:00 - 2015-10-03 11:00 - 00000470 _____ C:\Users\M*\Desktop\defogger_disable.log 2015-10-03 10:59 - 2015-10-03 10:59 - 00000470 _____ C:\Users\M*\Downloads\defogger_disable.log 2015-10-03 10:59 - 2015-10-03 10:59 - 00000000 _____ C:\Users\M*\defogger_reenable 2015-10-03 10:59 - 2015-10-03 10:58 - 00050477 _____ C:\Users\M*\Desktop\Defogger.exe 2015-09-22 18:34 - 2015-08-22 15:42 - 00901264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00984448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll 2015-09-22 18:34 - 2015-08-22 15:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll 2015-09-22 18:34 - 2015-08-10 20:15 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL 2015-09-22 18:34 - 2015-08-10 20:15 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL 2015-09-22 18:34 - 2015-08-10 20:06 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL 2015-09-22 18:34 - 2015-08-10 19:49 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll 2015-09-22 18:34 - 2015-08-10 18:56 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL 2015-09-22 18:34 - 2015-08-10 18:46 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll 2015-09-22 18:34 - 2015-08-07 23:41 - 07460168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-09-22 18:34 - 2015-08-07 23:40 - 01736520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2015-09-22 18:34 - 2015-08-07 23:40 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2015-09-22 18:34 - 2015-08-07 23:40 - 01134752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2015-09-22 18:34 - 2015-08-07 23:40 - 00686960 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll 2015-09-22 18:34 - 2015-08-07 23:40 - 00507176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll 2015-09-22 18:34 - 2015-08-07 16:13 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2015-09-22 18:34 - 2015-08-06 21:15 - 01658544 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2015-09-22 18:34 - 2015-08-06 21:15 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2015-09-22 18:34 - 2015-08-06 21:15 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2015-09-22 18:34 - 2015-08-06 21:15 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2015-09-22 18:34 - 2015-08-06 19:05 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx 2015-09-22 18:34 - 2015-08-06 18:47 - 04710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll 2015-09-22 18:34 - 2015-08-06 18:37 - 00536576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx 2015-09-22 18:34 - 2015-08-06 18:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2015-09-22 18:34 - 2015-07-16 20:58 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NcdAutoSetup.dll 2015-09-08 22:16 - 2015-09-03 04:18 - 02531400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-09-08 22:16 - 2015-09-03 04:17 - 01903848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-09-08 22:16 - 2015-09-02 20:48 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-09-08 22:16 - 2015-09-02 19:09 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-09-08 22:16 - 2015-08-27 04:48 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2015-09-08 22:16 - 2015-08-26 20:00 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2015-09-08 22:16 - 2015-08-26 20:00 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll 2015-09-08 22:16 - 2015-08-26 20:00 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2015-09-08 22:16 - 2015-08-26 20:00 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe 2015-09-08 22:16 - 2015-08-26 16:46 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2015-09-08 22:16 - 2015-08-26 16:29 - 02240512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll 2015-09-08 22:16 - 2015-08-26 16:27 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2015-09-08 22:16 - 2015-08-26 16:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll 2015-09-08 22:16 - 2015-08-26 16:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll 2015-09-08 22:16 - 2015-08-26 16:26 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2015-09-08 22:16 - 2015-08-26 16:26 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe 2015-09-08 22:16 - 2015-08-22 20:19 - 25188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-09-08 22:16 - 2015-08-22 19:35 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-09-08 22:16 - 2015-08-22 19:34 - 00585216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-09-08 22:16 - 2015-08-22 19:22 - 