| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: HTML/Crypted.Gen von AntiVir gefundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.06.2016, 09:07
| #1 |
 |  HTML/Crypted.Gen von AntiVir gefunden Hallo liebes Trojaner-Board, Ich war gerade auf der Website der NASA unterwegs (die ich als sicher einstufen würde) und da hat sich Antivir zu Wort gemeldet. Es wurde die Signatur von HTML/Crypted.Gen gefunden. Bitte helft mir, das wieder los zuwerden. Vielen Dank schon mal im Voraus. Hier das Log-File von AntiVir: Code:
ATTFilter
Free Antivirus
Erstellungsdatum der Reportdatei: Friday, June 03, 2016 16:43
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : NIGHTRAID
Versionsinformationen:
build.dat : 15.0.17.273 92152 Bytes 4/4/2016 17:07:00
AVSCAN.EXE : 15.0.17.264 1258544 Bytes 5/10/2016 13:16:45
AVSCANRC.DLL : 15.0.17.269 65256 Bytes 5/10/2016 13:16:45
LUKE.DLL : 15.0.17.264 68864 Bytes 5/10/2016 13:17:17
AVSCPLR.DLL : 15.0.17.264 130712 Bytes 5/10/2016 13:16:45
REPAIR.DLL : 15.0.17.264 640544 Bytes 5/10/2016 13:16:43
repair.rdf : 1.0.17.38 1627624 Bytes 6/1/2016 15:18:46
AVREG.DLL : 15.0.17.264 350584 Bytes 5/10/2016 13:16:42
avlode.dll : 15.0.17.264 722920 Bytes 5/10/2016 13:16:38
avlode.rdf : 14.0.5.36 94056 Bytes 3/1/2016 15:44:18
XBV00010.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00011.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00012.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00013.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00014.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00015.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00016.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00017.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00018.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00019.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00020.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00021.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00022.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00023.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00024.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00025.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00026.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00027.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00028.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00029.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00030.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00031.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00032.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00033.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00034.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00035.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00036.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00037.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00038.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00039.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00040.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00041.VDF : 8.12.37.66 2048 Bytes 12/17/2015 17:50:22
XBV00091.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:26
XBV00092.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:26
XBV00093.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00094.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00095.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00096.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00097.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00098.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00099.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00100.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00101.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:27
XBV00102.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:28
XBV00103.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:28
XBV00104.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:28
XBV00105.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:28
XBV00106.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:28
XBV00107.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:28
XBV00108.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:28
XBV00109.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00110.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00111.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00112.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00113.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00114.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00115.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00116.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00117.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:29
XBV00118.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00119.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00120.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00121.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00122.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00123.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00124.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00125.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:30
XBV00126.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00127.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00128.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00129.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00130.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00131.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00132.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00133.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00134.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:31
XBV00135.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:32
XBV00136.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:32
XBV00137.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:32
XBV00138.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:32
XBV00139.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:32
XBV00140.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:32
XBV00141.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00142.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00143.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00144.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00145.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00146.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00147.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00148.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00149.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:33
XBV00150.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00151.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00152.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00153.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00154.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00155.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00156.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00157.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00158.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:34
XBV00159.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:35
XBV00160.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:35
XBV00161.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:35
XBV00162.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:35
XBV00163.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:35
XBV00164.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00165.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00166.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00167.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00168.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00169.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00170.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00171.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00172.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:36
XBV00173.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00174.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00175.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00176.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00177.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00178.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00179.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00180.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:37
XBV00181.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00182.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00183.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00184.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00185.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00186.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00187.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00188.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:38
XBV00189.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00190.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00191.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00192.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00193.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00194.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00195.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00196.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00197.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:39
XBV00198.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00199.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00200.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00201.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00202.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00203.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00204.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00205.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00206.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:40
XBV00207.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00208.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00209.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00210.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00211.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00212.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00213.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00214.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:41
XBV00215.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00216.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00217.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00218.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00219.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00220.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00221.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00222.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00223.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00224.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:42
XBV00225.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00226.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00227.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00228.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00229.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00230.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00231.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00232.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00233.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:43
XBV00234.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00235.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00236.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00237.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00238.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00239.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00240.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00241.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:44
XBV00242.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00243.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00244.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00245.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00246.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00247.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00248.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00249.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00250.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:45
XBV00251.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:46
XBV00252.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:46
XBV00253.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:46
XBV00254.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:46
XBV00255.VDF : 8.12.95.102 2048 Bytes 5/28/2016 11:52:46
XBV00000.VDF : 7.11.70.0 66736640 Bytes 4/4/2013 15:10:17
XBV00001.VDF : 7.11.237.0 48041984 Bytes 6/2/2015 17:50:19
XBV00002.VDF : 7.12.37.36 16452096 Bytes 12/17/2015 17:50:22
XBV00003.VDF : 8.12.44.142 3948032 Bytes 1/9/2016 18:00:10
XBV00004.VDF : 8.12.52.208 4036096 Bytes 2/2/2016 15:50:31
XBV00005.VDF : 8.12.62.184 2779136 Bytes 2/26/2016 07:08:37
XBV00006.VDF : 8.12.71.186 2191360 Bytes 3/19/2016 17:46:50
XBV00007.VDF : 8.12.80.192 3617280 Bytes 4/13/2016 11:58:25
XBV00008.VDF : 8.12.88.34 4358144 Bytes 5/6/2016 16:09:10
XBV00009.VDF : 8.12.95.102 4861952 Bytes 5/28/2016 11:52:20
XBV00042.VDF : 8.12.95.104 110080 Bytes 5/29/2016 11:52:20
XBV00043.VDF : 8.12.95.122 9728 Bytes 5/29/2016 11:52:20
XBV00044.VDF : 8.12.95.140 12288 Bytes 5/29/2016 11:52:20
XBV00045.VDF : 8.12.95.158 17920 Bytes 5/29/2016 15:52:14
XBV00046.VDF : 8.12.95.176 88576 Bytes 5/30/2016 06:43:02
XBV00047.VDF : 8.12.95.194 5120 Bytes 5/30/2016 06:43:02
XBV00048.VDF : 8.12.95.212 2048 Bytes 5/30/2016 06:43:02
XBV00049.VDF : 8.12.95.230 11264 Bytes 5/30/2016 08:50:26
XBV00050.VDF : 8.12.95.232 9216 Bytes 5/30/2016 08:50:27
XBV00051.VDF : 8.12.95.234 8704 Bytes 5/30/2016 10:50:27
XBV00052.VDF : 8.12.95.236 9728 Bytes 5/30/2016 10:50:27
XBV00053.VDF : 8.12.95.240 123904 Bytes 5/30/2016 11:51:53
XBV00054.VDF : 8.12.95.242 40448 Bytes 5/30/2016 11:51:53
XBV00055.VDF : 8.12.95.244 2048 Bytes 5/30/2016 11:51:53
XBV00056.VDF : 8.12.95.246 2048 Bytes 5/30/2016 11:51:53
XBV00057.VDF : 8.12.95.248 2048 Bytes 5/30/2016 11:51:53
XBV00058.VDF : 8.12.96.12 186880 Bytes 5/31/2016 11:51:53
XBV00059.VDF : 8.12.96.28 12800 Bytes 5/31/2016 11:51:53
XBV00060.VDF : 8.12.96.44 14336 Bytes 5/31/2016 11:51:53
XBV00061.VDF : 8.12.96.60 17920 Bytes 5/31/2016 11:51:53
XBV00062.VDF : 8.12.96.76 20992 Bytes 5/31/2016 11:51:53
XBV00063.VDF : 8.12.96.94 55808 Bytes 5/31/2016 17:51:52
XBV00064.VDF : 8.12.96.96 2048 Bytes 5/31/2016 17:51:52
XBV00065.VDF : 8.12.96.98 18944 Bytes 5/31/2016 03:00:30
XBV00066.VDF : 8.12.96.100 24064 Bytes 5/31/2016 03:00:30
XBV00067.VDF : 8.12.96.102 12288 Bytes 5/31/2016 03:00:30
XBV00068.VDF : 8.12.96.120 64512 Bytes 6/1/2016 07:50:29
XBV00069.VDF : 8.12.96.136 8704 Bytes 6/1/2016 07:50:29
XBV00070.VDF : 8.12.96.152 11776 Bytes 6/1/2016 07:50:29
XBV00071.VDF : 8.12.96.168 17408 Bytes 6/1/2016 12:46:42
XBV00072.VDF : 8.12.96.170 11264 Bytes 6/1/2016 12:46:42
XBV00073.VDF : 8.12.96.174 72192 Bytes 6/1/2016 17:18:44
XBV00074.VDF : 8.12.96.176 20992 Bytes 6/1/2016 19:18:44
XBV00075.VDF : 8.12.96.178 15872 Bytes 6/1/2016 19:18:44
XBV00076.VDF : 8.12.96.180 7680 Bytes 6/1/2016 03:51:29
XBV00077.VDF : 8.12.96.182 10240 Bytes 6/1/2016 03:51:29
XBV00078.VDF : 8.12.96.186 23040 Bytes 6/2/2016 06:14:54
XBV00079.VDF : 8.12.96.188 5120 Bytes 6/2/2016 08:14:54
XBV00080.VDF : 8.12.96.190 5632 Bytes 6/2/2016 08:14:54
XBV00081.VDF : 8.12.96.192 20992 Bytes 6/2/2016 12:49:14
XBV00082.VDF : 8.12.96.194 15872 Bytes 6/2/2016 12:49:14
XBV00083.VDF : 8.12.96.198 70656 Bytes 6/2/2016 17:01:52
XBV00084.VDF : 8.12.96.214 10752 Bytes 6/2/2016 17:01:52
XBV00085.VDF : 8.12.96.228 11776 Bytes 6/2/2016 19:01:50
XBV00086.VDF : 8.12.96.242 8192 Bytes 6/2/2016 19:01:50
XBV00087.VDF : 8.12.97.0 13824 Bytes 6/2/2016 01:09:09
XBV00088.VDF : 8.12.97.2 17408 Bytes 6/2/2016 01:09:09
XBV00089.VDF : 8.12.97.4 22016 Bytes 6/2/2016 01:09:09
XBV00090.VDF : 8.12.97.8 39936 Bytes 6/3/2016 06:03:08
LOCAL001.VDF : 8.12.97.8 160211456 Bytes 6/3/2016 06:03:25
Engineversion : 8.3.40.32
AEBB.DLL : 8.1.3.0 59296 Bytes 11/19/2015 13:56:31
AECORE.DLL : 8.3.12.4 247720 Bytes 3/21/2016 13:08:44
AECRYPTO.DLL : 8.2.0.2 128936 Bytes 5/12/2016 12:20:16
AEDROID.DLL : 8.4.3.362 2717608 Bytes 4/29/2016 10:28:36
AEEMU.DLL : 8.1.3.8 404328 Bytes 3/18/2016 10:58:48
AEEXP.DLL : 8.4.2.182 305064 Bytes 6/1/2016 15:18:45
AEGEN.DLL : 8.1.8.116 547696 Bytes 5/24/2016 16:08:01
AEHELP.DLL : 8.3.2.10 284584 Bytes 2/16/2016 06:11:38
AEHEUR.DLL : 8.1.4.2316 10283888 Bytes 5/27/2016 15:34:30
AELIBINF.DLL : 8.2.1.4 68464 Bytes 5/12/2016 12:20:16
AEMOBILE.DLL : 8.1.8.10 301936 Bytes 11/26/2015 14:53:08
AEOFFICE.DLL : 8.3.3.36 473968 Bytes 6/2/2016 15:01:53
AEPACK.DLL : 8.4.2.14 805744 Bytes 3/31/2016 11:34:14
AERDL.DLL : 8.2.1.42 813928 Bytes 3/18/2016 10:58:49
AESBX.DLL : 8.2.21.4 1629032 Bytes 3/16/2016 12:18:27
AESCN.DLL : 8.3.4.6 141216 Bytes 5/6/2016 06:24:41
AESCRIPT.DLL : 8.3.0.150 617328 Bytes 6/2/2016 15:01:53
AEVDF.DLL : 8.3.3.4 142184 Bytes 3/21/2016 13:08:45
AVWINLL.DLL : 15.0.17.264 27680 Bytes 5/10/2016 13:16:30
AVPREF.DLL : 15.0.17.264 53944 Bytes 5/10/2016 13:16:42
AVREP.DLL : 15.0.17.264 223400 Bytes 5/10/2016 13:16:42
AVARKT.DLL : 15.0.17.264 230080 Bytes 5/10/2016 13:16:31
AVEVTLOG.DLL : 15.0.17.264 202776 Bytes 5/10/2016 13:16:34
SQLITE3.DLL : 15.0.17.264 459752 Bytes 5/10/2016 13:17:24
