Windows 8: Malware/Adware Probleme, Aufruf von unerwünschten Seiten im Internet
Hallo Liebes TB-Team,
ich habe mal wieder ein Problem mit dem Laptop eines Bekannten.
Beim Surfen im Internet wurden Seiten von Trovi.com geöffnet.
Während des Arbeiten mit dem Laptop wurde der PCOptimizerPro geöffnet.
Folgende Programme habe ich mit IOUninstaller deinstalliert: - pgcchelper
- Pokki
- Safefinder Smartbar
Mit Malwarebyte's Anti-Malware habe ich bereits alle Funde entfernen lassen.
Hier die letzten Logfiles: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by ***** (ATTENTION: The logged in user is not administrator) on WOLKENSCHIEBER on 05-08-2014 17:59:24
Running from C:\Users\*****\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Quick Access\QuickAccess.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Farbar) C:\Users\*****\Desktop\1 FRST64.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13657304 2013-10-18] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2778352 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-05-12] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] ( (Atheros Communications))
HKU\S-1-5-21-3687772733-1280818029-1885610514-1004\...\Run: [Pokki] => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
BootExecute: autocheck autochk * BootDefrag.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=APJB
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=APJB
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - {62D98EA6-05E3-4196-8CD4-3F9DAE6FCD4E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=APJB
SearchScopes: HKLM-x32 - {62D98EA6-05E3-4196-8CD4-3F9DAE6FCD4E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=APJB
SearchScopes: HKCU - {62D98EA6-05E3-4196-8CD4-3F9DAE6FCD4E} URL =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1
FireFox:
========
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Portal\CCDMonitorService.exe [2650696 2013-07-26] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [663592 2013-07-05] (Acer Incorporated)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2175264 2014-08-05] (IObit)
R2 lmhosts; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 LMSvc; C:\Program Files\Packard Bell\Packard Bell Launch Manager\LMSvc.exe [457768 2013-08-03] (Acer Incorporate)
R2 NlaSvc; C:\Windows\System32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R3 QASvc; C:\Program Files\Packard Bell\Packard Bell Quick Access\QASvc.exe [457768 2013-08-02] (Acer Incorporate)
R3 RMSvc; C:\Program Files\Packard Bell\Packard Bell Quick Access\RMSvc.exe [448040 2013-08-02] (Acer Incorporate)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
R0 BootDefragDriver; C:\Windows\System32\drivers\BootDefragDriver.sys [17600 2014-07-18] (Glarysoft Ltd)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-07] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2014-08-05] (Glarysoft Ltd)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 17:59 - 2014-08-05 18:00 - 00007740 _____ () C:\Users\*****\Desktop\FRST.txt
2014-08-05 17:56 - 2014-08-05 17:56 - 00000000 ____D () C:\Users\*****\AppData\Roaming\IObit
2014-08-05 17:53 - 2014-08-05 17:53 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft
2014-08-05 17:52 - 2012-10-24 21:44 - 00656048 _____ (WildTangent, Inc.) C:\ProgramData\uninstall3134972.exe
2014-08-05 17:51 - 2014-08-05 17:51 - 00000000 ____D () C:\Users\*****\AppData\Roaming\WildTangent
2014-08-05 17:15 - 2014-08-05 17:17 - 00000000 ____D () C:\ProgramData\ProductData
2014-08-05 17:15 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\IObit
2014-08-05 17:15 - 2014-08-05 17:15 - 00001260 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-08-05 17:15 - 2014-08-05 17:15 - 00000310 _____ () C:\Windows\Tasks\Uninstaller_SkipUac_Administrator.job
2014-08-05 17:15 - 2014-08-05 17:15 - 00000000 ____D () C:\Users\*****\AppData\Roaming\IObit
