| davide0308 | 10.02.2015 14:17 |
Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden!
Sehr geehrtes Trojaner-Board Team!
Erstmal vielen lieben Dank dafür, dass Sie hier den support anbieten!
Zum Problem:
Gestern habe ich mehrere Bedrohungen eingefangen. Diese habe ich versucht mit diversen Programmen zu entfernen.
Nun habe ich mit malwarebytes mehr ale 200 Bedrohungen gefunden. Daraufhin habe ich Ihre Regeln befolgt und die Analyse mit den Programmen "defogger, FRST und Gmer" durchgeführt. Die entsprechenden log-Dateien, sowie die log-Datei von malwarebytes stelle ich nachfolgend ins Forum mit der großen Bitte mir eventl. hierzu weiter zu helfen.
Vielen DANK und Grüße
davide0308 Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 10.02.2015
Suchlauf-Zeit: 11:16:31
Logdatei: Malware_10_02_2015.txt
Administrator: Ja
Version: 2.00.4.1028
Malware Datenbank: v2015.02.10.06
Rootkit Datenbank: v2015.02.03.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Da Wee
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 382489
Verstrichene Zeit: 30 Min, 10 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert
Prozesse: 4
PUP.Optional.WindowsProtectManger.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 1540, , [3a94c4586822de5809bf6600659b3fc1]
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, 2108, , [efdf48d44e3c5dd90707fd0d3fc338c8]
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\CmdShell.exe, 4800, , [329c0a1284065adcca821b726c9714ec]
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\HPNotify.exe, 5060, , [329c0a1284065adcca821b726c9714ec]
Module: 9
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowerWatchFF.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowserAction.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\IeWatchDog.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec],
Registrierungsschlüssel: 9
PUP.Optional.WindowsProtectManger.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, , [3a94c4586822de5809bf6600659b3fc1],
PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, , [efdf48d44e3c5dd90707fd0d3fc338c8],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [537bb16b8406f4429e8719ee28db936d],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [537bb16b8406f4429e8719ee28db936d],
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, , [19b551cbb7d3231390bb830a4cb74ab6],
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\mystartsearchSoftware, , [65697f9da3e776c09491eaaba45f14ec],
PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, , [953956c6b0dad0669f0cd82fb451fb05],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, , [894524f8d9b1d0660511c2e18d767789],
PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, , [06c853c9e1a9d0660d3eb1e7b94a06fa],
Registrierungswerte: 2
PUP.Optional.FFToolbar.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fftoolbar2014@etech.com, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com, , [8b436ab20d7d85b1509585071be8ac54]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, smt, , [894524f8d9b1d0660511c2e18d767789]
Registrierungsdaten: 14
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[69658e8e038745f1678066467d889868]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[fad4fb21d8b2eb4bd9587f2e46bfe719]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[834b809c8307ea4ce64abbf27b8a728e]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[c40a58c4a4e673c308b11b9f51b458a8]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[a727bc6092f836001b17fdb03dc8649c]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[2ca29b81098137ff65821f8db64f22de]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[725ca874d3b7c373a78aab02fc09e41c]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[379726f6f39745f10b2504a99075d52b]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[7f4f5dbfc4c6fb3bd4e5308a38cd9868]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[4c82e03c0585e94dbd75e7c658ad6799]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[7a5485971a703afc1a9d7d3d09fcfb05]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[488619037f0b58de83b0f4b99f66be42]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[5e7061bbe1a9c76fd85d04a964a1f50b]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[8648e23a96f48ea8e054a10c1de8e818]
Ordner: 40
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\image, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\weather, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MindSpark.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\FromDocToPDF_65, , [e1edc953d9b1ab8bbbb544157c87a25e],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, , [fdd12af296f492a484d90d5aa3606f91],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, , [fdd12af296f492a484d90d5aa3606f91],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, , [a6283ae258326dc93aca6a1a2ad9ad53],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, , [a6283ae258326dc93aca6a1a2ad9ad53],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\content, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\skin, , [339b0f0d92f8ba7c959df98b6b98a65a],
Dateien: 124
PUP.Optional.WindowsProtectManger.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, , [3a94c4586822de5809bf6600659b3fc1],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, , [efdf48d44e3c5dd90707fd0d3fc338c8],
PUP.Optional.SupTab.A, C:\Program Files (x86)\XTab\SupTab.dll, , [537bb16b8406f4429e8719ee28db936d],
PUP.Optional.OpenCandy, C:\$Recycle.Bin\S-1-5-21-206210334-1080461088-3002721162-1002\$RXXSV1E.exe, , [339b74a8e2a843f3b2b17966dc29847c],
PUP.Optional.Wajam.A, C:\Users\Da Wee\AppData\Local\Temp\E0A3.tmp, , [7a5447d5d0bab87e7a650d0adb278080],
PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nse2813.tmp, , [a02ecb516a20e35395940a1652b39070],
PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nsi42A5.tmp, , [a5299587fd8d75c1e44557c94db8629e],
PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nso39BB.tmp, , [a727d4486b1f0e287faaa67a07feac54],
PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nsvF023.tmp, , [b01ee13ba8e2bb7bec3d61bfc93c5fa1],
PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\bitool.dll, , [21ade9330585e551728c8d3580827e82],
PUP.Optional.Wajam.A, C:\Users\Da Wee\AppData\Local\Temp\3307.tmp, , [c40ac15b5931da5c2cb31007c63ca858],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Local\Temp\setup.exe, , [25a99e7e65258ea86028d31e11f4768a],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\uninstall.exe, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowerWatchCH.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowerWatchFF.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowserAction.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\CmdShell.exe, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\conf, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\HPNotify.exe, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\IeWatchDog.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\install.data, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\searchProvider.xml, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about_bk.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn_apply.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\close.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf.xml, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf_back.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\input_bk.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\logo.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\main.xml, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_1.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_2.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\rigth_arrow.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\settings.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\data.html, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE.html, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE8.html, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\main.css, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\ver.txt, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\arrow.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\default_add_logo.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\default_add_logo_hover.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\default_logo.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\googlelogo.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\googlelogo2.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\google_trends.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon128.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon16.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon48.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\loading.gif, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\logo32.ico, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\weather\0.png, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\common.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\ga.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\ie8.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery-1.11.0.min.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery.autocomplete.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\js.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\library.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit-ie8.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit2.0.js, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW\messages.json, , [329c0a1284065adcca821b726c9714ec],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\MessageBox.xml, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\422.json, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\uninstallDlg2.xml, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\UninstallManager.exe, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\bg.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\bg1.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\bk_shadow.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\button.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\button1.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\checkbox.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\checkbox_select.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\checked.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\close.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\loading_bg.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\loading_light.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\min.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\scrollbar.bmp, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\Thumbs.db, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\unchecked.png, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code1.jpg, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code2.jpg, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code3.jpg, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code4.jpg, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code5.jpg, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code6.jpg, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\Thumbs.db, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log\UninstallManager_2015-02-09[17-53-28-696].log, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log\UninstallManager_2015-02-09[17-54-03-617].log, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log\UninstallManager_2015-02-09[18-19-14-329].log, , [616d83997713c96d1b74ade5709306fa],
PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\searchplugins\mystartsearch.xml, , [775779a32466162041e3791ca162b24e],
