| sauterch | 30.07.2014 20:09 |
MBAM log files Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 22.07.2014
Suchlauf-Zeit: 20:07:46
Logdatei: mbam_01.txt
Administrator: Ja
Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: sauterch
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 249387
Verstrichene Zeit: 17 Min, 30 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 2
PUP.Optional.PCSpeedUp.A, HKLM\SOFTWARE\SPEEDCHECKER LIMITED\PC Speed Up, In Quarantäne, [b8c58e501b5f7cba1b21624ea063748c],
PUP.Optional.AlexaTB.A, HKU\S-1-5-21-2386147833-3081857437-1213626127-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DISTROMATIC\Toolbars, In Quarantäne, [ceaf30aed8a2db5bd19b6a47b251e020],
Registrierungswerte: 0
(No malicious items detected)
Registrierungsdaten: 3
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2386147833-3081857437-1213626127-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=8ff9e2c0-c955-4d2e-a461-0606362ab29b&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=8ff9e2c0-c955-4d2e-a461-0606362ab29b&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}),Ersetzt,[1a630fcfdb9fc076400bd05f1fe50bf5]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2386147833-3081857437-1213626127-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=8ff9e2c0-c955-4d2e-a461-0606362ab29b&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=8ff9e2c0-c955-4d2e-a461-0606362ab29b&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}),Ersetzt,[7b02ac3283f7aa8ce9658fa073919769]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-2386147833-3081857437-1213626127-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=8ff9e2c0-c955-4d2e-a461-0606362ab29b&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=8ff9e2c0-c955-4d2e-a461-0606362ab29b&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}),Ersetzt,[c8b523bb730747ef6fe083ac17ed1de3]
Ordner: 6
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\19537D25791648149EC6DB3239AF51EC, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\30527CCDA89445A0A77DCA1EB2364171, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\94ACABA8A7174B448C4091FB3D4D4D2C, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\F8DDD3DF2ABB4947952ECDE9255DE320, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\OpenCandy_94ACABA8A7174B448C4091FB3D4D4D2C, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
Dateien: 12
PUP.Optional.Babylon.A, C:\Users\sauterch\AppData\Local\Temp\DeltaTB.exe, In Quarantäne, [700d96487901ae88e7f680c7cc35cd33],
PUP.Optional.Babylon.A, C:\Users\sauterch\AppData\Local\Temp\038213AA-BAB0-7891-815D-5AC9261B177F\BExternal.dll, In Quarantäne, [7508a9352a50c472e0e7d59bbb454cb4],
PUP.Optional.Babylon.A, C:\Users\sauterch\AppData\Local\Temp\038213AA-BAB0-7891-815D-5AC9261B177F\Setup.exe, In Quarantäne, [abd27668b8c2e55143f8571514ec758b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\19537D25791648149EC6DB3239AF51EC\5260.ico, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\19537D25791648149EC6DB3239AF51EC\conduitinstaller.exe, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\19537D25791648149EC6DB3239AF51EC\EBB77268-338F-4C6A-8590-AD88FED26F4A, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\19537D25791648149EC6DB3239AF51EC\OCBrowserHelper_1.0.5.112.dll, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\30527CCDA89445A0A77DCA1EB2364171\2534.ico, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\30527CCDA89445A0A77DCA1EB2364171\EBB77268-338F-4C6A-8590-AD88FED26F4A, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\30527CCDA89445A0A77DCA1EB2364171\OCBrowserHelper_1.0.4.106.dll, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\94ACABA8A7174B448C4091FB3D4D4D2C\ds_DeDnCD_driverscanner.exe, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
PUP.Optional.OpenCandy, C:\Users\sauterch\AppData\Roaming\OpenCandy\F8DDD3DF2ABB4947952ECDE9255DE320\PCSU_SL_3.1.2.exe, In Quarantäne, [d5a8667880fa3ff7830842446999d52b],
Physische Sektoren: 0
(No malicious items detected)
(end)
weiterer scan mit MBAM Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 22.07.2014
Suchlauf-Zeit: 22:29:11
Logdatei: mbam_02.txt
Administrator: Ja
Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: sauterch
Suchlauf-Art: Benutzerdefinierter Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 529423
Verstrichene Zeit: 1 Std, 43 Min, 31 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 1
PUP.Optional.Conduit, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}, In Quarantäne, [d1ac20be24560531293e99e4af517987],
Registrierungswerte: 0
(No malicious items detected)
Registrierungsdaten: 0
(No malicious items detected)
Ordner: 0
(No malicious items detected)
Dateien: 1
PUP.Optional.Conduit, C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll, In Quarantäne, [d1ac20be24560531293e99e4af517987],
Physische Sektoren: 0
(No malicious items detected)
(end)
Trojan Remover Logfiles Code:
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:09:23 29 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
PC appears to be in SAFE MODE.
************************************************************
22:09:24: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
22:09:24: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
22:09:25: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [TrojanScanner]
Value Data: [D:\Trojan Remover\Trjscan.exe /boot]
D:\Trojan Remover\Trjscan.exe
1666432 bytes
Created: 25.08.2013 20:52
Modified: 05.06.2014 21:46
Company: Simply Super Software
--------------------
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:09:27: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [ShadowPlay]
Value Data: [C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart]
C:\Windows\System32\nvspcap64.dll
1279480 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:07
Company: NVIDIA Corporation
--------------------
Value Name: [NvBackend]
Value Data: ["C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"]
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
2352072 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:35
Company: NVIDIA Corporation
--------------------
Value Name: [EvtMgr6]
Value Data: [D:\Logitech\SetPointP\SetPoint.exe /launchGaming]
D:\Logitech\SetPointP\SetPoint.exe
1744152 bytes
Created: 07.10.2011 11:38
Modified: 07.10.2011 11:38
Company: Logitech, Inc.
--------------------
Value Name: [Acronis Scheduler2 Service]
Value Data: ["C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"]
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
391240 bytes
Created: 06.12.2010 07:55
Modified: 06.12.2010 07:55
Company: Acronis
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:09:28: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
22:09:28: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
22:09:28: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\CSS.scr
C:\Windows\CSS.scr
371712 bytes
Created: 08.01.2008 13:37
Modified: 08.01.2008 13:37
Company: ABF software, Inc.