2014-08-05 17:15 - 2014-08-05 17:15 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-08-05 17:14 - 2014-08-05 17:15 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2014-08-05 17:14 - 2014-08-05 17:14 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2014-08-05 17:14 - 2014-08-05 17:14 - 00001120 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2014-08-05 17:14 - 2014-08-05 17:14 - 00001108 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2014-08-05 17:14 - 2014-08-05 17:14 - 00000364 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2014-08-05 17:14 - 2014-08-05 17:14 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft
2014-08-05 17:14 - 2014-08-05 17:14 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DiskDefrag
2014-08-05 17:14 - 2014-08-05 17:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2014-08-05 17:14 - 2014-07-21 05:01 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-08-05 17:14 - 2014-07-18 09:11 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-08-05 16:58 - 2014-08-05 16:58 - 00000000 ____D () C:\Windows\ERUNT
2014-08-05 16:57 - 2014-08-05 16:57 - 00000000 _____ () C:\Users\*****\Desktop\4 ComboFix.exe
2014-08-04 17:26 - 2014-08-04 17:26 - 00002183 _____ () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-08-04 17:20 - 2014-08-05 16:58 - 00000000 ____D () C:\AdwCleaner
2014-08-04 16:54 - 2014-08-04 16:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 16:54 - 2014-08-04 16:54 - 00001130 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-04 16:54 - 2014-08-04 16:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 16:54 - 2014-08-04 16:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 16:54 - 2014-08-04 16:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-04 16:54 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-04 16:54 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-04 16:54 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-04 16:44 - 2014-08-05 17:59 - 00000000 ____D () C:\FRST
2014-08-04 16:44 - 2014-08-03 18:07 - 00709260 _____ () C:\Users\*****\Desktop\10 delfix_10.7.exe
2014-08-04 16:44 - 2014-08-03 18:05 - 02347384 _____ (ESET) C:\Users\*****\Desktop\8 esetsmartinstaller_deu.exe
2014-08-04 16:44 - 2014-08-03 18:04 - 00000078 _____ () C:\Users\*****\Desktop\7 zoek.txt
2014-08-04 16:44 - 2014-08-03 18:03 - 01287168 _____ () C:\Users\*****\Desktop\7 zoek.exe
2014-08-04 16:44 - 2014-08-03 17:56 - 00854390 _____ () C:\Users\*****\Desktop\9 SecurityCheck.exe
2014-08-04 16:44 - 2014-08-03 17:54 - 01361309 _____ () C:\Users\*****\Desktop\5 adwcleaner_3.302.exe
2014-08-04 16:44 - 2014-08-03 17:54 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\6 JRT.exe
2014-08-04 16:43 - 2014-08-04 16:43 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Apple Computer
2014-08-04 16:43 - 2014-08-03 17:58 - 02094080 _____ (Farbar) C:\Users\*****\Desktop\1 FRST64.exe
2014-08-04 16:43 - 2014-08-03 17:58 - 00380416 _____ () C:\Users\*****\Desktop\2 Gmer-19357.exe
2014-08-04 16:43 - 2014-08-03 17:55 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Desktop\3 mbam-setup-2.0.2.1012.exe
2014-08-04 16:43 - 2014-08-03 17:54 - 05566616 _____ (Swearware) C:\Users\*****\Desktop\4 ComboFix.exe
2014-08-03 15:55 - 2014-08-03 15:55 - 00000000 ___RD () C:\Users\*****\Documents\Notes
2014-08-02 17:38 - 2014-08-02 17:38 - 00001099 _____ () C:\Users\*****\Desktop\HP Officejet Pro 8600.lnk
2014-08-02 11:51 - 2014-08-02 11:51 - 00000046 _____ () C:\Users\*****\AppData\Roaming\WB.CFG
2014-07-22 20:57 - 2014-08-05 17:55 - 00000000 ____D () C:\Windows\Minidump
2014-07-22 20:04 - 2014-07-29 18:54 - 00000000 ____D () C:\Users\*****\AppData\Roaming\RapidLoadClient
2014-07-20 16:32 - 2014-08-02 11:33 - 00003536 _____ () C:\Windows\SysWOW64\AccProxy.ini
2014-07-20 16:32 - 2014-08-02 11:33 - 00001928 _____ () C:\Windows\SysWOW64\AccProxyOff.ini
2014-07-20 16:32 - 2014-08-02 11:33 - 00001928 _____ () C:\Windows\system32\AccProxyOff.ini
2014-07-20 16:32 - 2013-09-24 16:31 - 00345664 _____ (OR Interactive Ltd) C:\Windows\SysWOW64\AccProxy.dll