19856384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-09-08 22:16 - 2015-08-22 19:21 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-09-08 22:16 - 2015-08-22 19:20 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-09-08 22:16 - 2015-08-22 18:55 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-09-08 22:16 - 2015-08-22 18:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-09-08 22:16 - 2015-08-22 18:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2015-09-08 22:16 - 2015-08-22 18:45 - 00665600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-09-08 22:16 - 2015-08-22 18:44 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2015-09-08 22:16 - 2015-08-22 18:41 - 14451712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-09-08 22:16 - 2015-08-22 18:41 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-09-08 22:16 - 2015-08-22 18:41 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2015-09-08 22:16 - 2015-08-22 18:41 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2015-09-08 22:16 - 2015-08-22 18:39 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-09-08 22:16 - 2015-08-22 18:28 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-09-08 22:16 - 2015-08-22 18:26 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-09-08 22:16 - 2015-08-22 18:23 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2015-09-08 22:16 - 2015-08-22 18:22 - 12857344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-09-08 22:16 - 2015-08-22 18:20 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2015-09-08 22:16 - 2015-08-22 18:18 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2015-09-08 22:16 - 2015-08-22 18:18 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-09-08 22:16 - 2015-08-22 18:18 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2015-09-08 22:16 - 2015-08-22 18:14 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-09-08 22:16 - 2015-08-22 18:01 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2015-09-08 22:16 - 2015-08-22 18:00 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-09-08 22:16 - 2015-08-22 17:56 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-09-08 22:16 - 2015-08-22 17:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2015-09-08 22:16 - 2015-07-30 19:18 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\InkEd.dll 2015-09-08 22:16 - 2015-07-30 18:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InkEd.dll 2015-09-08 22:15 - 2015-09-02 04:56 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2015-09-08 22:15 - 2015-09-02 04:55 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2015-09-08 22:15 - 2015-09-02 04:50 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2015-09-08 22:15 - 2015-09-02 04:17 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2015-09-08 22:15 - 2015-09-02 04:13 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2015-09-08 22:15 - 2015-08-03 23:15 - 00074928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidapi.dll 2015-09-08 22:15 - 2015-08-03 23:15 - 00065600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appidapi.dll 2015-09-08 22:15 - 2015-08-01 16:22 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidsvc.dll 2015-09-08 22:15 - 2015-08-01 05:47 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\schtasks.exe 2015-09-08 22:15 - 2015-08-01 05:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schtasks.exe 2015-09-08 22:15 - 2015-08-01 05:38 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll 2015-09-08 22:15 - 2015-08-01 05:37 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskeng.exe 2015-09-08 22:15 - 2015-08-01 05:37 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskeng.exe 2015-09-08 22:15 - 2015-07-22 16:34 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2015-09-08 22:15 - 2015-07-22 16:33 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll 2015-09-08 22:15 - 2015-07-22 16:25 - 02461184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2015-09-08 22:15 - 2015-07-22 16:25 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll 2015-09-08 22:15 - 2015-07-18 20:31 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll 2015-09-08 22:15 - 2015-07-18 20:29 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll 2015-09-08 22:15 - 2015-07-18 20:29 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll 2015-09-08 22:15 - 2015-07-18 20:27 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-10-03 11:06 - 2014-11-18 00:07 