--------------------
************************************************************
22:09:28: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
22:09:29: Scanning ----- SERVICEDLL REGISTRY KEYS -----
************************************************************
22:09:41: Scanning ----- SERVICES REGISTRY KEYS -----
Key: FsUsbExDisk
ImagePath: \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS
C:\Windows\SysWOW64\FsUsbExDisk.SYS
37344 bytes
Created: 22.02.2013 23:17
Modified: 05.02.2013 10:54
Company: [no info]
----------
Key: RxFilter
ImagePath: system32\DRIVERS\RxFilter.sys
C:\Windows\System32\DRIVERS\RxFilter.sys - [file not found to scan]
----------
Key: SessionLauncher
ImagePath: C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe
C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe - [file not found to scan]
----------
************************************************************
22:09:53: Scanning -----VXD ENTRIES-----
************************************************************
22:09:53: Scanning ----- ContextMenuHandlers -----
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
600392 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-win32.dll
D:\TuneUp Utilities 2011\SDShelEx-win32.dll
30016 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\versions_page.dll
D:\Acronis True Image_2011\versions_page.dll
128352 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell.dll
D:\Acronis True Image_2011\tishell.dll
1030536 bytes
Created: 22.09.2011 23:21
Modified: 22.09.2011 23:21
Company: Acronis
----------
************************************************************
22:09:54: Scanning ----- Folder\ColumnHandlers -----
No Folder\ColumnHandler entries found to scan
************************************************************
22:09:54: Scanning ----- 64-Bit ContextMenuHandlers -----
Key: 7-Zip
CLSID: {23170F69-40C1-278A-1000-000100020000}
Path: D:\7-Zip\7-zip.dll
D:\7-Zip\7-zip.dll
86016 bytes
Created: 18.11.2010 22:08
Modified: 18.11.2010 22:08
Company: Igor Pavlov
----------
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
1242440 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: RXDCExtSvr
CLSID: {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C}
Path: C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
145904 bytes
Created: 26.06.2009 12:31
Modified: 26.06.2009 12:31
Company: Sonic Solutions
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-x64.dll
D:\TuneUp Utilities 2011\SDShelEx-x64.dll
28480 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\x64\versions_page.dll
D:\Acronis True Image_2011\x64\versions_page.dll
142176 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell64.dll
D:\Acronis True Image_2011\tishell64.dll
1246088 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
************************************************************
22:09:55: Scanning ----- 64-Bit Folder\ColumnHandlers -----
No Folder\ColumnHandler entries found to scan
************************************************************
22:09:55: Scanning ----- Browser Helper Objects -----
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: D:\Java\bin\ssv.dll
D:\Java\bin\ssv.dll
462760 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:11
Company: Oracle Corporation
----------
Key: {DBC80044-A445-435b-BC74-9C25C1C588A9}
BHO: D:\Java\bin\jp2ssv.dll
D:\Java\bin\jp2ssv.dll
171944 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:07
Company: Oracle Corporation
----------
************************************************************
22:09:56: Scanning ----- 64-Bit Browser Helper Objects -----
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
529664 bytes
Created: 17.07.2012 15:17
Modified: 17.07.2012 15:17
Company: Microsoft Corp.
----------
************************************************************
22:09:56: Scanning ----- ShellServiceObjectDelayLoad Entries -----
************************************************************
22:09:56: Scanning ----- 64-Bit ShellServiceObjectDelayLoad Entries -----
************************************************************
22:09:56: Scanning ----- ShellServiceObjects -----
************************************************************
22:10:00: Scanning ----- 64-Bit ShellServiceObjects -----
************************************************************
22:10:05: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
No SharedTaskScheduler entries found to scan
************************************************************
22:10:05: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.
************************************************************
22:10:05: Scanning ----- APPINIT_DLLS -----
No AppInit_DLLs value found to check
************************************************************
22:10:05: Scanning ----- 64-Bit APPINIT_DLLS -----
No 64-Bit AppInit_DLLs value found to check
************************************************************
22:10:05: Scanning ----- SECURITY PROVIDER DLLS -----
************************************************************
22:10:05: Scanning ----- CREDENTIAL PROVIDERS -----
************************************************************
22:10:07: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
Audible Download Manager.lnk - links to D:\Audible\Bin\AudibleDownloadHelper.exe [file not found to scan]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk - this links to D:\Audible\Bin\AudibleDownloadHelper.exe - this Shortcut has been removed
--------------------
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 14.07.2009 06:54
Modified: 14.07.2009 06:54
Company: [no info]
--------------------
************************************************************
22:10:28: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: sauterch
[C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 30.12.2010 22:36
Modified: 15.05.2014 18:17
Company: [no info]
----------
--------------------
************************************************************
22:10:28: Scanning ----- SCHEDULED TASKS -----
Scheduled Tasks not scanned: running in Safe Mode so Task Scheduler service not running
************************************************************
22:10:28: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
************************************************************
22:10:28: Scanning ----- DEVICE DRIVER ENTRIES -----
Value: vidc.i420
File: lvcodec2.dll
C:\Windows\SysWoW64\lvcodec2.dll
416280 bytes
Created: 26.07.2008 16:23
Modified: 26.07.2008 16:23
Company: Logitech Inc.