2014-07-20 16:31 - 2014-08-04 17:20 - 00000000 ____D () C:\Users\*****\AppData\Roaming\RapidLoad
2014-07-20 15:34 - 2014-07-20 15:34 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-20 15:34 - 2014-07-20 15:34 - 00000000 _____ () C:\autoexec.bat
2014-07-20 15:33 - 2014-07-20 16:24 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-07-20 15:21 - 2014-07-20 15:21 - 00000000 ____D () C:\MININT
2014-07-20 15:20 - 2014-08-04 17:20 - 00000000 ____D () C:\Users\*****\AppData\Roaming\IDM2
2014-07-19 13:25 - 2014-07-19 13:25 - 00000000 ____H () C:\Users\*****\Documents\Default.rdp
2014-07-18 15:03 - 2014-01-19 09:38 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-07-16 21:05 - 2014-08-04 17:23 - 00000000 ____D () C:\Program Files (x86)\19A6D51C-2D35-44DB-B412-0B01BF8D2D62
2014-07-16 21:05 - 2014-07-16 21:05 - 00000000 ____D () C:\Program Files\19A6D51C-2D35-44DB-B412-0B01BF8D2D62
2014-07-16 20:56 - 2014-07-16 20:58 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-07-16 20:01 - 2014-07-16 20:01 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-15 21:43 - 2014-07-15 21:43 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-15 21:43 - 2014-04-14 05:29 - 01018880 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-07-15 21:03 - 2014-07-01 00:45 - 00688128 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-07-15 21:03 - 2014-06-28 09:48 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-07-15 21:03 - 2014-06-28 09:07 - 00385536 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-07-11 18:04 - 2014-07-11 18:04 - 00000000 ____D () C:\Users\*****\Documents\CyberLink
2014-07-11 18:04 - 2014-07-11 18:04 - 00000000 ____D () C:\Users\*****\AppData\Roaming\CyberLink
2014-07-10 11:07 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-10 11:07 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-10 11:07 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-10 11:07 - 2014-06-19 01:46 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-10 11:07 - 2014-06-19 00:57 - 00225280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-10 11:06 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-10 11:06 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-10 11:06 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-10 11:06 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-10 11:06 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-10 11:06 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-10 11:06 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-10 11:06 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-10 11:06 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-10 11:06 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-10 11:06 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-10 11:06 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-10 11:06 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-10 11:06 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-10 11:05 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-10 11:05 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-10 11:05 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-10 11:05 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-10 11:05 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-10 11:05 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-10 11:05 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-10 11:05 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-10 11:05 - 2014-06-17 00:26 - 00779264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-10 11:05 - 2014-06-17 00:24 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-10 11:05 - 2014-06-06 16:20 - 04190720 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-10 11:05 - 2014-05-30 05:03 - 00563200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-10 11:05 - 2014-05-29 14:02 - 00565576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-07-10 11:05 - 2014-05-29 09:55 