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, , [fdd12af296f492a484d90d5aa3606f91],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update\conf, , [a6283ae258326dc93aca6a1a2ad9ad53],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome.manifest, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\install.rdf, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.xul, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\skin\icon.png, , [339b0f0d92f8ba7c959df98b6b98a65a],
PUP.Optional.QuickStart.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), ,[7e50b16ba1e9af878276f6fdf80de61a]
Physische Sektoren: 0
(Keine schädliche Elemente erkannt)
(end)
defogger Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:16 on 10/02/2015 (Da Wee)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by Da Wee (administrator) on DAWEE-PC on 10-02-2015 12:21:59
Running from C:\Users\Da Wee\Downloads
Loaded Profiles: UpdatusUser & Da Wee & (Available profiles: UpdatusUser & Da Wee)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(XTab system) C:\Program Files (x86)\XTab\ProtectService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
() C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(SearchProtect) C:\Program Files (x86)\XTab\CmdShell.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(XTab system) C:\Program Files (x86)\XTab\HPNotify.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\Da Wee\Downloads\Defogger.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] => C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-08-26] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-01] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-206210334-1080461088-3002721162-1000\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-206210334-1080461088-3002721162-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2015-02-01] (SUPERAntiSpyware)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2015-02-01] (SUPERAntiSpyware)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [241984 2011-10-16] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-16] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:53101;https=127.0.0.1:53101
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346
FireFox:
========
FF ProfilePath: C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: mystartsearch
FF SelectedSearchEngine: mystartsearch
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-206210334-1080461088-3002721162-1002: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\searchplugins\mystartsearch.xml
FF Extension: FF Toolbar - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\fftoolbar2014@etech.com [2015-02-09]
FF Extension: [verify-U]-Add-on - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\verify-u_2@cybits.de [2012-11-18]
FF Extension: Garmin Communicator - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-02-01]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-02-01]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2015-02-01]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-13] (SUPERAntiSpyware.com)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [487056 2015-02-09] (SysTool PasSame LIMITED)
S2 [verify-U]; C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-10] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S1 [verify-U]_System; C:\Windows\SysWOW64\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG) [File not signed]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-10 12:21 - 2015-02-10 12:22 - 00025151 _____ () C:\Users\Da Wee\Downloads\FRST.txt
2015-02-10 12:21 - 2015-02-10 12:22 - 00000000 ____D () C:\FRST
2015-02-10 12:20 - 2015-02-10 12:20 - 02132992 _____ (Farbar) C:\Users\Da Wee\Downloads\FRST64.exe
2015-02-10 12:16 - 2015-02-10 12:16 - 00000474 _____ () C:\Users\Da Wee\Downloads\defogger_disable.log
2015-02-10 12:16 - 2015-02-10 12:16 - 00000000 _____ () C:\Users\Da Wee\defogger_reenable
2015-02-10 12:15 - 2015-02-10 12:15 - 00050477 _____ () C:\Users\Da Wee\Downloads\Defogger.exe
2015-02-10 11:49 - 2015-02-10 11:50 - 00000000 ____D () C:\Users\Da Wee\Desktop\Sicherung
2015-02-10 11:15 - 2015-02-10 11:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-10 11:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-10 11:15 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-10 11:13 - 2015-02-10 11:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Da Wee\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-09 19:15 - 2015-02-10 10:24 - 00003272 _____ () C:\Windows\PFRO.log
2015-02-09 19:15 - 2015-02-10 10:24 - 00000112 _____ () C:\Windows\setupact.log
2015-02-09 19:15 - 2015-02-09 19:15 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-09 19:14 - 2015-02-09 19:14 - 00000789 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 02-09-2015 - 19-07-30.log
2015-02-09 18:04 - 2015-02-09 18:04 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Apps\2.0
2015-02-09 16:48 - 2015-02-09 16:48 - 00000000 ____D () C:\Users\Da Wee\Documents\SICHERUNG
2015-02-09 15:36 - 2015-02-09 15:36 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-02-09 15:35 - 2015-02-09 18:19 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-02-09 15:35 - 2015-02-09 15:35 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-02-09 15:34 - 2015-02-09 18:21 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\mystartsearch
2015-02-09 15:32 - 2015-02-09 16:44 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\DAEMON Tools Lite
2015-02-09 15:30 - 2015-02-09 16:31 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2015-02-09 13:32 - 2015-02-09 13:32 - 00002148 _____ () C:\Users\Public\Desktop\WISO steuer Start 2015.lnk
2015-02-09 13:29 - 2015-02-09 13:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO steuer Start 2015
2015-02-01 10:30 - 2015-02-01 10:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-16 20:12 - 2015-01-16 20:12 - 00001597 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 01-16-2015 - 20-04-49.log