----------
Value: msacm.l3acm
File: C:\Windows\SysWOW64\l3codeca.acm
C:\Windows\SysWOW64\l3codeca.acm
64000 bytes
Created: 14.07.2009 02:07
Modified: 14.07.2009 03:14
Company: Fraunhofer Institut Integrierte Schaltungen IIS
----------
************************************************************
22:10:29: ----- ADDITIONAL CHECKS -----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
144595 bytes
Created: 30.12.2010 22:36
Modified: 30.08.2013 21:04
Company: [no info]
----------
Web Desktop Wallpaper entry is blank
----------
Checks for rogue DNS NameServers completed
----------
Checks for Backdoor.ZeroAccess completed
----------
Safe Mode checks completed
----------
Additional checks completed
************************************************************
22:10:29: Scanning ----- RUNNING PROCESSES -----
C:\Windows\System32\smss.exe
112640 bytes
Created: 12.09.2013 18:17
Modified: 02.08.2013 02:59
Company: Microsoft Corporation
--------------------
C:\Windows\System32\csrss.exe
7680 bytes
Created: 14.07.2009 01:19
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\wininit.exe
129024 bytes
Created: 14.07.2009 01:52
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\winlogon.exe
455168 bytes
Created: 14.05.2014 18:13
Modified: 04.03.2014 11:43
Company: Microsoft Corporation
--------------------
C:\Windows\System32\services.exe
328704 bytes
Created: 14.07.2009 01:19
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\lsass.exe
31232 bytes
Created: 14.05.2014 18:13
Modified: 12.04.2014 04:19
Company: Microsoft Corporation
--------------------
C:\Windows\System32\lsm.exe
343040 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:24
Company: Microsoft Corporation
--------------------
C:\Windows\System32\svchost.exe
27136 bytes
Created: 14.07.2009 01:31
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\ctfmon.exe
9728 bytes
Created: 14.07.2009 01:39
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\dllhost.exe
9728 bytes
Created: 14.07.2009 01:59
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
D:\Trojan Remover\Rmvtrjan.exe
FileSize: 5468008
[This is a Trojan Remover component]
--------------------
--------------------
************************************************************
22:10:32: Checking HOSTS file
No malicious entries were found in the HOSTS file
************************************************************
22:10:32: Checking ----- ROGUE BROWSER MODIFICATIONS -----
************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
about:blank
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\SysWOW64\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
hxxp://www.my-online-search.com/?babsrc=HP_ofln&mntrId=D840ED1AFF0F1A72&cat=delta&dlb=0&affID=122471
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
************************************************************
=== CHANGES WERE MADE TO A USER'S STARTUP GROUP ===
Scan completed at: 22:10:32 29 Jul 2014
Total Scan time: 00:01:08
************************************************************
======================================
[INCOMPLETE SCAN LOG RECOVERED]
======================================
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:20:57 24 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
22:20:57: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
22:20:57: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
22:20:57: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:20:58: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [ShadowPlay]
Value Data: [C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart]
C:\Windows\System32\nvspcap64.dll
1279480 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:07
Company: NVIDIA Corporation
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:20:59: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
22:20:59: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
22:20:59: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\CSS.scr
C:\Windows\CSS.scr
371712 bytes
Created: 08.01.2008 13:37
Modified: 08.01.2008 13:37
Company: ABF software, Inc.
--------------------
************************************************************
22:20:59: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
22:20:59: Scanning ----- SERVICEDLL REGISTRY KEYS -----
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[INCOMPLETE SCAN LOG RECOVERED]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
***** LAYERED SERVICE PROVIDER CHECKS *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:20:37 24 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
No errors were located in the Layered Service Provider Registry entries.
No action was taken.
************************************************************
***** WINDOWS HOSTS FILE RESET *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:20:27 24 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
The original HOSTS file has been backed up to C:\Windows\system32\Drivers\etc\hosts.trb
The HOSTS file has been reset to the default supplied by Microsoft
************************************************************
***** LAYERED SERVICE PROVIDER CHECKS *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:20:04 24 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
No errors were located in the Layered Service Provider Registry entries.
No action was taken.
************************************************************
======================================
[INCOMPLETE SCAN LOG RECOVERED]
======================================
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:13:57 24 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
22:13:58: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
22:13:58: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
22:13:58: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:13:59: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [ShadowPlay]
Value Data: [C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart]
C:\Windows\System32\nvspcap64.dll
1279480 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:07
Company: NVIDIA Corporation
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:13:59: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
22:13:59: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
22:14:00: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\CSS.scr
C:\Windows\CSS.scr
371712 bytes
Created: 08.01.2008 13:37
Modified: 08.01.2008 13:37
Company: ABF software, Inc.
--------------------
************************************************************
22:14:00: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
22:14:00: Scanning ----- SERVICEDLL REGISTRY KEYS -----
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[INCOMPLETE SCAN LOG RECOVERED]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
***** THE SYSTEM HAS BEEN RESTARTED *****
24.07.2014 22:07:31: Trojan Remover has been restarted
24.07.2014 22:07:31: Trojan Remover closed
************************************************************
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 17:41:57 23 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
PC appears to be in SAFE MODE.
************************************************************
17:41:58: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
17:41:58: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
17:41:59: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Value Name: [Malwarebytes Anti-Malware (cleanup)]
Value Data: ["C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware"]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe
54072 bytes
Created: 23.07.2014 06:44
Modified: 12.05.2014 07:24
Company: Malwarebytes Corporation
--------------------
Value Name: [Trojan Remover]
Value Data: ["D:\Trojan Remover\RMVTRJAN.EXE" /restart]
D:\Trojan Remover\RMVTRJAN.EXE
5468008 bytes
Created: 25.08.2013 20:52
Modified: 22.05.2014 18:34
Company: Simply Super Software
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
17:42:01: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [ShadowPlay]
Value Data: [C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart]
C:\Windows\System32\nvspcap64.dll
1279480 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:07
Company: NVIDIA Corporation
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
17:42:01: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
17:42:01: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
17:42:01: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\CSS.scr
C:\Windows\CSS.scr
371712 bytes
Created: 08.01.2008 13:37
Modified: 08.01.2008 13:37
Company: ABF software, Inc.
--------------------
************************************************************
17:42:02: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
17:42:02: Scanning ----- SERVICEDLL REGISTRY KEYS -----
************************************************************
17:42:20: Scanning ----- SERVICES REGISTRY KEYS -----
Key: FsUsbExDisk
ImagePath: \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS
C:\Windows\SysWOW64\FsUsbExDisk.SYS
37344 bytes
Created: 22.02.2013 23:17
Modified: 05.02.2013 10:54
Company: [no info]
----------
Key: RxFilter
ImagePath: system32\DRIVERS\RxFilter.sys
C:\Windows\System32\DRIVERS\RxFilter.sys - [file not found to scan]
----------
Key: SessionLauncher
ImagePath: C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe
C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe - [file not found to scan]
----------
************************************************************
17:42:32: Scanning -----VXD ENTRIES-----
************************************************************
17:42:32: Scanning ----- ContextMenuHandlers -----
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
600392 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-win32.dll
D:\TuneUp Utilities 2011\SDShelEx-win32.dll
30016 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\versions_page.dll
D:\Acronis True Image_2011\versions_page.dll
128352 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell.dll
D:\Acronis True Image_2011\tishell.dll
1030536 bytes
Created: 22.09.2011 23:21
Modified: 22.09.2011 23:21
Company: Acronis
----------
************************************************************
17:42:33: Scanning ----- Folder\ColumnHandlers -----
No Folder\ColumnHandler entries found to scan
************************************************************
17:42:33: Scanning ----- 64-Bit ContextMenuHandlers -----
Key: 7-Zip
CLSID: {23170F69-40C1-278A-1000-000100020000}
Path: D:\7-Zip\7-zip.dll
D:\7-Zip\7-zip.dll
86016 bytes
Created: 18.11.2010 22:08
Modified: 18.11.2010 22:08
Company: Igor Pavlov
----------
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
1242440 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: RXDCExtSvr
CLSID: {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C}
Path: C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
145904 bytes
Created: 26.06.2009 12:31
Modified: 26.06.2009 12:31
Company: Sonic Solutions
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-x64.dll
D:\TuneUp Utilities 2011\SDShelEx-x64.dll
28480 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\x64\versions_page.dll
D:\Acronis True Image_2011\x64\versions_page.dll
142176 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell64.dll
D:\Acronis True Image_2011\tishell64.dll
1246088 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
************************************************************
17:42:34: Scanning ----- 64-Bit Folder\ColumnHandlers -----
No Folder\ColumnHandler entries found to scan
************************************************************
17:42:34: Scanning ----- Browser Helper Objects -----
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: D:\Java\bin\ssv.dll
D:\Java\bin\ssv.dll
462760 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:11
Company: Oracle Corporation
----------
Key: {DBC80044-A445-435b-BC74-9C25C1C588A9}
BHO: D:\Java\bin\jp2ssv.dll
D:\Java\bin\jp2ssv.dll
171944 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:07
Company: Oracle Corporation
----------
************************************************************
17:42:34: Scanning ----- 64-Bit Browser Helper Objects -----
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
529664 bytes
Created: 17.07.2012 15:17
Modified: 17.07.2012 15:17
Company: Microsoft Corp.
----------
************************************************************
17:42:34: Scanning ----- ShellServiceObjectDelayLoad Entries -----
************************************************************
17:42:34: Scanning ----- 64-Bit ShellServiceObjectDelayLoad Entries -----
************************************************************
17:42:34: Scanning ----- ShellServiceObjects -----
************************************************************
17:42:39: Scanning ----- 64-Bit ShellServiceObjects -----
************************************************************
17:42:43: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
No SharedTaskScheduler entries found to scan
************************************************************
17:42:43: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.
************************************************************
17:42:43: Scanning ----- APPINIT_DLLS -----
No AppInit_DLLs value found to check
************************************************************
17:42:43: Scanning ----- 64-Bit APPINIT_DLLS -----
No 64-Bit AppInit_DLLs value found to check
************************************************************
17:42:44: Scanning ----- SECURITY PROVIDER DLLS -----
************************************************************
17:42:44: Scanning ----- CREDENTIAL PROVIDERS -----
************************************************************
17:42:46: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 14.07.2009 06:54
Modified: 14.07.2009 06:54
Company: [no info]
--------------------
************************************************************
17:42:46: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: sauterch
[C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 30.12.2010 22:36
Modified: 15.05.2014 18:17
Company: [no info]
----------
--------------------
************************************************************
17:42:46: Scanning ----- SCHEDULED TASKS -----
Scheduled Tasks not scanned: running in Safe Mode so Task Scheduler service not running
************************************************************
17:42:46: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
************************************************************
17:42:46: Scanning ----- DEVICE DRIVER ENTRIES -----
Value: vidc.i420
File: lvcodec2.dll
C:\Windows\SysWoW64\lvcodec2.dll
416280 bytes
Created: 26.07.2008 16:23
Modified: 26.07.2008 16:23
Company: Logitech Inc.
----------
Value: msacm.l3acm
File: C:\Windows\SysWOW64\l3codeca.acm
C:\Windows\SysWOW64\l3codeca.acm
64000 bytes
Created: 14.07.2009 02:07
Modified: 14.07.2009 03:14
Company: Fraunhofer Institut Integrierte Schaltungen IIS
----------
************************************************************
17:42:47: ----- ADDITIONAL CHECKS -----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
144595 bytes
Created: 30.12.2010 22:36
Modified: 30.08.2013 21:04
Company: [no info]
----------
Web Desktop Wallpaper entry is blank
----------
Checks for rogue DNS NameServers completed
----------
Checks for Backdoor.ZeroAccess completed
----------
Safe Mode checks completed
----------
Additional checks completed
************************************************************
17:42:47: Scanning ----- RUNNING PROCESSES -----
C:\Windows\System32\smss.exe
112640 bytes
Created: 12.09.2013 18:17
Modified: 02.08.2013 02:59
Company: Microsoft Corporation
--------------------
C:\Windows\System32\csrss.exe
7680 bytes
Created: 14.07.2009 01:19
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\wininit.exe
129024 bytes
Created: 14.07.2009 01:52
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\winlogon.exe
455168 bytes
Created: 14.05.2014 18:13
Modified: 04.03.2014 11:43
Company: Microsoft Corporation
--------------------
C:\Windows\System32\services.exe
328704 bytes
Created: 14.07.2009 01:19
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\lsass.exe
31232 bytes
Created: 14.05.2014 18:13
Modified: 12.04.2014 04:19
Company: Microsoft Corporation
--------------------
C:\Windows\System32\lsm.exe
343040 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:24
Company: Microsoft Corporation
--------------------
C:\Windows\System32\svchost.exe
27136 bytes
Created: 14.07.2009 01:31
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\ctfmon.exe
9728 bytes
Created: 14.07.2009 01:39
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\wbem\WmiPrvSE.exe
372736 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
************************************************************
17:42:49: Checking HOSTS file
No malicious entries were found in the HOSTS file
************************************************************
17:42:49: Checking ----- ROGUE BROWSER MODIFICATIONS -----
************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
about:blank
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\SysWOW64\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
hxxp://www.my-online-search.com/?babsrc=HP_ofln&mntrId=D840ED1AFF0F1A72&cat=delta&dlb=0&affID=122471
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 17:42:49 23 Jul 2014
Total Scan time: 00:00:52
************************************************************
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 17:36:43 23 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
PC appears to be in SAFE MODE.
************************************************************
17:36:44: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
17:36:44: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
17:36:44: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Value Name: [Malwarebytes Anti-Malware (cleanup)]
Value Data: ["C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware"]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe
54072 bytes
Created: 23.07.2014 06:44
Modified: 12.05.2014 07:24
Company: Malwarebytes Corporation
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
17:36:46: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [ShadowPlay]
Value Data: [C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart]
C:\Windows\System32\nvspcap64.dll
1279480 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:07
Company: NVIDIA Corporation
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
17:36:46: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
17:36:46: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
17:36:46: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\CSS.scr
C:\Windows\CSS.scr
371712 bytes
Created: 08.01.2008 13:37
Modified: 08.01.2008 13:37
Company: ABF software, Inc.
--------------------
************************************************************
17:36:47: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
17:36:47: Scanning ----- SERVICEDLL REGISTRY KEYS -----
************************************************************
17:37:06: Scanning ----- SERVICES REGISTRY KEYS -----
Key: FsUsbExDisk
ImagePath: \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS
C:\Windows\SysWOW64\FsUsbExDisk.SYS
37344 bytes
Created: 22.02.2013 23:17
Modified: 05.02.2013 10:54
Company: [no info]
----------
Key: RxFilter
ImagePath: system32\DRIVERS\RxFilter.sys
C:\Windows\System32\DRIVERS\RxFilter.sys - [file not found to scan]
----------
Key: SessionLauncher
ImagePath: C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe
C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe - [file not found to scan]
----------
************************************************************
17:37:18: Scanning -----VXD ENTRIES-----
************************************************************
17:37:18: Scanning ----- ContextMenuHandlers -----
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
600392 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-win32.dll
D:\TuneUp Utilities 2011\SDShelEx-win32.dll
30016 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\versions_page.dll
D:\Acronis True Image_2011\versions_page.dll
128352 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell.dll
D:\Acronis True Image_2011\tishell.dll
1030536 bytes
Created: 22.09.2011 23:21
Modified: 22.09.2011 23:21
Company: Acronis
----------
************************************************************
17:37:19: Scanning ----- Folder\ColumnHandlers -----
No Folder\ColumnHandler entries found to scan
************************************************************
17:37:19: Scanning ----- 64-Bit ContextMenuHandlers -----
Key: 7-Zip
CLSID: {23170F69-40C1-278A-1000-000100020000}
Path: D:\7-Zip\7-zip.dll
D:\7-Zip\7-zip.dll
86016 bytes
Created: 18.11.2010 22:08
Modified: 18.11.2010 22:08
Company: Igor Pavlov
----------
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
1242440 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: RXDCExtSvr
CLSID: {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C}
Path: C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
145904 bytes
Created: 26.06.2009 12:31
Modified: 26.06.2009 12:31
Company: Sonic Solutions
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-x64.dll
D:\TuneUp Utilities 2011\SDShelEx-x64.dll
28480 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\x64\versions_page.dll
D:\Acronis True Image_2011\x64\versions_page.dll
142176 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell64.dll
D:\Acronis True Image_2011\tishell64.dll
1246088 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
************************************************************
17:37:20: Scanning ----- 64-Bit Folder\ColumnHandlers -----
No Folder\ColumnHandler entries found to scan
************************************************************
17:37:20: Scanning ----- Browser Helper Objects -----
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: D:\Java\bin\ssv.dll
D:\Java\bin\ssv.dll
462760 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:11
Company: Oracle Corporation
----------
Key: {DBC80044-A445-435b-BC74-9C25C1C588A9}
BHO: D:\Java\bin\jp2ssv.dll
D:\Java\bin\jp2ssv.dll
171944 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:07
Company: Oracle Corporation
----------
************************************************************
17:37:20: Scanning ----- 64-Bit Browser Helper Objects -----
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
529664 bytes
Created: 17.07.2012 15:17
Modified: 17.07.2012 15:17
Company: Microsoft Corp.
----------
************************************************************
17:37:21: Scanning ----- ShellServiceObjectDelayLoad Entries -----
************************************************************
17:37:21: Scanning ----- 64-Bit ShellServiceObjectDelayLoad Entries -----
************************************************************
17:37:21: Scanning ----- ShellServiceObjects -----
************************************************************
17:37:25: Scanning ----- 64-Bit ShellServiceObjects -----
************************************************************
17:37:30: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
No SharedTaskScheduler entries found to scan
************************************************************
17:37:30: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.
************************************************************
17:37:30: Scanning ----- APPINIT_DLLS -----
AppInitDLLs entry = [ ]
- this reference will be removed
----------
************************************************************
17:40:18: Scanning ----- 64-Bit APPINIT_DLLS -----
AppInitDLLs entry = [ ]
- this reference will be removed
----------
************************************************************
17:40:23: Scanning ----- SECURITY PROVIDER DLLS -----
************************************************************
17:40:23: Scanning ----- CREDENTIAL PROVIDERS -----
************************************************************
17:40:25: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 14.07.2009 06:54
Modified: 14.07.2009 06:54
Company: [no info]
--------------------
************************************************************
17:40:25: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: sauterch
[C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 30.12.2010 22:36
Modified: 15.05.2014 18:17
Company: [no info]
----------
--------------------
************************************************************
17:40:25: Scanning ----- SCHEDULED TASKS -----
Scheduled Tasks not scanned: running in Safe Mode so Task Scheduler service not running
************************************************************
17:40:25: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----
************************************************************
17:40:25: Scanning ----- DEVICE DRIVER ENTRIES -----
Value: vidc.i420
File: lvcodec2.dll
C:\Windows\SysWoW64\lvcodec2.dll
416280 bytes
Created: 26.07.2008 16:23
Modified: 26.07.2008 16:23
Company: Logitech Inc.
----------
Value: msacm.l3acm
File: C:\Windows\SysWOW64\l3codeca.acm
C:\Windows\SysWOW64\l3codeca.acm
64000 bytes
Created: 14.07.2009 02:07
Modified: 14.07.2009 03:14
Company: Fraunhofer Institut Integrierte Schaltungen IIS
----------
************************************************************
17:40:26: ----- ADDITIONAL CHECKS -----
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
144595 bytes
Created: 30.12.2010 22:36
Modified: 30.08.2013 21:04
Company: [no info]
----------
Web Desktop Wallpaper entry is blank
----------
Checks for rogue DNS NameServers completed
----------
Checks for Backdoor.ZeroAccess completed
----------
Safe Mode checks completed
----------
Additional checks completed
************************************************************
17:40:26: Scanning ----- RUNNING PROCESSES -----
C:\Windows\System32\smss.exe
112640 bytes
Created: 12.09.2013 18:17
Modified: 02.08.2013 02:59
Company: Microsoft Corporation
--------------------
C:\Windows\System32\csrss.exe
7680 bytes
Created: 14.07.2009 01:19
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\wininit.exe
129024 bytes
Created: 14.07.2009 01:52
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\winlogon.exe
455168 bytes
Created: 14.05.2014 18:13
Modified: 04.03.2014 11:43
Company: Microsoft Corporation
--------------------
C:\Windows\System32\services.exe
328704 bytes
Created: 14.07.2009 01:19
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\lsass.exe
31232 bytes
Created: 14.05.2014 18:13
Modified: 12.04.2014 04:19
Company: Microsoft Corporation
--------------------
C:\Windows\System32\lsm.exe
343040 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:24
Company: Microsoft Corporation
--------------------
C:\Windows\System32\svchost.exe
27136 bytes
Created: 14.07.2009 01:31
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\ctfmon.exe
9728 bytes
Created: 14.07.2009 01:39
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
C:\Windows\System32\dllhost.exe
9728 bytes
Created: 14.07.2009 01:59
Modified: 14.07.2009 03:39
Company: Microsoft Corporation
--------------------
D:\Trojan Remover\Rmvtrjan.exe
FileSize: 5468008
[This is a Trojan Remover component]
--------------------
--------------------
************************************************************
17:40:28: Checking HOSTS file
No malicious entries were found in the HOSTS file
************************************************************
17:40:28: Checking ----- ROGUE BROWSER MODIFICATIONS -----
{006ee092-9658-4fd6-bd8e-a21a348e59f5} - this rogue IE SearchScope, associated with BrowserHijack.SnapDo, has been removed
************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
about:blank
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\SysWOW64\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
hxxp://www.my-online-search.com/?babsrc=HP_ofln&mntrId=D840ED1AFF0F1A72&cat=delta&dlb=0&affID=122471
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\Windows\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
hxxp://go.microsoft.com/fwlink/?LinkId=54896
************************************************************
=== CHANGES WERE MADE TO THE WINDOWS REGISTRY ===
Scan completed at: 17:40:35 23 Jul 2014
Total Scan time: 00:03:52
-------------------------------------------------------------------------
Trojan Remover needs to restart the system to complete operations
23.07.2014 17:40:39: restart commenced
************************************************************
======================================
[INCOMPLETE SCAN LOG RECOVERED]
======================================
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:43:11 15 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
22:43:11: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
22:43:11: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
22:43:11: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [TrojanScanner]
Value Data: [D:\Trojan Remover\Trjscan.exe /boot]
D:\Trojan Remover\Trjscan.exe
1666432 bytes
Created: 25.08.2013 20:52
Modified: 05.06.2014 21:46
Company: Simply Super Software
--------------------
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: []
Value Data: [D:\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe Run ]
D:\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe
845120 bytes
Created: 29.11.2011 21:58
Modified: 14.02.2014 14:55
Company: Samsung
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:43:13: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [Acronis Scheduler2 Service]
Value Data: ["C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"]
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
391240 bytes
Created: 06.12.2010 07:55
Modified: 06.12.2010 07:55
Company: Acronis
--------------------
Value Name: [EvtMgr6]
Value Data: [D:\Logitech\SetPointP\SetPoint.exe /launchGaming]
D:\Logitech\SetPointP\SetPoint.exe
1744152 bytes
Created: 07.10.2011 11:38
Modified: 07.10.2011 11:38
Company: Logitech, Inc.
--------------------
Value Name: [ShadowPlay]
Value Data: [C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart]
C:\Windows\System32\nvspcap64.dll
1279480 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:07
Company: NVIDIA Corporation
--------------------
Value Name: [NvBackend]
Value Data: ["C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"]
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
2352072 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:35
Company: NVIDIA Corporation
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:43:14: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
22:43:14: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
22:43:14: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\CSS.scr
C:\Windows\CSS.scr
371712 bytes
Created: 08.01.2008 13:37
Modified: 08.01.2008 13:37
Company: ABF software, Inc.
--------------------
************************************************************
22:43:14: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
22:43:14: Scanning ----- SERVICEDLL REGISTRY KEYS -----
************************************************************
22:43:17: Scanning ----- SERVICES REGISTRY KEYS -----
Key: FsUsbExDisk
ImagePath: \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS
C:\Windows\SysWOW64\FsUsbExDisk.SYS
37344 bytes
Created: 22.02.2013 23:17
Modified: 05.02.2013 10:54
Company: [no info]
----------
Key: GDFwSvc
ImagePath: "D:\GData\Firewall\GDFwSvcx64.exe"
D:\GData\Firewall\GDFwSvcx64.exe - [file not found to scan]
----------
Key: RxFilter
ImagePath: system32\DRIVERS\RxFilter.sys
C:\Windows\System32\DRIVERS\RxFilter.sys - [file not found to scan]
----------
Key: SessionLauncher
ImagePath: C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe
C:\Users\sauterch\AppData\Local\Temp\DX9\SessionLauncher.exe - [file not found to scan]
----------
************************************************************
22:43:37: Scanning -----VXD ENTRIES-----
************************************************************
22:43:37: Scanning ----- ContextMenuHandlers -----
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreams.dll
600392 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-win32.dll
D:\TuneUp Utilities 2011\SDShelEx-win32.dll
30016 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\versions_page.dll
D:\Acronis True Image_2011\versions_page.dll
128352 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell.dll
D:\Acronis True Image_2011\tishell.dll
1030536 bytes
Created: 22.09.2011 23:21
Modified: 22.09.2011 23:21
Company: Acronis
----------
************************************************************
22:43:37: Scanning ----- Folder\ColumnHandlers -----
Key: {16148659-720A-457d-850B-2DBD87BB129D}
File: D:\Audible\Bin\AudibleExt.dll
D:\Audible\Bin\AudibleExt.dll
165208 bytes
Created: 09.04.2009 13:55
Modified: 09.04.2009 13:55
Company: Audible, Inc.
----------
************************************************************
22:43:38: Scanning ----- 64-Bit ContextMenuHandlers -----
Key: 7-Zip
CLSID: {23170F69-40C1-278A-1000-000100020000}
Path: D:\7-Zip\7-zip.dll
D:\7-Zip\7-zip.dll
86016 bytes
Created: 18.11.2010 22:08
Modified: 18.11.2010 22:08
Company: Igor Pavlov
----------
Key: PhotoStreamsExt
CLSID: {89D984B3-813B-406A-8298-118AFA3A22AE}
Path: C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
1242440 bytes
Created: 20.11.2013 16:43
Modified: 20.11.2013 16:43
Company: Apple Inc.