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-07-10 11:05 - 2014-05-29 08:40 - 00735232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-07-10 11:05 - 2014-05-29 08:37 - 00436224 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-07-10 11:05 - 2014-05-29 07:34 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2014-07-10 11:05 - 2014-05-29 07:27 - 01417216 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-10 10:28 - 2014-06-06 15:04 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-10 10:28 - 2014-06-06 14:18 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-10 10:28 - 2014-05-31 12:07 - 00054776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-07-10 10:28 - 2014-05-31 12:06 - 00555736 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.appcore.dll
2014-07-10 10:28 - 2014-05-31 05:40 - 13287936 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-07-10 10:28 - 2014-05-31 05:30 - 11792384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-07-10 10:28 - 2014-05-31 05:12 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-07-10 10:28 - 2014-05-31 05:06 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-07-10 10:28 - 2014-05-31 05:03 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-07-10 10:28 - 2014-05-31 05:01 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-07-10 10:28 - 2014-05-31 04:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-07-10 10:28 - 2014-05-31 04:54 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-07-10 10:28 - 2014-05-31 04:48 - 03463680 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-07-10 10:28 - 2014-05-31 04:37 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2014-07-10 10:28 - 2014-05-31 04:36 - 00923136 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-07-10 10:28 - 2014-05-31 04:35 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2014-07-10 10:28 - 2014-05-31 04:32 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-07-10 10:23 - 2014-07-10 10:23 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2021-10-21 15:36 - 2014-03-31 13:59 - 00000852 _____ () C:\Windows\system32\Drivers\RTKHDRC.dat
2021-10-04 09:34 - 2014-03-31 13:59 - 00000712 _____ () C:\Windows\system32\Drivers\RTMICEQ0.dat
2014-08-05 18:00 - 2014-08-05 17:59 - 00007740 _____ () C:\Users\*****\Desktop\FRST.txt
2014-08-05 18:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-08-05 17:59 - 2014-08-04 16:44 - 00000000 ____D () C:\FRST
2014-08-05 17:57 - 2014-03-31 13:36 - 01956011 _____ () C:\Windows\WindowsUpdate.log
2014-08-05 17:56 - 2014-08-05 17:56 - 00000000 ____D () C:\Users\*****\AppData\Roaming\IObit
2014-08-05 17:55 - 2014-07-22 20:57 - 00000000 ____D () C:\Windows\Minidump
2014-08-05 17:55 - 2013-11-07 03:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-08-05 17:55 - 2013-11-06 13:32 - 00000000 ____D () C:\Windows\Panther
2014-08-05 17:53 - 2014-08-05 17:53 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft
2014-08-05 17:52 - 2013-11-07 03:36 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games
2014-08-05 17:51 - 2014-08-05 17:51 - 00000000 ____D () C:\Users\*****\AppData\Roaming\WildTangent
2014-08-05 17:51 - 2013-11-07 03:36 - 00000000 ____D () C:\ProgramData\WildTangent
2014-08-05 17:50 - 2014-06-25 21:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-05 17:48 - 2014-03-31 14:23 - 00000000 ____D () C:\Program Files (x86)\Norton Online Backup ARA
2014-08-05 17:23 - 2014-03-31 14:26 - 00000000 ____D () C:\Program Files (x86)\Acer
2014-08-05 17:19 - 2014-04-01 17:53 - 00000000 ____D () C:\Users\*****\AppData\Local\Pokki
2014-08-05 17:18 - 2014-03-31 23:19 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2014-08-05 17:18 - 2014-03-31 23:19 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2014-08-05 17:18 - 2013-11-06 13:44 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-05 17:17 - 2014-08-05 17:15 - 00000000 ____D () C:\ProgramData\ProductData
2014-08-05 17:16 - 2014-08-05 17:15 - 00000000 ____D () C:\ProgramData\IObit
2014-08-05 17:15 - 2014-08-05 17:15 - 00001260 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-08-05 17:15 - 2014-08-05 17:15 - 00000310 _____ () C:\Windows\Tasks\Uninstaller_SkipUac_Administrator.job
2014-08-05 17:15 - 2014-08-05 17:15 - 00000000 ____D () C:\Users\*****\AppData\Roaming\IObit
2014-08-05 17:15 - 2014-08-05 17:15 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-08-05 17:15 - 2014-08-05 17:14 - 00000000 ____D () C:\Program Files (x86)\Glary Utilities 5
2014-08-05 17:15 - 2014-03-31 14:23 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-08-05 17:14 - 2014-08-05 17:14 - 00020160 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\GUBootStartup.sys
2014-08-05 17:14 - 2014-08-05 17:14 - 00001120 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
2014-08-05 17:14 - 2014-08-05 17:14 - 00001108 _____ () C:\Users\Public\Desktop\Glary Utilities 5.lnk
2014-08-05 17:14 - 2014-08-05 17:14 - 00000364 _____ () C:\Windows\Tasks\GlaryInitialize 5.job
2014-08-05 17:14 - 2014-08-05 17:14 - 00000000 ____D () C:\Users\*****\AppData\Roaming\GlarySoft
2014-08-05 17:14 - 2014-08-05 17:14 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DiskDefrag
2014-08-05 17:14 - 2014-08-05 17:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
2014-08-05 17:11 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-05 17:07 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-08-05 16:58 - 2014-08-05 16:58 - 00000000 ____D () C:\Windows\ERUNT
2014-08-05 16:58 - 2014-08-04 17:20 - 00000000 ____D () C:\AdwCleaner
2014-08-05 16:57 - 2014-08-05 16:57 - 00000000 _____ () C:\Users\*****\Desktop\4 ComboFix.exe
2014-08-04 17:26 - 2014-08-04 17:26 - 00002183 _____ () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2014-08-04 17:23 - 2014-07-16 21:05 - 00000000 ____D () C:\Program Files (x86)\19A6D51C-2D35-44DB-B412-0B01BF8D2D62
2014-08-04 17:23 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Resources
2014-08-04 17:20 - 2014-07-20 16:31 - 00000000 ____D () C:\Users\*****\AppData\Roaming\RapidLoad
2014-08-04 17:20 - 2014-07-20 15:20 - 00000000 ____D () C:\Users\*****\AppData\Roaming\IDM2
2014-08-04 16:55 - 2014-08-04 16:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-04 16:54 - 2014-08-04 16:54 - 00001130 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-04 16:54 - 2014-08-04 16:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-04 16:54 - 2014-08-04 16:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-04 16:54 - 2014-08-04 16:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-04 16:43 - 2014-08-04 16:43 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Apple Computer
2014-08-03 18:07 - 2014-08-04 16:44 - 00709260 _____ () C:\Users\*****\Desktop\10 delfix_10.7.exe
2014-08-03 18:05 - 2014-08-04 16:44 - 02347384 _____ (ESET) C:\Users\*****\Desktop\8 esetsmartinstaller_deu.exe
2014-08-03 18:04 - 2014-08-04 16:44 - 00000078 _____ () C:\Users\*****\Desktop\7 zoek.txt
2014-08-03 18:03 - 2014-08-04 16:44 - 01287168 _____ () C:\Users\*****\Desktop\7 zoek.exe
2014-08-03 17:58 - 2014-08-04 16:43 - 02094080 _____ (Farbar) C:\Users\*****\Desktop\1 FRST64.exe
2014-08-03 17:58 - 2014-08-04 16:43 - 00380416 _____ () C:\Users\*****\Desktop\2 Gmer-19357.exe
2014-08-03 17:56 - 2014-08-04 16:44 - 00854390 _____ () C:\Users\*****\Desktop\9 SecurityCheck.exe
2014-08-03 17:55 - 2014-08-04 16:43 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Desktop\3 mbam-setup-2.0.2.1012.exe
2014-08-03 17:54 - 2014-08-04 16:44 - 01361309 _____ () C:\Users\*****\Desktop\5 adwcleaner_3.302.exe
2014-08-03 17:54 - 2014-08-04 16:44 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\6 JRT.exe
2014-08-03 17:54 - 2014-08-04 16:43 - 05566616 _____ (Swearware) C:\Users\*****\Desktop\4 ComboFix.exe
2014-08-03 15:55 - 2014-08-03 15:55 - 00000000 ___RD () C:\Users\*****\Documents\Notes
2014-08-03 15:28 - 2014-06-25 21:07 - 00000000 ____D () C:\Users\*****\AppData\Roaming\HpUpdate
2014-08-02 17:38 - 2014-08-02 17:38 - 00001099 _____ () C:\Users\*****\Desktop\HP Officejet Pro 8600.lnk
2014-08-02 11:51 - 2014-08-02 11:51 - 00000046 _____ () C:\Users\*****\AppData\Roaming\WB.CFG
2014-08-02 11:51 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-08-02 11:33 - 2014-07-20 16:32 - 00003536 _____ () C:\Windows\SysWOW64\AccProxy.ini
2014-08-02 11:33 - 2014-07-20 16:32 - 00001928 _____ () C:\Windows\SysWOW64\AccProxyOff.ini
2014-08-02 11:33 - 2014-07-20 16:32 - 00001928 _____ () C:\Windows\system32\AccProxyOff.ini
2014-07-29 18:54 - 2014-07-22 20:04 - 00000000 ____D () C:\Users\*****\AppData\Roaming\RapidLoadClient
2014-07-27 13:58 - 2014-03-31 17:26 - 00000000 ____D () C:\Users\*****\Desktop\Musik (1)
2014-07-24 10:14 - 2014-03-31 15:05 - 00000000 ____D () C:\Users\*****
2014-07-22 20:56 - 2013-08-22 16:44 - 00344704 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-21 09:59 - 2014-03-31 16:31 - 00000000 ____D () C:\Users\*****\Documents\clear.fi
2014-07-21 05:01 - 2014-08-05 17:14 - 00118048 _____ (Glarysoft Ltd) C:\Windows\system32\BootDefrag.exe
2014-07-20 17:38 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-07-20 16:24 - 2014-07-20 15:33 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-07-20 15:34 - 2014-07-20 15:34 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-07-20 15:34 - 2014-07-20 15:34 - 00000000 _____ () C:\autoexec.bat
2014-07-20 15:21 - 2014-07-20 15:21 - 00000000 ____D () C:\MININT
2014-07-20 14:02 - 2013-11-07 03:47 - 00000000 ____D () C:\ProgramData\Norton
2014-07-19 16:00 - 2014-03-31 14:23 - 00000000 ____D () C:\ProgramData\Temp
2014-07-19 15:51 - 2013-08-22 15:25 - 00000194 _____ () C:\Windows\win.ini
2014-07-19 14:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-19 13:25 - 2014-07-19 13:25 - 00000000 ____H () C:\Users\*****\Documents\Default.rdp
2014-07-18 09:11 - 2014-08-05 17:14 - 00017600 _____ (Glarysoft Ltd) C:\Windows\system32\Drivers\BootDefragDriver.sys
2014-07-16 21:05 - 2014-07-16 21:05 - 00000000 ____D () C:\Program Files\19A6D51C-2D35-44DB-B412-0B01BF8D2D62
2014-07-16 20:59 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-07-16 20:58 - 2014-07-16 20:56 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-07-16 20:01 - 2014-07-16 20:01 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-15 21:46 - 2014-06-05 12:58 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-15 21:43 - 2014-07-15 21:43 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-11 18:05 - 2014-03-31 14:25 - 00000000 ____D () C:\ProgramData\CyberLink
2014-07-11 18:04 - 2014-07-11 18:04 - 00000000 ____D () C:\Users\*****\Documents\CyberLink
2014-07-11 18:04 - 2014-07-11 18:04 - 00000000 ____D () C:\Users\*****\AppData\Roaming\CyberLink
2014-07-10 12:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-07-10 12:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-07-10 12:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-07-10 12:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-07-10 11:15 - 2013-08-22 21:11 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-10 10:23 - 2014-07-10 10:23 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
Files to move or delete:
====================
C:\ProgramData\uninstall3134972.exe
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\oct3096.tmp.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-08-2014
Ran by ***** at 2014-08-05 18:01:12
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Docs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.01.3006 - Acer Incorporated)
Acer Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.04.3002.6 - Acer Incorporated)
Acer Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.04.3004.0 - Acer Incorporated)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 2.02.3104 - Acer Incorporated)
Acer Remote Files (HKLM\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 1.00.3007 - Acer Incorporated)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3323.57 - CyberLink Corp.)
CyberLink PowerDVD 12 (x32 Version: 12.0.3323.57 - CyberLink Corp.) Hidden
Glary Utilities 5.4 (HKLM-x32\...\Glary Utilities 5) (Version: 5.4.0.11 - Glarysoft Ltd)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.8100 - Packard Bell)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3349 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
Intel(R) Trusted Execution Engine (Version: 1.1.1.1 - Intel Corporation) Hidden
Intel(R) Trusted Execution Engine Driver (Version: 1.0.0.1050 - Intel Corporation) Hidden
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.3.8.2663 - IObit)
iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.8100 - Packard Bell)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0 - Microsoft Corporation) Hidden
Nero BackItUp (x32 Version: 12.5.11000 - Nero AG) Hidden
Nero BackItUp 12 Essentials OEM.a01 (HKLM-x32\...\{551AC8F2-FEA2-4B45-ACF7-C98681233CC9}) (Version: 12.5.01200 - Nero AG)
Nero BackItUp Help (CHM) (x32 Version: 12.0.13000 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 11.0.15900 - Nero AG) Hidden
Nero ControlCenter Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden
Nero Core Components (x32 Version: 11.0.20900 - Nero AG) Hidden
Nero Launcher (x32 Version: 12.2.7000 - Nero AG) Hidden
Nero RescueAgent (x32 Version: 12.0.3001 - Nero AG) Hidden
Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden
Packard Bell Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8101 - Packard Bell)
Packard Bell Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8100 - Packard Bell)
Packard Bell Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.00.3000 - Packard Bell)
Packard Bell Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8100 - Packard Bell)
Pokki (HKCU\...\Pokki) (Version: 0.266.1.172 - Pokki)
Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.07 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.27041 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7071 - Realtek Semiconductor Corp.)
Spotify (HKLM-x32\...\Spotify) (Version: 0.9.1.57.ge7405149 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.6.13 - Synaptics Incorporated)
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729 - Microsoft Corporation) Hidden
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2014-07-20 18:19 - 00000910 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 d3oxij66pru1i3.cloudfront.net
127.0.0.1 d3oxij66pru1i3.cloudfront.net
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: C:\Windows\Tasks\GlaryInitialize 5.job => ?
Task: C:\Windows\Tasks\Uninstaller_SkipUac_Administrator.job => ?
==================== Loaded Modules (whitelisted) =============
2014-03-31 14:26 - 2013-07-30 18:11 - 00110152 _____ () C:\Program Files (x86)\Acer\clear.fi plug-in\Clearfishellext_x64.dll
2013-09-07 01:48 - 2013-09-07 01:48 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-09-07 01:45 - 2013-09-07 01:45 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-09-07 01:52 - 2013-09-07 01:52 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:373E1720
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/05/2014 05:14:03 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
System errors:
=============
Error: (08/05/2014 05:11:06 PM) (Source: DCOM) (EventID: 10010) (User: Wolkenschieber)
Description: {3EEF301F-B596-4C0B-BD92-013BEAFCE793}
Error: (08/05/2014 05:11:06 PM) (Source: DCOM) (EventID: 10010) (User: Wolkenschieber)
Description: {3EEF301F-B596-4C0B-BD92-013BEAFCE793}
Error: (08/05/2014 05:10:36 PM) (Source: DCOM) (EventID: 10010) (User: Wolkenschieber)
Description: {3EEF301F-B596-4C0B-BD92-013BEAFCE793}
Error: (08/05/2014 05:10:36 PM) (Source: DCOM) (EventID: 10010) (User: Wolkenschieber)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (08/05/2014 05:10:06 PM) (Source: DCOM) (EventID: 10010) (User: Wolkenschieber)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (08/05/2014 05:09:35 PM) (Source: DCOM) (EventID: 10010) (User: Wolkenschieber)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Microsoft Office Sessions:
=========================
Error: (08/05/2014 05:14:03 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestE:\*****\8 esetsmartinstaller_deu.exe
CodeIntegrity Errors:
===================================
Date: 2014-07-20 15:30:47.623
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-07-20 15:30:47.232
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Percentage of memory in use: 27%
Total physical RAM: 3979.34 MB
Available physical RAM: 2870.87 MB
Total Pagefile: 8075.34 MB
Available Pagefile: 6936.41 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (Packard Bell) (Fixed) (Total:448 GB) (Free:419.56 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-05 18:07:16
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000026 WDC_WD5000LPVX-22V0TT0 rev.01.01A01 465,76GB
Running: 2 Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\kwrcypod.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\System32\spoolsv.exe[1264] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffbb1cd169a 4 bytes [CD, B1, FB, 7F]
.text C:\Windows\System32\spoolsv.exe[1264] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffbb1cd16a2 4 bytes [CD, B1, FB, 7F]
.text C:\Windows\System32\spoolsv.exe[1264] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffbb1cd181a 4 bytes [CD, B1, FB, 7F]
.text C:\Windows\System32\spoolsv.exe[1264] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffbb1cd1832 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1744] C:\Windows\system32\psapi.dll!GetModuleBaseNameA + 506 00007ffbb1cd169a 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1744] C:\Windows\system32\psapi.dll!GetModuleBaseNameA + 514 00007ffbb1cd16a2 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1744] C:\Windows\system32\psapi.dll!QueryWorkingSet + 118 00007ffbb1cd181a 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1744] C:\Windows\system32\psapi.dll!QueryWorkingSet + 142 00007ffbb1cd1832 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[3252] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ffb9e3a1f6a 4 bytes [3A, 9E, FB, 7F]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[3252] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ffb9e3a1f82 4 bytes [3A, 9E, FB, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3592] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffbb1cd169a 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3592] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffbb1cd16a2 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3592] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffbb1cd181a 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3592] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffbb1cd1832 4 bytes [CD, B1, FB, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[3740] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffbb1cd169a 4 bytes [CD, B1, FB, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[3740] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffbb1cd16a2 4 bytes [CD, B1, FB, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[3740] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffbb1cd181a 4 bytes [CD, B1, FB, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[3740] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffbb1cd1832 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[3448] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffbb1cd169a 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[3448] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffbb1cd16a2 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[3448] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffbb1cd181a 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[3448] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffbb1cd1832 4 bytes [CD, B1, FB, 7F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4732] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ffb9e3a1f6a 4 bytes [3A, 9E, FB, 7F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4732] C:\Windows\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ffb9e3a1f82 4 bytes [3A, 9E, FB, 7F]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [648:676] fffff960009b5b90
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-05 18:07:34
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000026 WDC_WD5000LPVX-22V0TT0 rev.01.01A01 465.76GB
Running: 2 Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\kwrcypod.sys
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [648:676] fffff960009b5b90
---- EOF - GMER 2.1 ----
Code:
# AdwCleaner v3.302 - Bericht erstellt am 05/08/2014 um 18:09:12
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : ***** - WOLKENSCHIEBER
# Gestartet von : C:\Users\Joachim\Desktop\5 adwcleaner_3.302.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\Software\PriceMeterLiveUpdate
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17126
*************************
AdwCleaner[R1].txt - [744 octets] - [05/08/2014 18:08:06]
AdwCleaner[S1].txt - [668 octets] - [05/08/2014 18:09:12]
########## EOF - \AdwCleaner\AdwCleaner[S1].txt - [727 octets] ##########
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 05.08.2014
Suchlauf-Zeit: 18:14:04
Logdatei: 2014-08-05 MBAM.txt
Administrator: Nein
Version: 2.00.2.1012
Malware Datenbank: v2014.08.05.06
Rootkit Datenbank: v2014.08.04.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert
Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: *****
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 227553
Verstrichene Zeit: 11 Min, 17 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 0
(No malicious items detected)
Registrierungswerte: 0
(No malicious items detected)
Registrierungsdaten: 0
(No malicious items detected)
Ordner: 0
(No malicious items detected)
Dateien: 0
(No malicious items detected)
Physische Sektoren: 0
(No malicious items detected)
(end)
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 x64
Ran by Marina on 05.08.2014 at 16:59:01,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B?
Value Name Type Value Data
========================================================================================
Pokki REG_EXPAND_SZ C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\DealKeeper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\DealKeeper_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateDealKeeper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateDealKeeper_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\utilDealKeeper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\utilDealKeeper_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\DealKeeper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\DealKeeper_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateDealKeeper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateDealKeeper_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\utilDealKeeper_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\utilDealKeeper_RASMANCS
~~~ Files
~~~ Folders
Failed to delete: [Folder] "C:\ProgramData\boost_interprocess"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.08.2014 at 17:08:13,85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 x64
Ran by Marina on 05.08.2014 at 18:28:06,50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.08.2014 at 18:36:55,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vielen Dank für eure Unterstützung!
Grüße
Nico |
SecurityCheck und:
