| andrey86 | 09.12.2014 10:14 |
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-09 08:30:50 Run:1
Running from C:\Users\Andrücha\Downloads
Loaded Profile: Andrücha (Available profiles: Andrücha)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKLM\...\Run: [] => [X]
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 - ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL =
SearchScopes: HKLM -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL =
BHO: MailRuBHO Class -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
BHO: AlterGeoBHO Class -> {9BFBA68E-E21B-458E-AE12-FE85E903D2C0} -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
Toolbar: HKLM - ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ???????@Mail.Ru - {09900DE8-1DCA-443F-9243-26FF581438AF} - C:\Program Files\Mail.Ru\Sputnik\MailRuSputnik.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @altergeo.ru/Html5loc -> C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [jggbjbmnfmipgcanidamjfpechdeekoi] - No Path
CHR HKLM\...\Chrome\Extension: [nhgcieglcpdegkhamigiokdphfhhnlhh] - C:\Program Files\AlterGeo\Html5 geolocation provider\altergeo.crx [Not Found]
C:\Users\Andrücha\AppData\Local\Temp\A861.exe
C:\Users\Andrücha\AppData\Local\Temp\amigo_setup.exe
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
C:\Users\Andrücha\AppData\Local\Temp\Delta.exe
C:\Users\Andrücha\AppData\Local\Temp\ffdshow.exe
C:\Users\Andrücha\AppData\Local\Temp\GuardMailRu.exe
C:\Users\Andrücha\AppData\Local\Temp\HPQSi.exe
C:\Users\Andrücha\AppData\Local\Temp\installhelper.dll
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (1).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2).exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2)_1.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih.exe
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih_1.exe
C:\Users\Andrücha\AppData\Local\Temp\Internet_s.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv_cf5873ae.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-6u37-windows-i586-iftw_e22a15f2.exe
C:\Users\Andrücha\AppData\Local\Temp\jre-7u71-windows-i586-iftw_717d7de5.exe
C:\Users\Andrücha\AppData\Local\Temp\MailRuUpdater.exe
C:\Users\Andrücha\AppData\Local\Temp\propsys.dll
C:\Users\Andrücha\AppData\Local\Temp\Quarantine.exe
C:\Users\Andrücha\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Andrücha\AppData\Local\Temp\sqlite3.dll
C:\Users\Andrücha\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Andrücha\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Andrücha\AppData\Local\Temp\WSSetup.exe
EmptyTemp:
*****************
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
Error setting Default URLSearchHook.
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{09900DE8-1DCA-443F-9243-26FF581438AF} => value deleted successfully.
"HKCR\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key deleted successfully.
Error setting Default URLSearchHook.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}" => Key deleted successfully.
"HKCR\CLSID\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8984B388-A5BB-4DF7-B274-77B879E179DB}" => Key deleted successfully.
"HKCR\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BFBA68E-E21B-458E-AE12-FE85E903D2C0}" => Key deleted successfully.
"HKCR\CLSID\{9BFBA68E-E21B-458E-AE12-FE85E903D2C0}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{09900DE8-1DCA-443F-9243-26FF581438AF} => value deleted successfully.
"HKCR\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key not found.
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{09900DE8-1DCA-443F-9243-26FF581438AF} => value deleted successfully.
"HKCR\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key not found.
HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{{09900DE8-1DCA-443F-9243-26FF581438AF} => Value not found.
"HKCR\CLSID\Toolbar: HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{{09900DE8-1DCA-443F-9243-26FF581438AF}" => Key not found.
"HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\MozillaPlugins\@altergeo.ru/Html5loc" => Key deleted successfully.
C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll not found.
"HKU\S-1-5-21-2119122295-1896836890-182237168-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\MozillaPlugins\@altergeo.ru/Html5loc" => Key not found.
C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\npHtml5loc.dll not found.
C:\Program Files\mozilla firefox\browser\searchplugins\Ask.xml => Moved successfully.
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found] => not found.
"HKLM\SOFTWARE\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi" => Key deleted successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\nhgcieglcpdegkhamigiokdphfhhnlhh" => Key deleted successfully.
C:\Users\Andrücha\AppData\Local\Temp\A861.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\amigo_setup.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\Delta.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\ffdshow.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\GuardMailRu.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\HPQSi.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\installhelper.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (1).exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2).exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih (2)_1.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\install_flashplayer11x32_chra_aih_1.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\Internet_s.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv_cf5873ae.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\jre-6u37-windows-i586-iftw_e22a15f2.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\jre-7u71-windows-i586-iftw_717d7de5.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\MailRuUpdater.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\propsys.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\SRAssetsHelper.dll => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\vcredist_x86.exe => Moved successfully.
C:\Users\Andrücha\AppData\Local\Temp\WSSetup.exe => Moved successfully.
EmptyTemp: => Removed 900.1 MB temporary data.
The system needed a reboot.
==== End of Fixlog ====
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-12-2014 01
Ran by Andrücha (administrator) on ANDRÜCHA-PC on 09-12-2014 09:06:44
Running from C:\Users\Andrücha\Downloads
Loaded Profile: Andrücha (Available profiles: Andrücha)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\WINDOWS\System32\nvvsvc.exe
(IDT, Inc.) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
(Microsoft Corporation) C:\WINDOWS\System32\SLsvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\rundll32.exe
(Hewlett-Packard Corporation) C:\WINDOWS\System32\hpservice.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\WINDOWS\System32\mobsync.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
() C:\WINDOWS\SMINST\BLService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TomTom) C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehmsas.exe
(Avira) C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\WINDOWS\System32\wuauclt.exe
(Microsoft Corporation) C:\WINDOWS\System32\taskmgr.exe
(Microsoft Corporation) C:\WINDOWS\System32\conime.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe [144784 2008-03-25] (Sun Microsystems, Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-11-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [124208 2014-10-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [AlterGeoUpdater] => C:\ProgramData\AlterGeo\Update for Html5 geolocation provider\html5locsvc.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-12-07] (Avira)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2119122295-1896836890-182237168-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mail.ru/cnt/7227
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
URLSearchHook: [S-1-5-21-2119122295-1896836890-182237168-1000] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKU\S-1-5-21-2119122295-1896836890-182237168-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?utf8in=1&fr=ietb&q={SearchTerms}
BHO: SSVHelper Class -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2119122295-1896836890-182237168-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\searchplugins\vkontakteru-audiosearch.xml
FF Extension: Avira Browser Safety - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\abs@avira.com [2014-11-19]
FF Extension: HTML5 location provider - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{B100D0FF-0001-8CE4-2790-AACE49B8AE35} [2014-03-25]
FF Extension: VKontakte.ru MP3 Музыка Качалка - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\ffvkontaktemusic@chupakabr.ru.xpi [2014-09-09]
FF Extension: Vkontakte Download - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\support@videoadd.ru.xpi [2014-09-09]
FF Extension: ВКонтакте.ру Downloader - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\vk@sergeykolosov.mp.xpi [2011-10-08]
FF Extension: Adblock Plus - C:\Users\Andrücha\AppData\Roaming\Mozilla\Firefox\Profiles\tsk69bmo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-31]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-03-06]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-10-08]
FF Extension: No Name - {20a82645-c095-46ed-80e3-08825760534b} [Not Found]
Chrome:
=======
CHR Profile: C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Mail.Ru) - C:\Users\Andrücha\AppData\Local\Google\Chrome\User Data\Default\Extensions\jggbjbmnfmipgcanidamjfpechdeekoi [2014-11-17]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [77824 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [993584 2014-11-19] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [164656 2014-10-22] (Avira Operations GmbH & Co. KG)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed]
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-04-15] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [File not signed]
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [292216 2008-06-25] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [116080 2008-06-25] ()
R2 Recovery Service for Windows; C:\Windows\SMINST\BLService.exe [361808 2008-04-26] ()
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe [221273 2008-06-27] (IDT, Inc.)
R2 TomTomHOMEService; C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-04-22] (TomTom)
S3 usnjsvc; C:\Program Files\MSN Messenger\usnsvc.exe [97136 2007-01-19] (Microsoft Corporation)
S2 Guard.Mail.ru; "C:\Program Files\Mail.Ru\Guard\GuardMailRu.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-11-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
U1 eabfiltr; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-09 09:02 - 2014-12-09 09:02 - 02347384 _____ (ESET) C:\Users\Andrücha\Downloads\esetsmartinstaller_deu.exe
2014-12-08 10:11 - 2014-12-08 10:11 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-12-08 09:48 - 2014-12-09 09:04 - 00025506 _____ () C:\Users\Andrücha\Downloads\Addition.txt
2014-12-08 09:47 - 2014-12-09 09:06 - 00013048 _____ () C:\Users\Andrücha\Downloads\FRST.txt
2014-12-08 09:47 - 2014-12-09 09:06 - 00000000 ____D () C:\FRST
2014-12-08 09:47 - 2014-12-08 09:47 - 01111040 _____ (Farbar) C:\Users\Andrücha\Downloads\FRST.exe
2014-12-08 09:34 - 2014-12-08 09:34 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\AviraSpeedup
2014-12-07 21:27 - 2014-12-07 21:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-12-07 21:20 - 2014-12-07 21:20 - 00000000 ____D () C:\Windows\ERUNT
2014-12-07 20:57 - 2014-12-08 20:22 - 00000000 ____D () C:\AdwCleaner
2014-12-07 20:57 - 2014-12-08 20:20 - 00000220 _____ () C:\AdwCleanerDebug.txt
2014-12-07 20:35 - 2014-12-08 20:56 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-07 20:35 - 2014-12-07 20:35 - 00000901 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-07 20:35 - 2014-12-07 20:35 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-12-07 20:35 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-07 20:35 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-07 20:31 - 2014-12-07 20:31 - 02153472 _____ () C:\Users\Andrücha\Downloads\AdwCleaner_4.104.exe
2014-12-07 20:31 - 2014-12-07 20:31 - 01707646 _____ (Thisisu) C:\Users\Andrücha\Downloads\JRT.exe
2014-12-07 20:29 - 2014-12-07 20:30 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Andrücha\Downloads\mbam-setup-2.0.4.1028.exe
2014-11-19 18:33 - 2014-12-09 08:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-19 18:33 - 2014-11-26 15:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-19 18:33 - 2014-11-19 18:33 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Macromedia
2014-11-19 18:09 - 2014-11-23 17:57 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-11-19 18:09 - 2014-11-19 18:09 - 00001894 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-11-19 18:08 - 2014-11-19 18:08 - 00000000 ____D () C:\Program Files\Adobe
2014-11-19 18:06 - 2014-11-19 18:06 - 01055952 _____ (Adobe) C:\Users\Andrücha\Downloads\install_reader10_de_mssa_aaa_aih.exe
2014-11-19 15:05 - 2014-11-19 15:05 - 01055936 _____ (Adobe) C:\Users\Andrücha\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-09 09:03 - 2006-11-02 11:33 - 01445310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-09 09:01 - 2011-10-06 13:17 - 01382089 _____ () C:\Windows\WindowsUpdate.log
2014-12-09 08:57 - 2013-04-18 20:07 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-09 08:57 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.dat
2014-12-09 08:57 - 2011-10-06 13:34 - 00192964 _____ () C:\ProgramData\nvModes.001
2014-12-09 08:56 - 2013-04-18 20:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-12-09 08:56 - 2008-01-21 03:47 - 00274048 _____ () C:\Windows\PFRO.log
2014-12-09 08:56 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-09 08:56 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-09 08:56 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-09 08:55 - 2008-07-31 21:52 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-09 08:55 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-08 10:11 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-08 10:09 - 2012-06-01 11:59 - 00000986 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job
2014-12-07 21:26 - 2013-11-03 19:12 - 00000000 ____D () C:\Program Files\Avira
2014-12-03 19:18 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing
2014-11-30 13:09 - 2012-06-01 11:59 - 00000964 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job
2014-11-26 15:53 - 2011-10-08 14:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-24 14:04 - 2011-10-07 13:02 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-20 19:33 - 2006-11-02 13:52 - 00149443 _____ () C:\Windows\setupact.log
2014-11-20 19:15 - 2008-07-31 23:19 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-20 19:14 - 2013-03-24 14:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-19 18:33 - 2012-08-20 14:35 - 00000000 ____D () C:\Users\Andrücha\AppData\Local\Adobe
2014-11-19 18:29 - 2014-03-06 16:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-19 18:12 - 2011-10-06 13:58 - 00000000 ____D () C:\Users\Andrücha\AppData\Roaming\Adobe
2014-11-19 18:09 - 2008-07-31 23:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-11-19 15:00 - 2013-08-01 23:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-19 14:55 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-11-19 14:51 - 2012-01-08 18:40 - 00000000 ____D () C:\ProgramData\Guard.Mail.Ru
Some content of TEMP:
====================
C:\Users\Andrücha\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-09 09:04
==================== End Of Log ============================
--- --- --- Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-12-2014 01
Ran by Andrücha at 2014-12-09 09:07:08
Running from C:\Users\Andrücha\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.115.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
Avira (HKLM\...\{9480d4af-12b9-4e56-8034-4031ef6ab39d}) (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.25.25607 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.342 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C1500}) (Version: 12.21.0.3975 - APN, LLC)
Avira System Speedup (HKLM\...\AviraSpeedup) (Version: 1.3.1.9970 - Avira System Speedup)
Canon Utilities Digital Photo Professional 3.10 (HKLM\...\DPP) (Version: 3.10.2.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.10.2.0 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.9.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
CleanUp! (HKLM\...\CleanUp!) (Version: - )
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
ESU for Microsoft Vista (HKLM\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
ffdshow v1.2.4422 [2012-04-09] (HKLM\...\ffdshow_is1) (Version: 1.2.4422.0 - FreeCodecPack)
Free Mp3 Wma Converter V 2.2 (HKLM\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Guard.Mail.ru (HKLM\...\Guard.Mail.ru) (Version: - Mail.ru) <==== ATTENTION
Hewlett-Packard Active Check for Health Check (Version: 1.1.15.2 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.63.2 - HP) Hidden
HP Customer Experience Enhancements (HKLM\...\{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Easy Setup - Frontend (HKLM\...\{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}) (Version: 5.7.0.2630 - Hewlett-Packard)
HP Help and Support (HKLM\...\{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}) (Version: 2.0.9.0 - Hewlett-Packard)
HP Integrated Module with Bluetooth wireless technology 6.0.1.6204 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.6204 - HP)
HP Quick Launch Buttons 6.40 D1 (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 D1 - Hewlett-Packard)
HP QuickPlay 3.7 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version: - Hewlett-Packard)
HP QuickTouch 1.00 D2 (HKLM\...\{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}) (Version: 1.0.9 - Hewlett-Packard)
HP Total Care Advisor (HKLM\...\{f32502b5-5b64-4882-bf61-77f23edcac4f}) (Version: 2.1.3359.2635 - Hewlett-Packard)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP User Guides 0103 (HKLM\...\{B8169E45-8E23-430B-91D1-EC64540C8ED0}) (Version: 1.01.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{340F521E-3576-4E1A-B75C-EB0ACF751379}) (Version: 3.00 J1 - Hewlett-Packard)
HPNetworkAssistant (Version: 1.1.70 - Hewlett-Packard.) Hidden
Html5 geolocation provider (HKLM\...\{12644DC5-2271-442B-816F-8CFFD3DDDF32}) (Version: 3.5.4.872 - AlterGeo)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6017.13 - IDT)
Java(TM) 6 Update 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160060}) (Version: 1.6.0.60 - Sun Microsystems, Inc.)
JMicron JMB38X Flash Media Controller (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.16.01 - JMicron Technology Corp.)
LightScribe System Software 1.12.33.2 (HKLM\...\{582287DA-0806-4AC0-BF19-C15E3A466034}) (Version: 1.12.33.2 - LightScribe)
Mail.Ru Агент 5.10 (сборка 5308, для всех пользователей) (HKLM\...\MRA) (Version: - Mail.Ru) <==== ATTENTION
Mail.Ru Агент 6.0 (сборка 5831, для текущего пользователя) (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\MRA) (Version: - Mail.Ru) <==== ATTENTION
Mail.Ru Спутник 2.4.1.44 (HKLM\...\MailRuSputnik) (Version: - Mail.Ru) <==== ATTENTION
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.43 - WildTangent)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
Opera 12.13 (HKLM\...\Opera 12.13.1734) (Version: 12.13.1734 - Opera Software ASA)
Power MP3 WMA Converter 2006, (ver 3.42) (HKLM\...\Power MP3 WMA Converter_is1) (Version: 3.42 - CooolSoft, Inc.)
ProtectSmart Hard Drive Protection (HKLM\...\{CB71A20E-B1B4-4562-81FA-33E1DBD0342F}) (Version: 3.10 A7 - Hewlett-Packard)
QuickPlay SlingPlayer 0.4.6 (HKLM\...\SlingMedia.QPSlingPlayer_is1) (Version: 0.4.6 - SlingMedia)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.3.11079 - Skype Technologies S.A.)
Skype™ 6.0 (HKLM\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.126 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.2.4.0 - Synaptics)
TomTom HOME 2.8.2.2264 (HKLM\...\TomTom HOME) (Version: 2.8.2.2264 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for Html5 geolocation provider (HKLM\...\{45BECC2D-582C-472D-A754-E2AD10706397}) (Version: 3.5.2.858 - AlterGeo)
Update for Html5 geolocation provider (HKLM\...\{D492942E-9368-48D9-BB8B-68E8E4CE2D43}) (Version: 3.7.6.911 - AlterGeo)
Update for Office 2007 (KB934528) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{2B939677-2FFD-48F6-9075-7BF48CB87C80}) (Version: - )
VKontakte (HKU\S-1-5-21-2119122295-1896836890-182237168-1000\...\VKontakte) (Version: - Andrew Rogozov)
Windows Live Messenger (HKLM\...\{279DB581-239C-4E13-97F8-0F48E40BE75C}) (Version: 8.1.0178.00 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2119122295-1896836890-182237168-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Andrücha\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
==================== Restore Points =========================
19-10-2013 15:03:39 Windows Update
22-10-2013 17:31:53 Windows Update
29-10-2013 18:55:33 Windows Update
31-10-2013 19:08:07 Installed Adobe Reader XI.
31-10-2013 19:12:48 Installed Adobe Reader XI.
01-11-2013 18:44:05 Windows Update
05-11-2013 20:28:15 Installed Adobe Reader XI.
16-11-2013 17:06:56 Windows Update
15-12-2013 20:52:29 Windows Update
26-01-2014 14:03:00 Windows Update
09-02-2014 18:20:47 PC Performer So, Feb 09, 14 19:20
14-02-2014 13:54:13 Windows Update
17-03-2014 19:06:00 Installed Adobe Reader XI.
23-03-2014 12:39:27 Windows Update
11-04-2014 12:37:07 Windows Update
14-05-2014 19:19:36 Windows Update
14-06-2014 22:46:50 Windows Update
10-07-2014 18:02:30 Windows Update
16-08-2014 16:00:04 Windows Update
31-08-2014 10:05:45 Removed Facebook Video Calling 3.1.0.521
10-09-2014 15:56:36 Windows Update
17-11-2014 19:16:22 Windows Update
19-11-2014 13:54:53 Windows Update
07-12-2014 20:25:39 Avira System Speedup(1.3.1.9970)
07-12-2014 20:28:50 Windows Update
09-12-2014 07:45:13 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1F286ADE-039E-474D-8EF2-83C14C3CFA0F} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-04-15] (Hewlett-Packard)
Task: {324F6E3C-D83B-431F-BD8A-D240B2CAB216} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
Task: {65349617-D6AF-4DA0-B523-2EFCC6B3BB54} - System32\Tasks\AviraSpeedup => C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe [2014-12-07] (Avira)
Task: {6E1CF2A5-F9D9-46D5-B68E-D6A811E76CDF} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {C163C141-F757-4156-8BE3-AEF8AEE4217C} - System32\Tasks\{6F3DAAC4-5DFC-4603-933B-572D9826C258} => Chrome.exe hxxp://ui.skype.com/ui/0/5.10.0.116/ru/abandoninstall?page=tsProgressBar
Task: {E5724EA0-F9B1-44B9-8EE9-8C85044BF062} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {FAD4286E-AA44-4B22-93DC-0231985E42AE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000Core.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2119122295-1896836890-182237168-1000UA.job => C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForAndrьcha.job => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{5FD033D5-882A-4E63-8500-180E11B1449B}.job => C:\Windows\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) =============
2008-07-31 22:31 - 2008-06-25 21:36 - 00292216 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
2008-07-31 22:31 - 2008-06-25 21:36 - 00259480 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00038184 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
2008-07-31 22:31 - 2008-06-25 21:36 - 00116080 _____ () C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
2008-07-31 23:35 - 2008-04-26 00:15 - 00361808 _____ () C:\Windows\SMINST\BLService.exe
2008-07-31 23:35 - 2007-11-15 00:46 - 00126976 _____ () C:\Windows\SMINST\STWmiM.dll
2008-07-31 22:30 - 2008-06-25 21:34 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2014-03-06 16:38 - 2014-11-19 18:29 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk => C:\Windows\pss\BTTray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Andrücha^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AlterGeoUpdater => C:\Program Files\AlterGeo\Html5 geolocation provider\html5locsvc.exe
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Andrücha\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpWirelessAssistant => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
MSCONFIG\startupreg: iLivid => "C:\Users\Andrücha\AppData\Local\iLivid\iLivid.exe" -autorun
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MAgent => C:\Program Files\Mail.Ru\Agent\magent.exe -LM
MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: OnScreenDisplay => C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QPService => "C:\Program Files\HP\QuickPlay\QPService.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => %ProgramFiles%\IDT\WDM\sttray.exe
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Users\Andrücha\Desktop\LKW-PKW\TomTom HOME 2\TomTomHOMERunner.exe"
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
========================= Accounts: ==========================
Administrator (S-1-5-21-2119122295-1896836890-182237168-500 - Administrator - Disabled)
Andrücha (S-1-5-21-2119122295-1896836890-182237168-1000 - Administrator - Enabled) => C:\Users\Andrücha
Gast (S-1-5-21-2119122295-1896836890-182237168-501 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/09/2014 09:06:29 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 16e8
Anfangszeit: 01d013866bbc7bc5
Zeitpunkt der Beendigung: 52765
Error: (12/09/2014 09:06:09 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.0.6001.18164 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 660
Anfangszeit: 01d01385b32a9335
Zeitpunkt der Beendigung: 60000
Error: (12/09/2014 09:01:57 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST.exe, Version 7.12.2014.1 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 126c
Anfangszeit: 01d013860b0a4d75
Zeitpunkt der Beendigung: 2
Error: (12/09/2014 08:58:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/09/2014 06:29:44 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (12/09/2014 06:29:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Fehlerhafte Anwendung QPSched.exe, Version 5.0.0.2922, Zeitstempel 0x48353a4d, fehlerhaftes Modul QPSched.exe, Version 5.0.0.2922, Zeitstempel 0x48353a4d, Ausnahmecode 0xc0000005, Fehleroffset 0x00007684,
Prozess-ID 0x95c, Anwendungsstartzeit QPSched.exe0.
System errors:
=============
Error: (12/09/2014 08:58:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (12/09/2014 08:57:56 AM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error: (12/09/2014 08:57:56 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
Error: (12/09/2014 08:56:52 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos
Error: (12/09/2014 08:25:28 AM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: Die DHCP-Zuweisung wurde für IP-Adresse 192.168.178.54 deaktiviert, da die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt, von der die Adressen DHCP-Clients zu gewiesen werden. Ändern Sie den Bereich, sodass die IP-Adresse mit einbezogen wird, oder ändern Sie die IP-Adresse, sodass sie innerhalb dieses Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
Error: (12/09/2014 08:25:28 AM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
Error: (12/09/2014 08:24:59 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: QuickPlay Task Scheduler (QTS)1
Error: (12/09/2014 06:29:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (12/09/2014 06:29:20 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-12-09 09:07:03.926
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:07:03.858
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:07:03.797
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:07:03.733
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:07:03.568
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:07:03.501
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:07:03.440
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:07:03.354
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:06:52.446
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-12-09 09:06:52.390
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Percentage of memory in use: 44%
Total physical RAM: 3068.03 MB
Available physical RAM: 1696.3 MB
Total Pagefile: 6341.08 MB
Available Pagefile: 4769.44 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.31 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:289.06 GB) (Free:208.15 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:298.09 GB) (Free:283.14 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:9.03 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 133E133E)
Partition 1: (Active) - (Size=289.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=9 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 9DC051CF)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ec8d9aaf38d16d4b9ebfb1d597adc466
# engine=21464
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-09 08:17:12
# local_time=2014-12-09 09:17:12 (+0100, Mitteleuropäische Zeit)
# country="Russia"
# lang=1031
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 6386 36684190 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 5038 255645760 0 0
# scanned=10405
# found=3
# cleaned=0
# scan_time=344
sh=DC2F44E408378C231AFA4D5E0BC65855573FA17D ft=1 fh=576bb7911dc12d10 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\iLivid\Helper.dll.vir"
sh=97200776036142F9D86A9E159FFB02F266065E78 ft=1 fh=2d9d215ea2994e2e vn="Variante von Win32/Toolbar.SearchSuite.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\torch\Helper.dll.vir"
sh=6EF4B349F23F2B83D07BAAFF09F65ED63482818C ft=1 fh=c71c001182c4fa88 vn="Variante von Win32/Toolbar.SearchSuite.Z evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Andrücha\AppData\Local\Temp\installhelper.dll.xBAD"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ec8d9aaf38d16d4b9ebfb1d597adc466
# engine=21464
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-09 09:09:53
# local_time=2014-12-09 10:09:53 (+0100, Mitteleuropäische Zeit)
# country="Russia"
# lang=1031
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 5947 36687351 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776573 100 100 4599 255648921 0 0
# scanned=158488
# found=9
# cleaned=0
# scan_time=3114
sh=DC2F44E408378C231AFA4D5E0BC65855573FA17D ft=1 fh=576bb7911dc12d10 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\iLivid\Helper.dll.vir"
sh=97200776036142F9D86A9E159FFB02F266065E78 ft=1 fh=2d9d215ea2994e2e vn="Variante von Win32/Toolbar.SearchSuite.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Andrücha\AppData\Local\torch\Helper.dll.vir"
sh=6EF4B349F23F2B83D07BAAFF09F65ED63482818C ft=1 fh=c71c001182c4fa88 vn="Variante von Win32/Toolbar.SearchSuite.Z evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Andrücha\AppData\Local\Temp\installhelper.dll.xBAD"
sh=64011682BF5F058CFE85661A38D03560E1E42712 ft=0 fh=0000000000000000 vn="INF/Autorun.gen Wurm" ac=I fn="E:\AUTORUN.INF"
sh=725F8FB6802AB9736A294EE4BA5D12B85413A9C7 ft=1 fh=60b1a670b66fa197 vn="Variante von Win32/ShipUp.NAJ Trojaner" ac=I fn="E:\keybd.exe"
sh=725F8FB6802AB9736A294EE4BA5D12B85413A9C7 ft=1 fh=60b1a670b66fa197 vn="Variante von Win32/ShipUp.NAJ Trojaner" ac=I fn="E:\msdn\KB914268-inf.log"
sh=27CADB87E4739D62070B050F272B84B01C0D5A4C ft=1 fh=653eeaf13d1b8ddf vn="Win32/ShipUp.NAH Trojaner" ac=I fn="E:\msdn\KB925273-dir.log"
sh=E04BD50B33C5149F2F9DF0A843A760680DE4DC1A ft=1 fh=a9d0e49a4d0eb69c vn="Win32/Small.BXO Trojaner" ac=I fn="E:\msdn\KB936891-doc.log"
sh=53BAD53092A0F97305F02A46957F05C512322474 ft=1 fh=bee555219d80b6c1 vn="Win32/AutoRun.Agent.NT Wurm" ac=I fn="E:\XP-Update\KB877527-ldup.log"
Zu der 4ten Frage:
Das System läuft nicht stabil, die Mailwareentfernung Programme muss ich teilweise 3x starten, da dass system ständig einfriert. |
FRST 32-Bit | FRST 64-Bit
AdwCleaner auf deinen Desktop.
Malwarebytes Anti-Malware 