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-10-03 11:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru 2015-10-03 10:59 - 2013-08-23 00:08 - 00000000 ____D C:\Users\M* 2015-10-03 10:36 - 2013-08-23 00:19 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-750122456-1480246655-3734385838-1001 2015-10-03 10:31 - 2015-03-03 20:43 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-10-03 10:30 - 2015-03-03 20:41 - 00000826 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-10-03 10:30 - 2015-03-03 20:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-10-03 09:45 - 2015-03-14 20:56 - 00000000 ____D C:\Users\M*\AppData\Local\Deployment 2015-10-02 20:16 - 2015-02-15 12:10 - 01823445 _____ C:\WINDOWS\WindowsUpdate.log 2015-09-29 22:03 - 2014-08-27 21:19 - 00000000 ____D C:\Users\M*\AppData\Roaming\vlc 2015-09-29 18:48 - 2013-08-23 00:14 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-09-29 18:41 - 2015-05-29 20:39 - 00000000 ____D C:\ProgramData\NVIDIA 2015-09-29 18:41 - 2015-03-15 11:58 - 00033720 _____ C:\WINDOWS\setupact.log 2015-09-29 18:41 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-09-27 17:47 - 2014-10-20 20:41 - 00000000 ____D C:\Users\M*\AppData\Local\CyberGhost 2015-09-24 10:20 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache 2015-09-22 18:35 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-09-21 22:06 - 2014-11-18 00:07 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2015-09-15 03:18 - 2013-08-22 17:38 - 00812008 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-09-15 03:18 - 2013-08-22 17:38 - 00178152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-09-13 00:07 - 2015-07-31 23:17 - 00000000 ____D C:\Users\M*\AppData\Roaming\Bioshock 2015-09-09 19:59 - 2015-03-15 12:39 - 00362792 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-09-09 19:56 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions 2015-09-08 22:20 - 2013-08-22 21:11 - 00000000 ____D C:\Program Files\Windows Journal 2015-09-08 22:19 - 2014-08-27 20:54 - 00000000 ____D C:\WINDOWS\system32\M*T Some files in TEMP: ==================== C:\Users\M*\AppData\Local\Temp\avgnt.exe C:\Users\M*\AppData\Local\Temp\AZxfyihpcsUxOPURbdOO.DLL C:\Users\M*\AppData\Local\Temp\i4jdel0.exe C:\Users\M*\AppData\Local\Temp\iSNYcLSqMQ.DLL C:\Users\M*\AppData\Local\Temp\mExgeeVDIOvSblHxCxIx.DLL C:\Users\M*\AppData\Local\Temp\nvStInst.exe C:\Users\M*\AppData\Local\Temp\OXTqqBUkQIvbJHJNpPST.DLL C:\Users\M*\AppData\Local\Temp\proxy_vole6515560313283769685.dll C:\Users\M*\AppData\Local\Temp\RzhqfrvaIb.DLL C:\Users\M*\AppData\Local\Temp\SkypeSetup.exe C:\Users\M*\AppData\Local\Temp\TJcqOEiClNxNAIzFTyeb.DLL C:\Users\M*\AppData\Local\Temp\ueoHSLTboj.DLL C:\Users\M*\AppData\Local\Temp\VtAERJvAFreCvAWmdjwz.DLL C:\Users\M*\AppData\Local\Temp\ZojWDFQuKnPGaJNelZXo.DLL ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-09-26 01:48 ==================== End of FRST.txt ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version:30-09-2015
Ran by N*** (2015-10-03 11:08:05)
Running from C:\Users\M*\Desktop
Windows 8.1 Pro (X64) (2013-08-22 22:11:16)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-750122456-1480246655-3734385838-500 - Administrator - Disabled)
Guest (S-1-5-21-750122456-1480246655-3734385838-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-750122456-1480246655-3734385838-1007 - Limited - Enabled)
N*** (S-1-5-21-750122456-1480246655-3734385838-1001 - Administrator - Enabled) => C:\Users\M*
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: FireWall (Enabled) {753F9273-B322-2907-AC37-03D0F1702F22}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
ACDSee Pro 8 (64-bit) (HKLM\...\{F84CE839-8CDD-4DC1-9A05-FA93BEA8B63D}) (Version: 8.1.0.270 - ACD Systems International Inc.)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Lightroom (HKLM-x32\...\{8048A5DF-8A70-5BE1-954B-E0FDE1BD0D0D}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Avira Internet Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.12.264 - Avira Operations GmbH & Co. KG)
BioShock version 1.1 (HKLM-x32\...\{4AA8D978-38C1-475B-936C-C79143624B61}_is1) (Version: 1.1 - 2K Games)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.4 - BlueJ Team)
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version: - CyberGhost S.R.L.)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java SE Development Kit 8 Update 20 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180200}) (Version: 8.0.200.26 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Moveslink2 (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\09caaf8ee8bfbd57) (Version: 1.3.23.5732 - Suunto)
Moveslink2 (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\09caaf8ee8bfbd57) (Version: 1.3.23.5732 - Suunto)
Moveslink2 (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\09caaf8ee8bfbd57) (Version: 1.3.23.5732 - Suunto)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Firefox 41.0.1 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Mozilla Firefox 41.0.1 (x86 de)) (Version: 41.0.1 - Mozilla)
Mozilla Firefox 41.0.1 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Mozilla Firefox 41.0.1 (x86 de)) (Version: 41.0.1 - Mozilla)
Mozilla Firefox 41.0.1 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Mozilla Firefox 41.0.1 (x86 de)) (Version: 41.0.1 - Mozilla)
Mozilla Thunderbird 38.3.0 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Mozilla Thunderbird 38.3.0 (x86 de)) (Version: 38.3.0 - Mozilla)
Mozilla Thunderbird 38.3.0 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Mozilla Thunderbird 38.3.0 (x86 de)) (Version: 38.3.0 - Mozilla)
Mozilla Thunderbird 38.3.0 (x86 de) (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Mozilla Thunderbird 38.3.0 (x86 de)) (Version: 38.3.0 - Mozilla)
NVIDIA 3D Vision Controller Driver 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 353.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 353.82 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.5.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.5.28 - NVIDIA Corporation)
NVIDIA Graphics Driver 353.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.82 - NVIDIA Corporation)
NVIDIA Miracast Virtual Audio 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 352.86 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
NZB Download App (x64) (HKLM\...\NZB Download - NzbLoad) (Version: - AnryNet Development)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Portal 2 (HKLM-x32\...\Postal 2_is1) (Version: - )
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
Screenpresso (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\Screenpresso) (Version: 1.5.6.0 - Learnpulse)
Screenpresso (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Screenpresso) (Version: 1.5.6.0 - Learnpulse)
Screenpresso (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Screenpresso) (Version: 1.5.6.0 - Learnpulse)
SHIELD Streaming (Version: 4.1.2000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.5.28 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.41459 - TeamViewer)
The Elder Scrolls V Skyrim - Legendary Edition (HKLM-x32\...\The Elder Scrolls V Skyrim - Legendary Edition_is1) (Version: - )
The Witcher 3 - Wild Hunt (HKLM-x32\...\1207664643_is1) (Version: 1.0.0.0 - GOG.com)
Tomb Raider (HKLM-x32\...\Tomb Raider_is1) (Version: - )
Unity Web Player (HKU\S-1-5-21-750122456-1480246655-3734385838-1001\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)
Unity Web Player (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)
Unity Web Player (HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
16-09-2015 07:44:37 Scheduled Checkpoint
22-09-2015 18:34:53 Windows Update
01-10-2015 08:28:25 Scheduled Checkpoint
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {A58526E5-7415-4D54-B983-9A73E1E34234} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: {BA093601-5168-45C7-9AF8-5A54B81F4F54} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-21] (Adobe Systems Incorporated)
Task: {C0D2DE04-A65C-42ED-9013-1F88CC36EB50} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {D42178DF-38A8-48D5-8DEE-46EFD01860DD} - System32\Tasks\Microsoft\Windows\RemovalTools\M*T_HB => C:\WINDOWS\system32\M*T.exe [2015-08-26] (Microsoft Corporation)
Task: {FF70EB16-78B1-420D-89FD-38574F85D2DC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2015-05-29 20:39 - 2015-08-07 02:44 - 00116528 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-01-29 23:02 - 2015-06-01 21:00 - 00102912 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-12-17 15:15 - 2014-12-17 15:15 - 02141192 _____ () D:\Program Files\ACD Systems\ACDSee Pro\8.0\ACDSeeCommanderPro8.exe
2015-02-19 23:40 - 2015-02-19 23:40 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-10-03 10:59 - 2015-10-03 10:58 - 00050477 _____ () C:\Users\M*\Desktop\Defogger.exe
2015-05-29 20:47 - 2015-06-03 23:06 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2014-10-20 20:34 - 2015-05-21 14:27 - 00032768 _____ () C:\Program Files\CyberGhost 5\de\CyberGhost.resources.dll
2014-11-12 20:44 - 2015-05-21 14:48 - 01427424 _____ () C:\Program Files\CyberGhost 5\Geckofx-Core.dll
2015-06-24 19:54 - 2015-06-24 19:54 - 08524856 _____ () C:\Users\M*\AppData\Local\Apps\2.0\MAHMQXVP.AEE\8B91HD6N.209\move..tion_391e8feca7b0cf78_0001.0003_5445a9a08ee15d6c\BLLWrapper.DLL
2013-08-13 20:42 - 2002-04-29 13:12 - 00069632 _____ () D:\Program Files (x86)\Winamp\Plugins\in_cdda.dll
2013-08-13 20:42 - 2003-05-06 01:37 - 00096768 _____ () D:\Program Files (x86)\Winamp\Plugins\in_flac.dll
2013-08-13 20:42 - 2002-03-20 12:43 - 00114688 _____ () D:\Program Files (x86)\Winamp\Plugins\in_midi.dll
2013-08-13 20:42 - 2002-04-27 09:14 - 00093696 _____ () D:\Program Files (x86)\Winamp\Plugins\read_file.dll
2013-08-13 20:42 - 2002-04-27 09:12 - 00151040 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mod.dll
2013-08-13 20:42 - 2002-04-24 23:56 - 00188928 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mp3.dll
2013-08-13 20:42 - 2005-09-05 07:27 - 00077824 _____ () D:\Program Files (x86)\Winamp\Plugins\in_mpc.dll
2013-08-13 20:42 - 2002-04-29 12:44 - 00221696 _____ () D:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll
2013-08-13 20:42 - 2002-04-17 01:18 - 00035328 _____ () D:\Program Files (x86)\Winamp\Plugins\in_wave.dll
2013-08-13 20:42 - 2002-01-15 01:01 - 00102400 _____ () D:\Program Files (x86)\Winamp\Plugins\in_wm.dll
2013-08-13 20:42 - 2001-12-30 17:08 - 00015360 _____ () D:\Program Files (x86)\Winamp\Plugins\out_disk.dll
2013-08-13 20:42 - 2002-04-28 22:03 - 00023552 _____ () D:\Program Files (x86)\Winamp\Plugins\out_ds.dll
2013-08-13 20:42 - 2002-04-27 07:38 - 00011776 _____ () D:\Program Files (x86)\Winamp\Plugins\out_wave.dll
2015-10-02 23:13 - 2015-10-02 23:13 - 00153768 _____ () D:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-10-02 23:13 - 2015-10-02 23:13 - 00023208 _____ () D:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\M*\Desktop\install-tl.exe:BDU
AlternateDataStreams: C:\Users\M*\Desktop\R-3.0.2-win.exe:BDU
AlternateDataStreams: C:\Users\M*\Desktop\TeamViewer_Setup_de.exe:BDU
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-750122456-1480246655-3734385838-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\M*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\M*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
HKU\S-1-5-21-750122456-1480246655-3734385838-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\Wallpaper -> C:\Users\M*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 95.169.183.219 - 89.41.60.38
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is disabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [TCP Query User{9C1BB2C8-3EFA-4CC3-A6E1-E6DFB25E7528}D:\program files (x86)\skype\phone\skype.exe] => (Allow) D:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{3C87A92E-E92E-45C4-BCDF-000EEDBEE095}D:\program files (x86)\skype\phone\skype.exe] => (Allow) D:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{B43E508A-DC32-4B9F-AA23-7F3251DBF6B3}D:\program files (x86)\skype\phone\skype.exe] => (Block) D:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{0883E134-46A9-4A49-856C-22629481C00B}D:\program files (x86)\skype\phone\skype.exe] => (Block) D:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{1C08E0E9-6BBB-496C-BD52-D8649C4BF443}E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe] => (Allow) E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe
FirewallRules: [UDP Query User{2EEF00BD-61DD-4F21-80D3-265669C14E68}E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe] => (Allow) E:\downloads\directlinks\acds.6.3.221.german\x64.acdp.6.3.221.de\acd.systems.acdsee.pro.v6.multilingual.keymaker.read.nfo-rndd\keymaker\keymaker.exe
FirewallRules: [TCP Query User{CEF265D4-D61D-4CD1-AE92-F22E8C3099ED}C:\program files\java\jre1.8.0_25\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{F1365788-B030-412F-9A2A-24DC77B54E80}C:\program files\java\jre1.8.0_25\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [{EC188990-B99E-4E9C-B8EF-1CC39C3ADC9E}] => (Block) C:\program files\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [{941230A0-6B19-43DE-8654-E5789044F9D1}] => (Block) C:\program files\java\jre1.8.0_25\bin\javaw.exe
FirewallRules: [{C36744A3-CFEF-461D-A416-92B800B8D457}] => (Allow) d:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{84FACE51-17DA-4F4C-ADA7-4B550E0AD54C}] => (Allow) d:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E8585E2C-A0F6-432C-908C-3928B863BA74}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{ABED24DC-A42E-43B5-8C5F-3ACA97F57E17}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{14414FB6-BE12-4D18-B227-BB94E0522862}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{0642C44C-743E-4A2A-BDB6-4F14674038B8}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{5FAB11A5-32D7-433A-BC79-6BB6825F4072}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{D619AEAE-11F1-4D19-8986-2A38A38DF0D7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{0C43F043-E77F-422C-B95B-5044C010696D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{DDCBA8E8-7385-42FC-A544-C9D72FA3845F}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{44D17559-82C8-49B1-AA4B-08081883B74B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{85F22C8F-12A1-4EED-9FFC-4140FF8E9385}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/03/2015 10:57:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*******)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/03/2015 10:42:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/03/2015 10:12:44 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/03/2015 09:55:12 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/03/2015 09:55:12 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/02/2015 11:28:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/02/2015 11:13:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/02/2015 11:13:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/02/2015 10:58:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
Error: (10/02/2015 10:28:51 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: S*********)
Description: Activation of app Microsoft.BingHealthAndFitness_8wekyb3d8bbwe!AppexHealthAndFitness failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.
System errors:
=============
Error: (10/03/2015 09:56:13 AM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (10/03/2015 09:55:43 AM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (10/02/2015 08:47:20 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.
Error: (10/02/2015 06:53:53 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4
Error: (10/02/2015 05:49:30 PM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (10/02/2015 05:49:00 PM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (10/01/2015 08:27:46 AM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (10/01/2015 08:27:16 AM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (09/30/2015 11:00:09 AM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (09/30/2015 10:59:39 AM) (Source: DCOM) (EventID: 10010) (User: S*********)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz
Percentage of memory in use: 34%
Total physical RAM: 8104.57 MB
Available physical RAM: 5337.7 MB
Total Virtual: 9448.57 MB
Available Virtual: 5904.54 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:149.14 GB) (Free:63.72 GB) NTFS
Drive d: (Install) (Fixed) (Total:750 GB) (Free:562.03 GB) NTFS
Drive e: () (Fixed) (Total:1746.82 GB) (Free:518.87 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: ADCE52A5)
Partition: GPT.
==================== End of Addition.txt ============================
Als ich GMER gestartete habe, erschien eine Systemmeldung, die sich während des Scans mit ähnlicher Mittleiung wiederholte 1. Beim Start: "C:\Windows\system32\config\system: The process cannot acces the file becaus it is being used by another process" 2. Während des Scans_ "c:\USERS\**\ntuser.dat: The process cannot acces the file becaus it is being used by another process" Die Log sieht wie folgt aus: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-10-03 11:30:26
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000031 ST3000DM001-1CH166 rev.CC24 2794,52GB
Running: Gmer-19357.exe; Driver: C:\Users\**\AppData\Local\Temp\kxlcrpow.sys
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [644:2092] fffff960008a12d0
Thread C:\WINDOWS\system32\svchost.exe [680:6096] 00007ff9a6f339b0
---- EOF - GMER 2.1 ----
|
| Themen zu Windows 8: URLs/Subdomains können temporär nicht erreicht werden |
| adware, alert, antivir, browser, cpu, cyberghost, defender, dnsapi.dll, explorer, failed, firefox, flash player, helper, hängen, lightning, mozilla, port, proxy, realtek, registry, rundll, security, services.exe, software, svchost.exe, system, udp, windows |
Baum-Darstellung