----------
Key: RXDCExtSvr
CLSID: {0FB82570-BB2D-23D3-8D3B-AC2F34F1FA3C}
Path: C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
C:\Program Files\Roxio\Virtual Drive 10\DC_ShellExt64.dll
145904 bytes
Created: 26.06.2009 12:31
Modified: 26.06.2009 12:31
Company: Sonic Solutions
----------
Key: TuneUp Shredder Shell Extension
CLSID: {4858E7D9-8E12-45a3-B6A3-1CD128C9D403}
Path: D:\TuneUp Utilities 2011\SDShelEx-x64.dll
D:\TuneUp Utilities 2011\SDShelEx-x64.dll
28480 bytes
Created: 13.12.2011 10:29
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: VersionsPageShellExt
CLSID: {9E42900A-85F9-4E67-9778-575FBBA0A81C}
Path: D:\Acronis True Image_2011\x64\versions_page.dll
D:\Acronis True Image_2011\x64\versions_page.dll
142176 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
Key: {C539A15A-3AF9-4c92-B771-50CB78F5C751}
Path: D:\Acronis True Image_2011\tishell64.dll
D:\Acronis True Image_2011\tishell64.dll
1246088 bytes
Created: 22.09.2011 23:22
Modified: 22.09.2011 23:22
Company: Acronis
----------
************************************************************
22:43:38: Scanning ----- 64-Bit Folder\ColumnHandlers -----
************************************************************
22:43:38: Scanning ----- Browser Helper Objects -----
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: D:\Java\bin\ssv.dll
D:\Java\bin\ssv.dll
462760 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:11
Company: Oracle Corporation
----------
Key: {DBC80044-A445-435b-BC74-9C25C1C588A9}
BHO: D:\Java\bin\jp2ssv.dll
D:\Java\bin\jp2ssv.dll
171944 bytes
Created: 20.10.2013 13:37
Modified: 14.04.2014 20:07
Company: Oracle Corporation
----------
************************************************************
22:43:39: Scanning ----- 64-Bit Browser Helper Objects -----
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
529664 bytes
Created: 17.07.2012 15:17
Modified: 17.07.2012 15:17
Company: Microsoft Corp.
----------
************************************************************
22:43:39: Scanning ----- ShellServiceObjectDelayLoad Entries -----
************************************************************
22:43:39: Scanning ----- 64-Bit ShellServiceObjectDelayLoad Entries -----
************************************************************
22:43:39: Scanning ----- ShellServiceObjects -----
************************************************************
22:43:42: Scanning ----- 64-Bit ShellServiceObjects -----
************************************************************
22:43:45: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----
No SharedTaskScheduler entries found to scan
************************************************************
22:43:45: Scanning ----- IMAGEFILE DEBUGGERS -----
Key = kies.exe
Image File Debugger details:
D:\TuneUp Utilities 2011\TUAutoReactivator64.exe
113472 bytes
Created: 13.12.2011 10:35
Modified: 13.12.2011 10:35
Company: TuneUp Software
"D:\TuneUp Utilities 2011\TUAutoReactivator64.exe" - Debugger entry has been excluded from scanning
----------
Key = kiesagent.exe
Image File Debugger details:
D:\TuneUp Utilities 2011\TUAutoReactivator64.exe
113472 bytes
Created: 13.12.2011 10:35
Modified: 13.12.2011 10:35
Company: TuneUp Software
"D:\TuneUp Utilities 2011\TUAutoReactivator64.exe" - Debugger entry has been excluded from scanning
----------
Key = setup.exe
Image File Debugger details:
D:\TuneUp Utilities 2011\TUAutoReactivator64.exe
113472 bytes
Created: 13.12.2011 10:35
Modified: 13.12.2011 10:35
Company: TuneUp Software
"D:\TuneUp Utilities 2011\TUAutoReactivator64.exe" - Debugger entry has been excluded from scanning
----------
************************************************************
22:43:45: Scanning ----- APPINIT_DLLS -----
No AppInit_DLLs value found to check
************************************************************
22:43:45: Scanning ----- 64-Bit APPINIT_DLLS -----
No 64-Bit AppInit_DLLs value found to check
************************************************************
22:43:46: Scanning ----- SECURITY PROVIDER DLLS -----
************************************************************
22:43:46: Scanning ----- CREDENTIAL PROVIDERS -----
************************************************************
22:43:47: Scanning ------ COMMON STARTUP GROUP ------
[C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]
The Common Startup Group attempts to load the following file(s) at boot time:
Audible Download Manager.lnk - links to D:\Audible\Bin\AUDIBL~1.EXE
D:\Audible\Bin\AUDIBL~1.EXE
2125472 bytes
Created: 14.03.2011 10:22
Modified: 14.03.2011 10:22
Company: Audible, Inc.
--------------------
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 14.07.2009 06:54
Modified: 14.07.2009 06:54
Company: [no info]
--------------------
************************************************************
22:43:48: Scanning ----- USER STARTUP GROUPS -----
Checking Startup Group for: sauterch
[C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]
C:\Users\sauterch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-HS- 174 bytes
Created: 30.12.2010 22:36
Modified: 15.05.2014 18:17
Company: [no info]
----------
--------------------
************************************************************
22:43:48: Scanning ----- SCHEDULED TASKS -----
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[INCOMPLETE SCAN LOG RECOVERED]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
======================================
[INCOMPLETE SCAN LOG RECOVERED]
======================================
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2931. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:34:52 15 Jul 2014
Using Database v8420
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
22:34:52: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
22:34:52: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
22:34:53: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [TrojanScanner]
Value Data: [D:\Trojan Remover\Trjscan.exe /boot]
D:\Trojan Remover\Trjscan.exe
1666432 bytes
Created: 25.08.2013 20:52
Modified: 05.06.2014 21:46
Company: Simply Super Software
--------------------
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: []
Value Data: [D:\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe Run ]
D:\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe
845120 bytes
Created: 29.11.2011 21:58
Modified: 14.02.2014 14:55
Company: Samsung
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:34:54: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [Acronis Scheduler2 Service]
Value Data: ["C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"]
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
391240 bytes
Created: 06.12.2010 07:55
Modified: 06.12.2010 07:55
Company: Acronis
--------------------
Value Name: [EvtMgr6]
Value Data: [D:\Logitech\SetPointP\SetPoint.exe /launchGaming]
D:\Logitech\SetPointP\SetPoint.exe
1744152 bytes
Created: 07.10.2011 11:38
Modified: 07.10.2011 11:38
Company: Logitech, Inc.