2015-01-16 19:48 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-16 19:48 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-16 19:48 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-16 19:48 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-16 19:48 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-16 19:48 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-16 19:47 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-16 19:47 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-16 19:47 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-16 19:47 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-16 19:47 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-16 19:47 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-16 19:47 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-10 12:16 - 2012-02-03 20:35 - 00000000 ____D () C:\Users\Da Wee
2015-02-10 11:52 - 2011-11-17 13:03 - 01070415 _____ () C:\Windows\WindowsUpdate.log
2015-02-10 11:37 - 2012-07-06 20:10 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\Malwarebytes
2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2015-02-10 10:41 - 2012-02-03 21:11 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-02-10 10:39 - 2013-08-27 20:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-02-10 10:34 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-10 10:34 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-10 10:27 - 2012-02-04 10:35 - 00000000 ____D () C:\ProgramData\clear.fi
2015-02-10 10:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-09 18:21 - 2012-02-03 21:03 - 00001146 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-09 18:21 - 2012-02-03 21:03 - 00001134 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-09 18:21 - 2012-02-03 20:39 - 00001425 _____ () C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-09 18:18 - 2011-11-17 21:55 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-02-09 18:18 - 2011-11-17 21:55 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-02-09 18:18 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-09 16:37 - 2012-02-05 22:07 - 00000793 _____ () C:\Windows\wiso.ini
2015-02-09 13:39 - 2012-02-05 21:18 - 00000000 ____D () C:\Users\Da Wee\Documents\Steuer
2015-02-09 13:24 - 2012-02-05 21:57 - 00000000 ____D () C:\Program Files (x86)\WISO
2015-02-09 13:24 - 2011-10-14 04:15 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-09 10:24 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-06 18:20 - 2012-02-03 21:22 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-06 17:37 - 2012-07-06 20:10 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 17:37 - 2012-04-09 09:02 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 17:37 - 2011-10-14 04:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 18:09 - 2012-04-28 21:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 18:10 - 2014-06-24 19:33 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Adobe
2015-01-16 20:14 - 2013-08-18 19:55 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 20:14 - 2012-02-04 19:27 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2011-11-17 13:30 - 2011-11-17 13:32 - 0015230 _____ () C:\ProgramData\ArcadeDeluxe5.log
Some content of TEMP:
====================
C:\Users\Da Wee\AppData\Local\Temp\bitool.dll
C:\Users\Da Wee\AppData\Local\Temp\setup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-08 10:06
==================== End Of Log ============================
FRST Addition Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by Da Wee at 2015-02-10 12:23:25
Running from C:\Users\Da Wee\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.100 - NTI Corporation)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1904 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3504 - Acer Incorporated)
Acer Games (HKLM-x32\...\WildTangent acer Master Uninstall) (Version: 1.0.2.5 - WildTangent)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3504 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0913.2011 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3500 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 14.8.4.1 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
clear.fi (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 1.0.2024.00 - CyberLink Corp.)
clear.fi (x32 Version: 1.0.1517_36458 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 1.0.2024.00 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 9.0.8026 - CyberLink Corp.) Hidden
clear.fi Client (HKLM-x32\...\{43AAE145-83CF-4C96-9A5E-756CEFCE879F}) (Version: 1.00.3500 - Acer Incorporated)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.7 - Dolby Laboratories Inc)
eBay Worldwide (HKLM-x32\...\{D3E5A972-9A15-427D-AE78-8181A5FD943C}) (Version: 2.2.0409 - OEM)
Elevated Installer (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
ETDWare PS/2-X64 8.0.6.3_WHQL (HKLM\...\Elantech) (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
Evernote v. 4.5.1 (HKLM-x32\...\{28921580-E4BB-11E0-9FD7-1CC1DEF07CBE}) (Version: 4.5.1.5451 - Evernote Corp.)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free FLV Converter V 7.5.0 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.5.0.0 - Koyote Soft)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Garmin Express (HKLM-x32\...\{817c6bb8-ea2d-4e12-abbc-e33c3de43f64}) (Version: 3.2.16.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Java 7 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Acer Inc.)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden
Nero Burning ROM 11 (HKLM-x32\...\{E656D89A-8CBB-497F-918F-8361A4071C26}) (Version: 11.0.10400 - Nero AG)
newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9002 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9002 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 285.64 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 285.64 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}) (Version: 9.10.0514 - NVIDIA Corporation)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6438 - Realtek Semiconductor Corp.)
Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.)
Samsung AllShare (x32 Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.) Hidden
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
StreamTransport version: 1.0.2.2171 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.0.1142 - SUPERAntiSpyware.com)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.18051 - TeamViewer)
Torchlight (x32 Version: 2.2.0.97 - WildTangent) Hidden
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3504 - Acer Incorporated)
WildTangent Games App (Acer Games) (x32 Version: 4.0.5.14 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 4.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)
WISO Steuer 2012 (HKLM-x32\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7303 - Buhl Data Service GmbH)
WISO Steuer 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
WISO Steuer 2014 (HKLM-x32\...\{DE0C16AA-A72B-4197-B40F-1B7E52E9EE35}) (Version: 21.00.8480 - Buhl Data Service GmbH)
WISO steuer:Start 2015 (HKLM-x32\...\{E1B43AA8-73CC-498F-9E3E-BA9F0008146B}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
16-12-2014 18:17:55 Windows Update
18-12-2014 19:00:18 Windows Update
19-12-2014 21:48:05 Installiert WISO steuer:Start 2015
22-12-2014 15:03:19 Windows Update
29-12-2014 14:00:29 Windows Update
07-01-2015 11:06:56 Windows Update
11-01-2015 10:22:07 Windows Update
16-01-2015 19:47:42 Windows Update
16-01-2015 20:13:39 Windows Update
26-01-2015 17:43:23 Windows Update
01-02-2015 10:20:40 Windows Update
05-02-2015 18:23:11 Windows Update
09-02-2015 10:36:16 Windows Update
09-02-2015 13:14:30 Entfernt WISO steuer:Start 2015
09-02-2015 13:24:02 Installiert WISO steuer:Start 2015
09-02-2015 15:32:20 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
09-02-2015 15:37:23 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
09-02-2015 17:49:59 Removed Apple Application Support
09-02-2015 17:51:35 Removed Apple Mobile Device Support
09-02-2015 18:15:54 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
10-02-2015 10:28:38 Removed iTunes
10-02-2015 10:34:40 Removed iTunes
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {19A64B5B-FFF2-4774-9BF1-EC54A8E4D149} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3DD17974-5CB1-40F2-9CB9-DE0649FA0AB1} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-08-24] (CyberLink)
Task: {3F044062-13A5-41E3-8DCC-57750A9AFD06} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-07-23] ()
Task: {50A05B06-FCE2-4213-AC40-7F918B810D8F} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-08-24] (CyberLink Corp.)
Task: {542DD518-C15C-42B6-96A2-0D30B7A5A282} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5502789F-A822-4A18-BB65-E00B5F778DEC} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-08-24] (Acer Incorporated)
Task: {7E0D7E15-EDCA-470A-A964-82B9731D6095} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2011-08-09] (Acer)
Task: {8137E10E-10ED-42F1-A0B9-445E1841F50A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {B3136869-CD7A-4445-80C7-7D39ACAB3F8F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {DB18FC88-3F4F-4B8B-B1A2-651749EB6826} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2009-01-21 16:45 - 2009-01-21 16:45 - 01401856 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2012-02-24 21:47 - 2012-02-17 20:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2011-10-14 04:57 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2015-01-21 03:06 - 2015-01-21 03:06 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-02-10 12:15 - 2015-02-10 12:15 - 00050477 _____ () C:\Users\Da Wee\Downloads\Defogger.exe
2012-01-05 14:22 - 2012-01-05 14:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2011-08-24 18:03 - 2011-08-24 18:03 - 00206216 _____ () C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
2014-10-22 19:28 - 2014-10-22 19:28 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\c152a64e30c5b94894d75ac86aa7aad2\IsdiInterop.ni.dll
2011-10-14 04:15 - 2011-04-30 08:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 01135616 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMSWrap.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00656896 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ContentDirectoryPresenter.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00105472 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMCDP.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00098816 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\FolderCDP.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00077312 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MetadataFramework.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00520234 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\sqlite3.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00450560 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MoodExtractor.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 05717504 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMImgExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00029184 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AutoChaptering.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00147456 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexpat.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoThumb.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 04671488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avcodec-52.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00070656 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avutil-50.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00686080 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avformat-52.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00152064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\swscale-0.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00027648 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AudioExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00063488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ID3Driver.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00366592 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\tag.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00289792 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libThumbnail.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00023040 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RichInfoDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ThumbnailMaker.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00133120 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoMetadataDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00290304 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libKeyFrame.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\SECMetaDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ImageExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\photoDriver.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00399826 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexif-12.dll.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00013824 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\TextExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00031232 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\Autobackup.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00054784 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RosettaAllShare.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00044032 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\us.dll
2015-02-01 10:30 - 2015-02-01 10:31 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
2013-07-10 17:07 - 2013-07-10 17:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Registry Areas =====================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-206210334-1080461088-3002721162-500 - Administrator - Disabled)
Da Wee (S-1-5-21-206210334-1080461088-3002721162-1002 - Administrator - Enabled) => C:\Users\Da Wee
Gast (S-1-5-21-206210334-1080461088-3002721162-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-206210334-1080461088-3002721162-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-206210334-1080461088-3002721162-1000 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/10/2015 10:25:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/09/2015 07:16:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/09/2015 07:12:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 161617
Error: (02/09/2015 07:12:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 161617
Error: (02/09/2015 07:12:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/09/2015 07:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3557
Error: (02/09/2015 07:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3557
Error: (02/09/2015 07:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/09/2015 07:09:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2371
Error: (02/09/2015 07:09:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2371
System errors:
=============
Error: (02/10/2015 10:25:28 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet:
%%2
Error: (02/10/2015 10:25:24 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
[verify-U]_System
Error: (02/10/2015 10:24:37 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\[verify-U]-driver.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (02/09/2015 07:16:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet:
%%2
Error: (02/09/2015 07:16:12 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
[verify-U]_System
Error: (02/09/2015 07:15:22 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\[verify-U]-driver.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (02/09/2015 05:51:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/09/2015 05:51:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (02/09/2015 04:39:56 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet:
%%2
Error: (02/09/2015 04:39:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
[verify-U]_System
Microsoft Office Sessions:
=========================
Error: (03/11/2013 03:49:24 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 428 seconds with 360 seconds of active time. This session ended with a crash.
Error: (03/15/2012 07:51:40 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 294 seconds with 240 seconds of active time. This session ended with a crash.
Error: (03/11/2012 01:16:23 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5606 seconds with 540 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz
Percentage of memory in use: 37%
Total physical RAM: 8043.86 MB
Available physical RAM: 5045.2 MB
Total Pagefile: 16085.9 MB
Available Pagefile: 13246.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:578.07 GB) (Free:469.11 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: D5A70C26)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=578.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Gmer Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-10 13:07:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD64 rev.01.0 596,17GB
Running: Gmer-19357.exe; Driver: C:\Users\DAWEE~1\AppData\Local\Temp\kwloapow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448 fffff80003201000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495 fffff8000320102f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\XTab\ProtectService.exe[2108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\XTab\ProtectService.exe[2108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[1368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[1368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\LManager.exe[352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\XTab\cmdshell.exe[4800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\XTab\cmdshell.exe[4800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\XTab\HPNotify.exe[5060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\XTab\HPNotify.exe[5060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[4356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[4356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [4356] entry point in ".rdata" section 00000000627f71e6
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075b88791 5 bytes JMP 00000001588953fc
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 0000000075cc6143 5 bytes JMP 000000015935f68e
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 00000000753f3e59 5 bytes JMP 00000001588c10b7
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 00000000753f3eae 5 bytes JMP 00000001588cb0be
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 00000000753f4731 5 bytes JMP 00000001588fb5dc
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000753f5dee 5 bytes JMP 00000001588fc50f
? C:\Windows\system32\mssprxy.dll [1736] entry point in ".rdata" section 00000000627f71e6
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Program Files (x86)\Common Files\SYSTEM\MSMAPI\1031\MSMAPI32.DLL!HrDispatchNotifications@4 + 112 0000000065e81b80 4 bytes [32, 9D, F1, 74]
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Users\Da Wee\Downloads\Defogger.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Users\Da Wee\Downloads\Defogger.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 166 000000002f101afc 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 253 000000002f101b53 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 320 000000002f101b96 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 390 000000002f101bdc 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 738 000000002f101d38 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 937 000000002f101dff 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 958 000000002f101e14 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 970 000000002f101e20 2 bytes [10, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075b88791 5 bytes JMP 00000001588953fc
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 0000000075cc6143 5 bytes JMP 000000015935f68e
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 00000000753f3e59 5 bytes JMP 00000001588c10b7
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 00000000753f3eae 5 bytes JMP 00000001588cb0be
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 00000000753f4731 5 bytes JMP 00000001588fb5dc
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000753f5dee 5 bytes JMP 00000001588fc50f
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75]
.text ... * 2
---- EOF - GMER 2.1 ----
|
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