AVSMTP.DLL : 15.0.17.264 80200 Bytes 5/10/2016 13:16:46
NETNT.DLL : 15.0.17.264 16880 Bytes 5/10/2016 13:17:19
CommonImageRc.dll: 15.0.17.269 4307832 Bytes 5/10/2016 13:16:30
CommonTextRc.dll: 15.0.17.269 68864 Bytes 5/10/2016 13:16:30
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\Antivirus\TEMP\AVGUARD_5750ff24\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: Vollständig
Auszulassende Dateien.................:
Beginn des Suchlaufs: Friday, June 03, 2016 16:43
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '115' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '168' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxCUIService.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'vpnagent.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '130' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'adminservice.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.ServiceHost.exe' - '129' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '204' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVCpl64.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'XBoxStat.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'StikyNot.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxEM.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxHK.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxTray.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.Systray.exe' - '130' Modul(e) wurden durchsucht
Durchsuche Prozess 'GWX.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'jhi_service.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '149' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '92' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'RdrCEF.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'RdrCEF.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'OSPPSVC.EXE' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'splwow64.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'OSE.EXE' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '34' Modul(e) wurden durchsucht
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\y7Gbyknv.default\cache2\entries\7D8379B26DBEDC489A5119215090F520333EAD96'
C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\y7Gbyknv.default\cache2\entries\7D8379B26DBEDC489A5119215090F520333EAD96
[FUND] Enthält Erkennungsmuster des HTML-Scriptvirus HTML/Crypted.Gen
Beginne mit der Desinfektion:
C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\y7Gbyknv.default\cache2\entries\7D8379B26DBEDC489A5119215090F520333EAD96
[FUND] Enthält Erkennungsmuster des HTML-Scriptvirus HTML/Crypted.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '519d959e.qua' verschoben!
Ende des Suchlaufs: Friday, June 03, 2016 16:44
Benötigte Zeit: 00:10 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
957 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
956 Dateien ohne Befall
0 Archive wurden durchsucht
0 Warnungen
1 Hinweise
Die Suchergebnisse werden an den Guard übermittelt.
|
|
04.06.2016, 17:15
| #2 |
| /// TB-Ausbilder /// Anleitungs-Guru  | HTML/Crypted.Gen von AntiVir gefunden NASA?
__________________  Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das... 
 Hinweis:Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert. Adware & Co. können wir sehr gut entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean  bekommst.Los geht's: Schritt 1   Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff Posten in CODE-Tags: So gehts... Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
04.06.2016, 19:38
| #3 |
| | HTML/Crypted.Gen von AntiVir gefunden Hallo Jürgen,
__________________Vielen Dank, dass du dich des Problems annimmst. Auf gehts: FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:03-06-2016
Ran by *** (administrator) on NIGHTRAID (05-06-2016 03:29:11)
Running from C:\Users\***\Desktop
Loaded Profiles: *** (Available Profiles: ***)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Adobe Systems Incorporated) D:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Qualcomm Atheros) C:\Program Files (x86)\Qualcomm Atheros\Qualcomm Atheros 61x4 Wireless LAN&Bluetooth Installer\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\update.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\updrgui.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-06-18] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [67840 2016-05-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [814608 2016-05-10] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1051186441-2669697347-139036509-1000\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-1051186441-2669697347-139036509-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1051186441-2669697347-139036509-1000\...\MountPoints2: {012e3693-c768-11e5-bccb-3065ec715166} - G:\AutoRun.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [176904 2015-08-26] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [155792 2015-08-26] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 118.238.201.38 118.238.201.49
Tcpip\..\Interfaces\{573B9456-B9D3-4BA0-BF7B-DADEC4A7367B}: [DhcpNameServer] 118.238.201.38 118.238.201.49
Tcpip\..\Interfaces\{D5810127-3CDC-4265-A488-3132E0CA44F3}: [DhcpNameServer] 118.238.201.38 118.238.201.49
Internet Explorer:
==================
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-04-12] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\y7Gbyknv.default
FF Session Restore: -> is enabled.
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-13] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-13] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-01-06] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> D:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\y7Gbyknv.default\searchplugins\amazon-search-suggestions.xml [2015-10-20]
FF SearchPlugin: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\y7Gbyknv.default\searchplugins\youtube-videosuche.xml [2015-10-11]
FF Extension: NoScript - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\y7Gbyknv.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-04-08]
FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\y7Gbyknv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-28]
Chrome:
=======
CHR Profile: C:\Users\***\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-10-12]
CHR Extension: (Google Docs) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-12]
CHR Extension: (Google Drive) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]
CHR Extension: (YouTube) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-12]
CHR Extension: (Adblock Plus) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-14]
CHR Extension: (Google-Suche) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-06]
CHR Extension: (Google Tabellen) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-10-12]
CHR Extension: (Google Docs Offline) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-03]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Google Mail) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-12]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
Opera:
=======
StartMenuInternet: (HKLM) Operadeveloper - D:\Program Files (x86)\Opera developer\Launcher.exe
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeActiveFileMonitor8.0; D:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [169312 2009-09-06] (Adobe Systems Incorporated)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [970656 2016-05-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [467016 2016-05-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [467016 2016-05-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1435704 2016-05-10] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Qualcomm Atheros 61x4 Wireless LAN&Bluetooth Installer\Bluetooth Suite\adminservice.exe [309376 2015-01-30] (Qualcomm Atheros) [File not signed]
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [276424 2016-05-04] (Avira Operations GmbH & Co. KG)
S3 GalaxyClientService; D:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1616440 2015-12-12] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [7220792 2016-01-30] (GOG.com)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [350312 2015-09-05] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2015-01-06] (Intel Corporation)
S2 SkypeUpdate; D:\Program Files (x86)\Skype\Updater\Updater.exe [327296 2015-07-09] (Skype Technologies)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [154816 2016-03-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141920 2016-05-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-09-02] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [79696 2016-05-10] (Avira Operations GmbH & Co. KG)
S3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [54376 2015-01-30] (Qualcomm Atheros) [File not signed]
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2015-01-06] (Intel Corporation)
S3 Qcamain; C:\Windows\System32\DRIVERS\Qcamain7x64.sys [2294784 2015-01-30] (Qualcomm Atheros, Inc.)
U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [752856 2015-09-14] (Realsil Semiconductor Corporation)
R3 RTSUER; C:\Windows\System32\Drivers\RtsUer.sys [402136 2015-09-14] (Realsil Semiconductor Corporation)
R3 ScpVBus; C:\Windows\System32\DRIVERS\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52592 2015-09-24] (Cisco Systems, Inc.)
S3 BTMCOM; System32\Drivers\btmcom.sys [X]
S3 BTMHID; system32\DRIVERS\btmhid.sys [X]
S3 BTMUSB; System32\Drivers\btmusb.sys [X]
S2 regi; \??\C:\Windows\system32\drivers\regi.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-05 03:29 - 2016-06-05 03:29 - 00014109 _____ C:\Users\***\Desktop\FRST.txt
2016-06-05 03:29 - 2016-06-05 03:29 - 00000000 ____D C:\FRST
2016-06-05 01:28 - 2016-06-05 01:28 - 02384384 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe
2016-06-02 00:33 - 2016-06-02 00:33 - 00001761 _____ C:\Users\Public\Desktop\MechWarrior Online.lnk
2016-06-02 00:33 - 2016-06-02 00:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Piranha Games
2016-05-27 04:46 - 2016-04-15 01:46 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-05-27 04:46 - 2016-04-15 01:42 - 03243520 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-05-27 04:46 - 2016-04-15 01:42 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-05-27 04:46 - 2016-04-15 01:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-05-27 04:46 - 2016-04-15 01:42 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-05-27 04:46 - 2016-04-15 01:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-05-27 04:46 - 2016-04-15 00:33 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-05-27 04:46 - 2016-04-15 00:33 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-05-27 04:46 - 2016-04-15 00:33 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2016-05-27 04:46 - 2016-04-15 00:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2016-05-27 04:46 - 2016-04-15 00:19 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2016-05-27 04:46 - 2016-04-15 00:11 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2016-05-27 04:46 - 2016-04-12 10:23 - 00154344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-05-27 04:46 - 2016-04-12 10:23 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-05-27 04:46 - 2016-04-12 10:20 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-05-27 04:46 - 2016-04-12 10:20 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-05-27 04:46 - 2016-04-12 10:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-05-27 04:46 - 2016-04-12 10:01 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-05-27 04:46 - 2016-04-12 10:01 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-05-27 04:46 - 2016-04-12 10:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-05-27 04:46 - 2016-04-12 09:50 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-05-27 04:46 - 2016-04-12 09:43 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-05-27 04:46 - 2016-04-12 09:43 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-05-27 04:46 - 2016-04-12 09:43 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-05-27 04:46 - 2016-04-12 09:42 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-05-27 04:46 - 2016-04-12 09:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-05-27 04:46 - 2016-04-12 09:36 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-05-27 04:46 - 2016-04-09 15:58 - 14186496 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-05-27 04:46 - 2016-04-09 15:57 - 01867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-05-27 04:46 - 2016-04-09 15:54 - 12881408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-05-27 04:46 - 2016-04-09 15:54 - 01499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-05-27 04:46 - 2016-04-09 14:53 - 03231232 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-05-27 04:46 - 2016-04-09 14:44 - 02973184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-05-18 01:16 - 2016-03-10 04:00 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-05-18 01:16 - 2016-03-10 04:00 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2016-05-18 01:16 - 2016-03-10 03:40 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-05-18 01:16 - 2016-03-10 03:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2016-05-11 16:16 - 2016-05-11 16:16 - 00092143 _____ C:\Users\***\Documents\Multiple studies on air.pdf
2016-05-11 15:17 - 2016-04-24 02:08 - 00394960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-05-11 15:17 - 2016-04-24 01:24 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-05-11 15:17 - 2016-04-23 14:25 - 25816064 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-05-11 15:17 - 2016-04-23 14:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-05-11 15:17 - 2016-04-23 14:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-05-11 15:17 - 2016-04-23 14:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-05-11 15:17 - 2016-04-23 14:00 - 02893312 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-05-11 15:17 - 2016-04-23 14:00 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-05-11 15:17 - 2016-04-23 14:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-05-11 15:17 - 2016-04-23 14:00 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-05-11 15:17 - 2016-04-23 14:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-05-11 15:17 - 2016-04-23 13:52 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-05-11 15:17 - 2016-04-23 13:51 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-05-11 15:17 - 2016-04-23 13:48 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-05-11 15:17 - 2016-04-23 13:47 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-05-11 15:17 - 2016-04-23 13:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-05-11 15:17 - 2016-04-23 13:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-05-11 15:17 - 2016-04-23 13:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-05-11 15:17 - 2016-04-23 13:46 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-05-11 15:17 - 2016-04-23 13:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-05-11 15:17 - 2016-04-23 13:36 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-05-11 15:17 - 2016-04-23 13:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-05-11 15:17 - 2016-04-23 13:27 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-05-11 15:17 - 2016-04-23 13:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-05-11 15:17 - 2016-04-23 13:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-05-11 15:17 - 2016-04-23 13:21 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-05-11 15:17 - 2016-04-23 13:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-05-11 15:17 - 2016-04-23 13:20 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-05-11 15:17 - 2016-04-23 13:11 - 20350464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-05-11 15:17 - 2016-04-23 13:09 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-05-11 15:17 - 2016-04-23 13:08 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-05-11 15:17 - 2016-04-23 13:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-05-11 15:17 - 2016-04-23 13:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-05-11 15:17 - 2016-04-23 13:07 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-05-11 15:17 - 2016-04-23 13:07 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-05-11 15:17 - 2016-04-23 13:07 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-05-11 15:17 - 2016-04-23 13:06 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-05-11 15:17 - 2016-04-23 13:06 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-05-11 15:17 - 2016-04-23 13:05 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-05-11 15:17 - 2016-04-23 13:04 - 02285568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-05-11 15:17 - 2016-04-23 13:02 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-05-11 15:17 - 2016-04-23 13:01 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-05-11 15:17 - 2016-04-23 13:00 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-05-11 15:17 - 2016-04-23 12:59 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-05-11 15:17 - 2016-04-23 12:58 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-05-11 15:17 - 2016-04-23 12:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-05-11 15:17 - 2016-04-23 12:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-05-11 15:17 - 2016-04-23 12:51 - 02596864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-05-11 15:17 - 2016-04-23 12:50 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-05-11 15:17 - 2016-04-23 12:45 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-05-11 15:17 - 2016-04-23 12:44 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-05-11 15:17 - 2016-04-23 12:43 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-05-11 15:17 - 2016-04-23 12:41 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-05-11 15:17 - 2016-04-23 12:40 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-05-11 15:17 - 2016-04-23 12:39 - 01547776 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-05-11 15:17 - 2016-04-23 12:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-05-11 15:17 - 2016-04-23 12:36 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-05-11 15:17 - 2016-04-23 12:33 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-05-11 15:17 - 2016-04-23 12:31 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-05-11 15:17 - 2016-04-23 12:30 - 02056192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-05-11 15:17 - 2016-04-23 12:30 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-05-11 15:17 - 2016-04-23 12:28 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-05-11 15:17 - 2016-04-23 12:26 - 13811200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-05-11 15:17 - 2016-04-23 12:12 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-05-11 15:17 - 2016-04-23 12:09 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-05-11 15:17 - 2016-04-23 12:07 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-05-11 15:17 - 2016-04-14 22:49 - 00603648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2016-05-11 15:17 - 2016-04-14 22:21 - 00647680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-05-11 15:17 - 2016-04-09 16:02 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-05-11 15:17 - 2016-04-09 16:01 - 05546216 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-05-11 15:17 - 2016-04-09 16:01 - 00986344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-05-11 15:17 - 2016-04-09 16:01 - 00706280 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-05-11 15:17 - 2016-04-09 16:01 - 00264936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-05-11 15:17 - 2016-04-09 15:59 - 03998952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-05-11 15:17 - 2016-04-09 15:59 - 03943144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-05-11 15:17 - 2016-04-09 15:59 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-05-11 15:17 - 2016-04-09 15:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:57 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 15:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-05-11 15:17 - 2016-04-09 14:52 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-05-11 15:17 - 2016-04-09 14:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-05-11 15:17 - 2016-04-09 14:52 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-05-11 15:17 - 2016-04-09 14:49 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-05-11 15:17 - 2016-04-09 14:48 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-05-11 15:17 - 2016-04-09 14:47 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-05-11 15:17 - 2016-04-09 14:43 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-05-11 15:17 - 2016-04-09 14:38 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-05-11 15:17 - 2016-04-09 14:38 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-05-11 15:17 - 2016-04-09 14:38 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-05-11 15:17 - 2016-04-09 14:38 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-05-11 15:17 - 2016-04-09 14:37 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 14:37 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 14:37 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 14:37 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-05-11 15:17 - 2016-04-09 13:20 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-05-11 15:17 - 2016-04-09 12:52 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-05-11 15:17 - 2016-04-07 00:27 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2016-05-11 15:17 - 2016-03-10 03:54 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2016-05-11 15:17 - 2016-03-10 03:34 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2016-05-07 01:36 - 2016-05-07 20:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-05 02:43 - 2015-10-06 02:59 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-06-05 02:38 - 2015-10-12 02:16 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-05 02:30 - 2009-07-14 13:45 - 00022736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-05 02:30 - 2009-07-14 13:45 - 00022736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-05 01:23 - 2009-07-14 14:13 - 00781790 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-05 01:23 - 2009-07-14 12:20 - 00000000 ____D C:\Windows\inf
2016-06-05 01:20 - 2015-10-21 04:59 - 00000552 _____ C:\Windows\Tasks\MATLAB R2015b Startup Accelerator.job
2016-06-05 01:19 - 2015-10-12 02:16 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-05 01:19 - 2015-09-14 20:20 - 00000000 __SHD C:\Users\***\IntelGraphicsProfiles
2016-06-05 01:19 - 2015-09-14 20:19 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-06-05 01:19 - 2009-07-14 14:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-04 23:23 - 2015-10-17 17:45 - 00000000 ____D C:\Users\***\AppData\LocalLow\Temp
2016-06-04 03:00 - 2009-07-14 12:20 - 00000000 ____D C:\Windows\rescache
2016-06-03 19:45 - 2009-07-14 12:20 - 00000000 ____D C:\Windows\system32\NDF
2016-06-03 11:14 - 2015-10-21 12:43 - 00000000 ____D C:\Users\***\Documents\MATLAB
2016-06-02 23:57 - 2016-04-23 19:58 - 00003868 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1461409109
2016-06-02 00:33 - 2015-09-14 20:11 - 00000000 ____D C:\ProgramData\Package Cache
2016-06-02 00:29 - 2015-09-15 05:59 - 00000000 ____D C:\Windows\Panther
2016-06-02 00:09 - 2015-09-25 03:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-05-27 03:01 - 2015-09-17 05:53 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2016-05-27 03:01 - 2015-09-17 05:53 - 00000000 ___SD C:\Windows\system32\GWX
2016-05-21 00:43 - 2015-09-30 10:35 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-18 11:21 - 2009-07-14 14:08 - 00032630 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-05-18 01:13 - 2016-03-06 01:11 - 00000000 ____D C:\ProgramData\sMedio
2016-05-18 01:13 - 2015-09-14 20:05 - 00000000 ____D C:\Users\***
2016-05-13 23:43 - 2015-10-06 02:59 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-05-13 23:43 - 2015-10-06 02:59 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-05-13 23:43 - 2015-10-06 02:59 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-05-13 13:39 - 2015-10-12 02:16 - 00002187 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-13 03:00 - 2015-09-15 02:29 - 00000000 ____D C:\Windows\system32\appraiser
2016-05-12 12:44 - 2009-07-14 13:45 - 00445472 _____ C:\Windows\system32\FNTCACHE.DAT
2016-05-12 03:17 - 2011-04-12 17:28 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-12 03:07 - 2015-09-17 03:58 - 00000000 ____D C:\Windows\system32\MRT
2016-05-12 03:01 - 2015-09-17 03:58 - 139319312 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-05-12 01:25 - 2015-09-30 10:35 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-05-11 14:33 - 2015-10-12 02:16 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-11 14:33 - 2015-10-12 02:16 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-10 22:17 - 2015-09-25 03:35 - 00141920 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-05-10 22:17 - 2015-09-25 03:35 - 00079696 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2016-05-07 20:50 - 2015-09-25 03:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
==================== Files in the root of some directories =======
2016-01-06 01:32 - 2016-01-06 02:35 - 0002730 _____ () C:\Users\***\AppData\Local\mbt-actwiz.log
2015-09-14 20:36 - 2015-09-14 20:36 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\***\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-05-29 21:45
==================== End of FRST.txt ============================
Addition.txt: FRST Additions Logfile: [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:03-06-2016
Ran by Joni-Wan (2016-06-05 03:29:37)
Running from C:\Users\***\Desktop
Windows 7 Professional Service Pack 1 (X64) (2015-09-14 11:05:51)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1051186441-2669697347-139036509-500 - Administrator - Disabled)
Guest (S-1-5-21-1051186441-2669697347-139036509-501 - Limited - Disabled)
*** (S-1-5-21-1051186441-2669697347-139036509-1000 - Administrator - Enabled) => C:\Users\***
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Album Art Downloader XUI 1.01 (HKLM-x32\...\Album Art Downloader XUI) (Version: 1.01 - hxxp://sourceforge.net/projects/album-art)
Apple Application Support (32-bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Audacity 2.1.1 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.1 - Audacity Team)
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.17.273 - Avira Operations GmbH & Co. KG)
Avira Launcher (HKLM-x32\...\{28d41884-9b36-4f54-bed2-92863f08e65d}) (Version: 1.1.62.21333 - Avira Operations GmbH & Co. KG)
Avira Launcher (x32 Version: 1.1.62.21333 - Avira Operations GmbH & Co. KG) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.14018 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.14018 - Cisco Systems, Inc.) Hidden
Extended Asian Language font pack for Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
FINAL FANTASY XIV - A Realm Reborn (HKLM-x32\...\{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}) (Version: 1.0.0000 - SQUARE ENIX CO., LTD.)
Gameforge Live 2.0.8 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.8 - Gameforge)
Go! Go! Nippon! ~My First Trip to Japan~ (HKLM-x32\...\Steam App 251870) (Version: - OVERDRIVE)
GOG Galaxy (HKLM-x32\...\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version: - GOG.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 50.0.2661.102 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Intel(R) Chipset Device Software (x32 Version: 10.0.22 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.38.1036 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.15.4279 - Intel Corporation)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
MATLAB R2015b (HKLM\...\Matlab R2015b) (Version: 8.6 - MathWorks)
MechWarrior Online (HKLM-x32\...\{9f17023b-d04f-432b-b08a-3bb4c3a7ed3c}) (Version: 1.6.0.0 - Piranha Games Inc.)
MechWarrior Online (x32 Version: 1.6.1.0 - Piranha Games Inc.) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM-x32\...\{90120000-00A4-0409-0000-0000000FF1CE}) (Version: 12.0.6213.1000 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visio Professional 2013 (HKLM-x32\...\Office15.VISPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (HKLM\...\Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Applications - ENU (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Applications - ENU) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Mozilla Firefox 46.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 de)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1.5966 - Mozilla)
Mozilla Thunderbird 38.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 38.3.0 (x86 de)) (Version: 38.3.0 - Mozilla)
Mozilla Thunderbird 38.7.2 (x86 de) (HKU\S-1-5-21-1051186441-2669697347-139036509-1000\...\Mozilla Thunderbird 38.7.2 (x86 de)) (Version: 38.7.2 - Mozilla)
NVIDIA Graphics Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.82 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Opera developer 39.0.2248.0 (HKLM-x32\...\Opera 39.0.2248.0) (Version: 39.0.2248.0 - Opera Software)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PHANTASY STAR ONLINE 2 (HKLM-x32\...\hxxp://pso2.jp/appid/release_is1) (Version: - SEGA)
Qualcomm Atheros 61x4 Wireless LAN&Bluetooth Installer (HKLM-x32\...\{3241744A-BA36-41F0-B4AA-EF3946D00632}) (Version: 11.0.0.0769 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.370.102 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7541 - Realtek Semiconductor Corp.)
Rebel Galaxy (HKLM-x32\...\1435582019_is1) (Version: 2.4.0.9 - GOG.com)
Satellite Reign (HKLM-x32\...\1428054996_is1) (Version: 2.4.0.8 - GOG.com)
Secure Download Manager (HKLM-x32\...\{E040B65B-8683-4228-8C33-D44A141E40EA}) (Version: 3.1.60 - Kivuto Solutions Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.111 - Skype Technologies S.A.)
Slender: The Arrival (HKLM-x32\...\Steam App 252330) (Version: - Blue Isle Studios)
Star Wars: Dark Forces (HKLM-x32\...\Steam App 32400) (Version: - LucasArts)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Sunless Sea (HKLM-x32\...\1421064427_is1) (Version: 2.6.0.7 - GOG.com)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
The Witcher Enhanced Edition Director's Cut (HKLM-x32\...\1207658924_is1) (Version: 2.1.0.15 - GOG.com)
WinRAR 5.31 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.31.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {10CF642E-5DD3-4921-AC90-5C3609FC0AEA} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {7C55AB37-EBAE-4284-89AD-018B8C46082E} - System32\Tasks\{95633909-3FE7-42FD-BA2A-20266323F22E} => pcalua.exe -a C:\Users\***\Desktop\8400fvst6410231a_64en\SetupSG.exe -d C:\Users\***\Desktop\8400fvst6410231a_64en
Task: {90E0FDC3-FB28-4D56-A506-72A604ECA658} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {B0BBE8EA-7487-47E3-8964-DC0D223757CD} - System32\Tasks\MATLAB R2015b Startup Accelerator => D:\Program Files\MATLAB\R2015b\bin\win64\MATLABStartupAccelerator.exe [2015-07-30] ()
Task: {B20CC83C-BF90-4523-AD17-93616ED69373} - System32\Tasks\Opera scheduled Autoupdate 1461409109 => D:\Program Files (x86)\Opera developer\launcher.exe [2016-06-02] (Opera Software)
Task: {B9895DB1-7D71-41D7-98C4-1AB7CB60C54D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-12] (Google Inc.)
Task: {CBA5E592-FDE5-4A4C-8C4E-E082C7851DB1} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {CE2FD656-A2F2-4795-A164-7B8F1A30836F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-21] (Microsoft Corporation)
Task: {D2638B22-84A9-4109-89E3-AF57328EEC42} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-12] (Google Inc.)
Task: {D97ED9BC-DCC4-4AF1-92C7-76CECFCFAB26} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-13] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\MATLAB R2015b Startup Accelerator.job => D:\Program Files\MATLAB\R2015b\bin\win64\MATLABStartupAccelerator.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-09-14 20:28 - 2015-08-26 03:46 - 00011896 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2015-09-14 20:29 - 2015-08-25 23:24 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-09-23 16:47 - 2015-09-23 16:47 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-11-10 15:45 - 2015-11-10 15:45 - 08901184 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-09-05 18:41 - 2015-09-05 18:41 - 00395880 _____ () C:\Windows\system32\igfxTray.exe
2016-02-29 19:16 - 2016-02-29 19:16 - 00070144 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2015-09-14 20:28 - 2015-08-26 03:46 - 00011896 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2015-01-06 22:40 - 2015-01-06 22:40 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 11:34 - 2009-06-11 06:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1051186441-2669697347-139036509-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\***\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 118.238.201.38 - 118.238.201.49
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SolidWorks Background Downloader.lnk => C:\Windows\pss\SolidWorks Background Downloader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^***^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: Cisco AnyConnect Secure Mobility Agent for Windows => "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
MSCONFIG\startupreg: Connectify Dispatch => C:\Program Files (x86)\Connectify\DispatchUI.exe autorun
MSCONFIG\startupreg: Connectify Hotspot => C:\Program Files (x86)\Connectify\Connectify.exe autorun
MSCONFIG\startupreg: GalaxyClient => D:\Program Files (x86)\GalaxyClient\GalaxyClient.exe /launchViaAutoStart
MSCONFIG\startupreg: iTunesHelper => "D:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: PowerDVD15Agent => "D:\Program Files (x86)\CyberLink\PowerDVD15\PowerDVD15Agent.exe"
MSCONFIG\startupreg: RESTART_STICKY_NOTES => C:\Windows\System32\StikyNot.exe
MSCONFIG\startupreg: Steam => "D:\Program Files (x86)\Steam\steam.exe" -silent
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{D75737EF-0C43-45E2-8EAC-5F5B722CFFAE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{704F790E-4541-4B44-9009-6D5028AC9477}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7CF1F9F0-E16D-4830-A9E0-3AEAF2B0B6C1}] => (Allow) D:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobePhotoshopElementsMediaServer.exe
FirewallRules: [{F7F05B7E-13AF-40C1-B73E-0C60FCC01161}] => (Allow) D:\Program Files (x86)\Adobe\Elements Organizer 8.0\AdobePhotoshopElementsMediaServer.exe
FirewallRules: [TCP Query User{EA14D37B-A244-4A20-89F0-E198FBBAC607}C:\program files (x86)\connectify\connectify.exe] => (Allow) C:\program files (x86)\connectify\connectify.exe
FirewallRules: [UDP Query User{D22A738A-BD0B-480B-8D4C-BE3347E9E576}C:\program files (x86)\connectify\connectify.exe] => (Allow) C:\program files (x86)\connectify\connectify.exe
FirewallRules: [{DCF5F71F-A371-44D1-905C-6455E37E4304}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D877A69F-98CE-4705-B3E5-88F97733C936}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E39684A2-0328-4E07-B139-EE138DBF6ED7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C07872FA-4FF9-4C9B-88B5-3A4267EB3897}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{35EB9E6F-1391-49E1-B91A-37BDC50E7498}] => (Allow) D:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{FD1E59DD-74FE-45D1-86D3-7846ADFC5C4E}D:\program files\matlab\r2015b\bin\win64\matlab.exe] => (Allow) D:\program files\matlab\r2015b\bin\win64\matlab.exe
FirewallRules: [UDP Query User{624E0BA6-A9A2-4F70-AD4D-5FFFFDBD69AB}D:\program files\matlab\r2015b\bin\win64\matlab.exe] => (Allow) D:\program files\matlab\r2015b\bin\win64\matlab.exe
FirewallRules: [{121C7D5E-E37D-4D24-ACEC-D2F27E8D789B}] => (Allow) D:\Program Files\iTunes\iTunes.exe
FirewallRules: [{42200F05-E290-40D7-B447-5C7B46D8C00C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{169F0E8D-350F-4900-8EB1-96EB1633077A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{672D367E-9527-426E-857E-F1952DF3962D}] => (Allow) D:\Program Files\SolidWorks Corp\SolidWorks\photoview\photoview360.exe
FirewallRules: [{881C9A72-2460-403E-A149-F41655FA8896}] => (Allow) D:\Program Files\SolidWorks Corp\SolidWorks\photoview\photoview360.exe
FirewallRules: [{5A28CC3D-FFAC-4B14-9C3F-91D85E7F80F1}] => (Allow) D:\Program Files (x86)\GameforgeLive\gfl_client.exe
FirewallRules: [TCP Query User{0A9B7FF8-73C8-4E4E-9E86-4F717C5469AA}D:\program files (x86)\gameforgelive\games\gbr_eng\tera\tera-launcher.exe] => (Allow) D:\program files (x86)\gameforgelive\games\gbr_eng\tera\tera-launcher.exe
FirewallRules: [UDP Query User{14873A28-DA3F-489B-8E54-FD34410C8987}D:\program files (x86)\gameforgelive\games\gbr_eng\tera\tera-launcher.exe] => (Allow) D:\program files (x86)\gameforgelive\games\gbr_eng\tera\tera-launcher.exe
FirewallRules: [{1400365F-04DD-4623-A8CC-F6589EC1E7C2}] => (Allow) D:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe
FirewallRules: [{38986FC9-3C93-4021-8262-4B9AB9210FD0}] => (Allow) D:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivboot.exe
FirewallRules: [{3678C3E7-3985-4D64-B93E-6922ABD2F674}] => (Allow) D:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe
FirewallRules: [{09826E09-6772-40EE-869C-176D8C076801}] => (Allow) D:\Program Files (x86)\SquareEnix\FINAL FANTASY XIV - A Realm Reborn\boot\ffxivlauncher.exe
FirewallRules: [{B577C34B-67E5-4367-B6FA-0E9017342291}] => (Allow) D:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{9F614047-7C28-4867-82CA-7AB7900DCF1F}] => (Allow) D:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{1213BBA7-E956-449B-AA5E-2F89C94E7C89}] => (Allow) D:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{BB479F9E-7621-47B6-84EE-4616524BF83C}] => (Allow) D:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{C0ECFA02-152C-457D-8CD3-EBD91BCB7135}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\GoGoNippon\GoGoNippon\BGI.exe
FirewallRules: [{087F49E6-787E-4734-87E7-1FCB7DD1D039}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\GoGoNippon\GoGoNippon\BGI.exe
FirewallRules: [{8C9CA716-7F22-41FD-A751-2C55709286BF}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\Dark Forces\DosBox\dosbox.exe
FirewallRules: [{A2BA9EB6-324D-411F-A5EB-97B84E2D4DEE}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\Dark Forces\DosBox\dosbox.exe
FirewallRules: [{80B3F56E-958F-44B3-8E90-8C295DEB9DB6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
05-06-2016 02:04:30 Scheduled Checkpoint
==================== Faulty Device Manager Devices =============
Name: Bluetooth Device (Personal Area Network) #2
Description: Bluetooth Device (Personal Area Network)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: BthPan
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Qualcomm Atheros QCA61x4 Wireless Network Adapter
Description: Qualcomm Atheros QCA61x4 Wireless Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros Communications Inc.
Service: Qcamain
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/05/2016 01:19:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/04/2016 11:16:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/04/2016 01:55:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/04/2016 12:41:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/04/2016 12:25:49 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (06/04/2016 12:25:43 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (06/04/2016 12:25:43 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (06/04/2016 12:24:11 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (06/04/2016 12:19:48 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (06/03/2016 03:31:24 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2434
System errors:
=============
Error: (06/05/2016 01:20:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)
Error: (06/05/2016 01:19:08 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The regi service failed to start due to the following error:
%%2
Error: (06/04/2016 11:16:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The regi service failed to start due to the following error:
%%2
Error: (06/04/2016 01:57:23 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)
Error: (06/04/2016 01:55:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The regi service failed to start due to the following error:
%%2
Error: (06/04/2016 01:25:36 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
Error: (06/04/2016 12:42:47 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)
Error: (06/04/2016 12:41:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The regi service failed to start due to the following error:
%%2
Error: (06/04/2016 12:45:24 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
%%1275
Error: (06/04/2016 12:45:24 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\***\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
CodeIntegrity:
===================================
Date: 2016-03-06 01:15:02.151
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:02.121
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:02.051
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:01.961
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:01.891
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:01.851
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:01.811
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:01.701
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:01.521
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-06 01:15:01.361
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\cryptnet.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
Percentage of memory in use: 22%
Total physical RAM: 8111.55 MB
Available physical RAM: 6270.98 MB
Total Virtual: 16221.29 MB
Available Virtual: 14196.12 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:60.1 GB) (Free:2.57 GB) NTFS
Drive d: () (Fixed) (Total:150.1 GB) (Free:34.04 GB) NTFS
Drive e: () (Fixed) (Total:721.22 GB) (Free:457.62 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 4D4B35F5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=60.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=150.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=721.2 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
--- --- --- Meinen Nutzernamen habe ich mit *** unkenntlich gemacht. Die von AntiVir gefundene Datei lasse ich in der Quarantäne, ja? |
|
05.06.2016, 11:13
| #4 |
| /// TB-Ausbilder /// Anleitungs-Guru | HTML/Crypted.Gen von AntiVir gefunden Ja, Quarantäne reicht. Jetzt bitte Suchscan durchführen: Schritt 1 ESET Online Scanner
__________________ Gruß deeprybka  Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
05.06.2016, 17:02
| #5 |
| | HTML/Crypted.Gen von AntiVir gefunden Ok, erledigt. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=e403a27326b5c34d916a855a9c3259c5
# end=init
# utc_time=2016-06-05 01:35:13
# local_time=2016-06-05 10:35:13 (+0900, Tokyo Standard Time)
# country="United States"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 29699
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=e403a27326b5c34d916a855a9c3259c5
# end=updated
# utc_time=2016-06-05 01:58:53
# local_time=2016-06-05 10:58:53 (+0900, Tokyo Standard Time)
# country="United States"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=e403a27326b5c34d916a855a9c3259c5
# engine=29699
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-06-05 03:30:46
# local_time=2016-06-06 12:30:46 (+0900, Tokyo Standard Time)
# country="United States"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Antivirus'
# compatibility_mode=1815 16777213 100 99 7318 24020454 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 22025427 216770496 0 0
# scanned=616221
# found=0
# cleaned=0
# scan_time=5513
|
|
05.06.2016, 17:05
| #6 |
| /// TB-Ausbilder /// Anleitungs-Guru | HTML/Crypted.Gen von AntiVir gefunden Wir haben es geschafft! Die Logs sehen für mich im Moment sauber aus. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.  Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.   Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.  Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken (z.B. hier) in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Kauf-Empfehlung:  Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ --> HTML/Crypted.Gen von AntiVir gefunden |
|
06.06.2016, 04:42
| #7 |
| | HTML/Crypted.Gen von AntiVir gefunden Vielen Dank für die schnelle und kompetente Hilfe, Jürgen! Ich werd euch eine kleine Spende zukommen lassen |
|
06.06.2016, 10:42
| #8 |
| /// TB-Ausbilder /// Anleitungs-Guru | HTML/Crypted.Gen von AntiVir gefunden Danke, da freut sich das Team. Alles Gute!
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
| Themen zu HTML/Crypted.Gen von AntiVir gefunden |
| antivir, appdata, avira, bytes, code, csrss.exe, datei, dllhost.exe, explorer.exe, html/crypted.gen, log-file, lsass.exe, mas, modul, mozilla, namen, programm, prozesse, services.exe, smss.exe, spoolsv.exe, suchergebnisse, svchost.exe, temp, windows, winlogon.exe |
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