--------------------
Value Name: [ShadowPlay]
Value Data: [C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart]
C:\Windows\System32\nvspcap64.dll
1279480 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:07
Company: NVIDIA Corporation
--------------------
Value Name: [NvBackend]
Value Data: ["C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"]
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
2352072 bytes
Created: 05.06.2014 10:21
Modified: 30.05.2014 01:35
Company: NVIDIA Corporation
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:34:55: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
22:34:55: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
22:34:55: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\CSS.scr
C:\Windows\CSS.scr
371712 bytes
Created: 08.01.2008 13:37
Modified: 08.01.2008 13:37
Company: ABF software, Inc.
--------------------
************************************************************
22:34:55: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
22:34:55: Scanning ----- SERVICEDLL REGISTRY KEYS -----
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[INCOMPLETE SCAN LOG RECOVERED]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.9.1.2629. For information, email support@simplysup.com
[Registered to: sauterch@yahoo.de]
Scan started at: 22:50:00 03 Apr 2014
Using Database v8344
Operating System: Windows 7 x64 Home Premium (SP1) [Build: 6.1.7601]
File System: NTFS
User Account Control is Enabled
[Secure Desktop Prompt is DISABLED]
UserData directory: C:\Users\sauterch\AppData\Roaming\Simply Super Software\Trojan Remover\
Database directory: C:\ProgramData\Simply Super Software\Trojan Remover\Data\
Logfile directory: C:\Users\sauterch\Documents\Simply Super Software\Trojan Remover Logfiles\
Program directory: D:\Trojan Remover\
Running with Administrator privileges
************************************************************
22:50:01: ----- Checking Default File Associations -----
No modified default file associations detected
************************************************************
22:50:01: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.
************************************************************
22:50:01: Scanning ----- Windows Registry -----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
Key value: [explorer.exe]
File: C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
2871808 bytes
Created: 27.04.2011 18:56
Modified: 25.02.2011 08:19
Company: Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
Key value: [C:\Windows\system32\userinit.exe,]
File: C:\Windows\system32\userinit.exe
C:\Windows\System32\userinit.exe
30720 bytes
Created: 27.04.2011 22:51
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
----------
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [G Data AntiVirus Tray Application]
Value Data: [D:\GData\AVKTray\AVKTray.exe]
D:\GData\AVKTray\AVKTray.exe
1035216 bytes
Created: 22.02.2013 23:08
Modified: 09.01.2013 14:01
Company: G Data Software AG
--------------------
Value Name: [GDFirewallTray]
Value Data: [D:\GData\Firewall\GDFirewallTray.exe]
D:\GData\Firewall\GDFirewallTray.exe
1475096 bytes
Created: 08.01.2013 13:21
Modified: 29.11.2012 06:20
Company: G Data Software AG
--------------------
Value Name: [TrojanScanner]
Value Data: [D:\Trojan Remover\Trjscan.exe /boot]
D:\Trojan Remover\Trjscan.exe
1661856 bytes
Created: 25.08.2013 20:52
Modified: 23.02.2014 20:04
Company: Simply Super Software
--------------------
Value Name: [IMSS]
Value Data: ["C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"]
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
111640 bytes
Created: 31.12.2010 12:38
Modified: 30.09.2009 20:02
Company:
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: [Sidebar]
Value Data: [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun]
C:\Program Files\Windows Sidebar\sidebar.exe
1475584 bytes
Created: 27.04.2011 22:52
Modified: 20.11.2010 15:25
Company: Microsoft Corporation
--------------------
Value Name: [ctfmon.exe]
Value Data: ["C:\Windows\system32\ctfmon.exe"]
C:\Windows\SysWoW64\ctfmon.exe
8704 bytes
Created: 14.07.2009 01:26
Modified: 14.07.2009 03:14
Company: Microsoft Corporation
--------------------
Value Name: []
Value Data: [D:\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe Run]
D:\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe
845120 bytes
Created: 29.11.2011 21:58
Modified: 14.02.2014 14:55
Company: Samsung
--------------------
Value Name: [AVMUSBFernanschluss]
Value Data: ["C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe"]
C:\Users\sauterch\AppData\Local\Apps\2.0\N7JC67JJ.28D\EXZ09BGP.07J\frit..tion_1acae14e4778b8d2_0002.0003_6dcb4a48ddb2ee39\AVMAutoStart.exe
139264 bytes
Created: 30.12.2013 20:34
Modified: 30.12.2013 20:34
Company: AVM Berlin
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Value Name: [Uninstall C:\Users\sauterch\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64]
Value Data: [C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\sauterch\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64"]
rmdir /s /q C:\Users\sauterch\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\amd64 - [file not found to scan]
************************************************************
22:50:02: Scanning ----- Windows 64-Bit Registry -----
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: [Acronis Scheduler2 Service]
Value Data: ["C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"]
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
391240 bytes
Created: 06.12.2010 07:55
Modified: 06.12.2010 07:55
Company: Acronis
--------------------
Value Name: [EvtMgr6]
Value Data: [D:\Logitech\SetPointP\SetPoint.exe /launchGaming]
D:\Logitech\SetPointP\SetPoint.exe
1744152 bytes
Created: 07.10.2011 11:38
Modified: 07.10.2011 11:38
Company: Logitech, Inc.
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry key appears to be empty
************************************************************
22:50:03: Scanning -----SHELLEXECUTEHOOKS-----
ShellExecuteHooks key is empty
************************************************************
22:50:03: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------
************************************************************
22:50:03: Scanning -----ACTIVE SCREENSAVER-----
ScreenSaver: C:\Windows\KAMINF~1.SCR
C:\Windows\KAMINF~1.SCR
14257664 bytes
Created: 02.02.2014 16:07
Modified: 21.05.2013 20:03
Company: Jochen Moschko
--------------------
************************************************************
22:50:03: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key: {2D46B6DC-2207-486B-B523-A557E6D54B47}
Path: C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
C:\Windows\SysWoW64\ie4uinit.exe - [file not found to scan]
----------
************************************************************
22:50:03: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key: UxTuneUp
Path: %SystemRoot%\System32\uxtuneup.dll
C:\Windows\System32\uxtuneup.dll
36160 bytes
Created: 15.01.2011 17:11
Modified: 13.12.2011 10:29
Company: TuneUp Software
----------
Key: wuauserv
Path: C:\Windows\system32\wuaueng.dll
C:\Windows\System32\wuaueng.dll
2428952 bytes
Created: 22.06.2012 18:39
Modified: 03.06.2012 00:19
Company: Microsoft Corporation
----------
************************************************************
|
Lesestoff: