| buenoDad | 11.03.2015 17:44 |
Sorry,
hier die Logfiles :
FRST
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Standard (administrator) on TOSHIBA1LQ on 05-03-2015 19:46:41
Running from C:\Users\Standard\Desktop
Loaded Profiles: Standard (Available profiles: Standard & Gast1)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default
FF Homepage: google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll (Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-02-03]
FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\CNTVLive2@www.cntv.cn [2014-07-08]
FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-01]
FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-16]
FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-17] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S1 ASPI32; No ImagePath
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43064 2014-10-14] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2015-03-05] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-05 19:46 - 2015-03-05 19:47 - 00014187 _____ () C:\Users\Standard\Desktop\FRST.txt
2015-03-05 19:45 - 2015-03-05 19:46 - 00000000 ____D () C:\FRST
2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe
2015-03-05 19:36 - 2015-03-05 19:36 - 02092544 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe
2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk
2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Downloads\JRT.exe
2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll
2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll
2015-03-03 14:01 - 2015-03-03 14:01 - 02126848 _____ () C:\Users\Standard\Desktop\adwcleaner_4.111.exe
2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp
2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump
2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP
2015-02-27 20:36 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls
2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2015-02-12 22:04 - 2015-01-23 04:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-02-12 22:04 - 2015-01-23 03:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-02-11 22:20 - 2015-02-03 23:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-02-11 22:20 - 2015-02-03 23:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-02-11 22:20 - 2015-02-03 23:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-02-11 22:20 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-02-11 22:20 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2015-02-11 22:20 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2015-02-11 22:20 - 2014-12-08 23:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-02-11 22:01 - 2015-02-11 22:01 - 00007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg
2015-02-11 20:14 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-02-11 20:14 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-02-11 20:14 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-02-11 20:14 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-02-11 20:14 - 2015-01-13 22:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-02-11 20:14 - 2015-01-13 22:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-02-11 20:14 - 2015-01-10 09:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-02-11 20:14 - 2015-01-10 09:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-02-11 20:14 - 2015-01-10 08:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-02-11 20:14 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll
2015-02-11 20:14 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll
2015-02-11 20:14 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll
2015-02-11 20:14 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2015-02-11 20:14 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2015-02-11 20:14 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll
2015-02-11 20:14 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-02-11 20:14 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-02-11 20:14 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-02-11 20:14 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-02-11 20:14 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-02-11 20:14 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll
2015-02-11 20:14 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe
2015-02-11 20:14 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe
2015-02-11 20:14 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe
2015-02-11 20:13 - 2015-01-12 03:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-02-11 20:13 - 2015-01-12 02:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-02-11 20:13 - 2015-01-12 02:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-02-11 20:13 - 2015-01-12 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-02-11 20:13 - 2015-01-12 02:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-02-11 20:13 - 2015-01-12 02:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-02-11 20:13 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-02-11 20:13 - 2015-01-12 02:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-02-11 20:13 - 2015-01-12 02:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-02-11 20:13 - 2015-01-12 02:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-02-11 20:13 - 2015-01-12 02:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-02-11 20:13 - 2015-01-12 01:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-02-11 20:13 - 2015-01-12 01:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-02-11 20:13 - 2015-01-12 01:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-02-11 20:13 - 2015-01-12 01:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-02-11 20:13 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-02-11 20:13 - 2015-01-12 01:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-02-11 20:13 - 2015-01-12 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-02-11 20:13 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-02-11 20:13 - 2015-01-12 01:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-02-11 20:13 - 2015-01-12 01:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-02-11 20:13 - 2015-01-12 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-02-11 20:13 - 2015-01-12 01:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-02-11 20:13 - 2015-01-12 01:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-02-11 20:13 - 2015-01-12 01:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-02-11 20:13 - 2015-01-12 01:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-02-11 20:13 - 2015-01-12 01:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-02-11 20:13 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-02-11 20:13 - 2015-01-12 01:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-02-11 20:13 - 2015-01-12 01:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-02-11 20:13 - 2015-01-12 01:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-02-11 20:13 - 2015-01-12 01:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-02-11 20:13 - 2015-01-12 00:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-02-11 20:13 - 2015-01-12 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-02-11 20:13 - 2015-01-10 07:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-02-11 20:13 - 2015-01-10 06:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-02-11 20:11 - 2015-01-10 08:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 19:34 - 2013-10-29 14:53 - 01559257 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-05 19:20 - 2013-08-17 16:59 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893-1633341002-1001
2015-03-05 19:15 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-03-05 19:11 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-05 19:11 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-03-05 19:11 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data
2015-03-05 19:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-05 19:08 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6}
2015-03-05 19:07 - 2013-08-22 14:46 - 00315945 _____ () C:\WINDOWS\setupact.log
2015-03-05 19:05 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP
2015-03-05 19:04 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive
2015-03-05 01:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-03-03 15:01 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-03-03 15:00 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner
2015-03-03 14:48 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard
2015-03-03 13:33 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-24 23:09 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-12 09:24 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-12 09:23 - 2013-09-29 19:04 - 00032246 _____ () C:\WINDOWS\PFRO.log
2015-02-12 00:38 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast1
2015-02-12 00:38 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-02-12 00:37 - 2013-08-19 01:13 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-11 20:49 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-04 23:09 - 2013-08-17 18:18 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-02-03 19:31 - 2014-12-12 11:05 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-02-03 19:31 - 2014-12-12 11:05 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg
Some content of TEMP:
====================
C:\Users\Standard\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-03 21:39
==================== End Of Log ============================
--- --- ---
Additions : Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-03-2015 01
Ran by Standard at 2015-03-05 19:47:46
Running from C:\Users\Standard\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29480 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)
Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1402.1 - Microsoft Corporation) Hidden
Update for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
11-02-2015 20:53:45 Windows Update
19-02-2015 22:58:54 Geplanter Prüfpunkt
24-02-2015 23:09:15 Windows Update
04-03-2015 00:04:32 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll
2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:88050731
AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"
==================== Accounts: =============================
Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)
Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)
Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1
Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0xa34
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
Error: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0xec
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
Error: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0x12c4
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
Error: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0x76c
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5
System errors:
=============
Error: (03/05/2015 07:45:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 4 Mal passiert.
Error: (03/05/2015 07:27:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (03/04/2015 00:05:25 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{0a543ba0-7861-11e2-8d38-d60b12dec0bc}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{84DCEC0C-94C3-49C0-B572-5573AA6F1404}
Error: (03/04/2015 00:05:14 AM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "TI31051200A" wurde eine Beschädigung erkannt.
In einer Indexstruktur des Dateisystems wurde eine Beschädigung gefunden. Die Dateireferenznummer ist 0x40000000162f1. Der Name der Datei ist "\Windows\System32\DriverStore\FileRepository". Das Attribut des beschädigten Indexes ist ":$I30:$INDEX_ALLOCATION".
Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (03/03/2015 03:16:24 PM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "C:" wurde eine Beschädigung erkannt.
Die genaue Art der Beschädigung ist unbekannt. Die Dateisystemstrukturen müssen online überprüft werden.
Error: (03/03/2015 03:12:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (03/03/2015 03:02:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aa3401d0577ce9733e01C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe275745ee-c370-11e4-bed7-7c050738016e
Error: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aec01d0577a69f6aa56C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exea8e40698-c36d-11e4-bed7-7c050738016e
Error: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a12c401d055c47b2b8440C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeb937cef2-c1b7-11e4-bed7-7c050738016e
Error: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a76c01d055c2f82e9b10C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe3fd774c2-c1b6-11e4-bed7-7c050738016e
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHz
Percentage of memory in use: 23%
Total physical RAM: 8073.22 MB
Available physical RAM: 6151.34 MB
Total Pagefile: 16265.22 MB
Available Pagefile: 14374.57 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB
==================== Drives ================================
Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:597.87 GB) NTFS
Drive d: (TOSHIBA EXT) (Fixed) (Total:465.76 GB) (Free:422.99 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: E6615A88)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
CHECKRESULTS Code:
mbam-check result log version: 2.1.1.1001
========================================
User Account type: Administrator
OS: Windows 8.1 64 bit Operating System
Current Version and Build: 6.3.9200.0
Malwarebytes Anti-Malware:
Installed On: 2014/06/25
Malware Database: 0000.00.00.00
Rootkit Database: 0000.00.00.00
Remediation Database: 0000.00.00.00
IP Database: 0000.00.00.00
Domain Database: 0000.00.00.00
License: Premium
Malware Protection: 4 (The service is running.)
Malicious Website Protection: 1 (The service is not running.)
Chameleon: 0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon
Log Created: 2015/03/05 20:03:28
Compatibility Flag Settings:
=================================
Malwarebytes Anti-Malware Shell Extension Block Check:
======================================================
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked:
MBAM Startup Entries:
=====================
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Malwarebytes Anti-Malware Service and Driver Status:
=======================================================
--------------Driver File Info:--------------
C:\WINDOWS\system32\drivers\mbam.sys
File Size: 25816 BYTES FileVersion: 0.1.13.0 MD5: [f92b0e478c0faa6d6661e6e977247e60]
C:\WINDOWS\system32\drivers\mwac.sys
File Size: 64216 BYTES FileVersion: 1.0.1.0 MD5: [0664f6335f108f38fe08c3ca747311ee]
C:\WINDOWS\system32\drivers\mbamswissarmy.sys
File Size: 122584 BYTES FileVersion: 0.1.7.0 MD5: [8a50d5304e6ae48664cf5838ec32f647]
C:\WINDOWS\system32\drivers\mbamchameleon.sys
File Size: 91352 BYTES FileVersion: 1.0.4.0 MD5: [9d9ed48f841ea37aa5310d54b9e5d3c7]
--------------MBAMProtector:--------------
Type: 2
State: 4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE: 0
SERVICE_EXIT_CODE: 0
CHECKPOINT: 0
WAIT_HINT: 0
--------------MBAMService:--------------
Type: 16
State: 1 (The service is not running.) (State is stopped)
WIN32_EXIT_CODE: 1067
SERVICE_EXIT_CODE: 0
CHECKPOINT: 0
WAIT_HINT: 0
--------------MBAMScheduler:--------------
Type: 16
State: 4 (The service is running.)
WIN32_EXIT_CODE: 0
SERVICE_EXIT_CODE: 0
CHECKPOINT: 0
WAIT_HINT: 0
--------------MBAMChameleon:--------------
Type: N/A
State: 0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon
WIN32_EXIT_CODE: N/A
SERVICE_EXIT_CODE: N/A
CHECKPOINT: N/A
WAIT_HINT: N/A
--------------MBAMWebAccessControl:--------------
Type: 1
State: 1 (The service is not running.) (State is stopped)
WIN32_EXIT_CODE: 1077
SERVICE_EXIT_CODE: 0
CHECKPOINT: 0
WAIT_HINT: 0
Required Dependencies:
======================
--------------BFE:--------------
Type: 32
State: 4 (The service is running.)
WIN32_EXIT_CODE: 0
SERVICE_EXIT_CODE: 0
CHECKPOINT: 0
WAIT_HINT: 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
DisplayName REG_SZ @%SystemRoot%\system32\bfe.dll,-1001
ErrorControl REG_DWORD 1
Group REG_SZ NetworkProvider
ImagePath REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork
Start REG_DWORD 2
Type REG_DWORD 32
Description REG_SZ @%SystemRoot%\system32\bfe.dll,-1002
DependOnService REG_MULTI_SZ RpcSs
WfpLwfs
ObjectName REG_SZ NT AUTHORITY\LocalService
ServiceSidType REG_DWORD 3
RequiredPrivileges REG_MULTI_SZ SeAuditPrivilege
FailureActions REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters
ServiceDllUnloadOnStop REG_DWORD 1
ServiceMain REG_SZ BfeServiceMain
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\bfe.dll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime\Filter
{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY Binary Data
{84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY Binary Data
{dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data
{0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data
{12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data
{c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data
{0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data
{074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data
{c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data
{a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data
{0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data
{2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data
{2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data
{c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data
{935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data
{941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Options
EnablePacketQueue REG_DWORD 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Callout
{22001ee0-8e87-4f75-ba58-248f5918a63a}REG_BINARY Binary Data
{79f2a265-b693-4cc9-b480-cbcd87bd4747}REG_BINARY Binary Data
{c4b50f21-503e-4d7a-abd4-ed0a823a2453}REG_BINARY Binary Data
{91e902db-2cef-4040-b8e2-02fe4fd49c25}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Filter
{3a90a266-1519-4d23-911b-e84cd0f02ab8}REG_BINARY Binary Data
{8b50e2ec-7cF0-4b71-b42e-5b0536f6cab8}REG_BINARY Binary Data
{17043d46-fac2-4561-bca1-0c7a05e95f5f}REG_BINARY Binary Data
{3180114b-8338-4740-9a16-444134ad62f4}REG_BINARY Binary Data
{d870c96c-75ee-46a6-8a02-8e4401a73423}REG_BINARY Binary Data
{4137b143-2770-43d4-91a2-55bb0a069830}REG_BINARY Binary Data
{b02a4013-b6b5-4859-9168-1e3299e43b24}REG_BINARY Binary Data
{4e718c57-c397-4221-9fbb-14fd51701d6a}REG_BINARY Binary Data
{567d3836-3f5b-4067-b9c4-952f677010a2}REG_BINARY Binary Data
{70694559-714a-4a38-a0cd-51439e06f1d8}REG_BINARY Binary Data
{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY Binary Data
{84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY Binary Data
{e72646bc-7d3f-4c5c-a679-b3716f8c6cc8}REG_BINARY Binary Data
{b98b75dc-17c0-4e84-bd4e-2080527ca6a6}REG_BINARY Binary Data
{56b4fdc4-bb4e-4c42-a9d8-f627ee15ac21}REG_BINARY Binary Data
{1ba41ed8-151d-4577-9272-317856bc637c}REG_BINARY Binary Data
{9248d57e-f843-4159-807d-3813173e2096}REG_BINARY Binary Data
{4658cd86-525d-44ed-98a5-791a7b8655f1}REG_BINARY Binary Data
{dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY Binary Data
{f444c576-6e60-4ea2-9faa-80d57ed12cd2}REG_BINARY Binary Data
{0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY Binary Data
{12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY Binary Data
{c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY Binary Data
{0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY Binary Data
{4d9581d2-aef8-4993-84cd-b986ced80d42}REG_BINARY Binary Data
{be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc}REG_BINARY Binary Data
{716b48eb-0a35-4a76-92ab-1d987230d288}REG_BINARY Binary Data
{1165065e-4996-4338-abaf-4b8556b4d431}REG_BINARY Binary Data
{07a24961-a760-4e80-b263-6d275e1b09cb}REG_BINARY Binary Data
{5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9}REG_BINARY Binary Data
{b6b2ca61-fb98-4422-adc2-e7cf56b3680c}REG_BINARY Binary Data
{0aa7fff8-919f-453c-928c-28a12122ba38}REG_BINARY Binary Data
{074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY Binary Data
{c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY Binary Data
{a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY Binary Data
{0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY Binary Data
{91ffecf0-0a9e-4572-95f1-a7111af86967}REG_BINARY Binary Data
{64e55933-15a5-495d-a928-ccca43d44875}REG_BINARY Binary Data
{13bfd422-6f75-4408-8924-9400ec0cb19c}REG_BINARY Binary Data
{cbfb56db-3c85-4543-9bc2-76ea28cdd74e}REG_BINARY Binary Data
{2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY Binary Data
{375fb39b-08c6-40f2-bdf2-08fa63f970a2}REG_BINARY Binary Data
{2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY Binary Data
{c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY Binary Data
{b6fdab6b-dcc6-43e3-99ce-7aeca65063a4}REG_BINARY Binary Data
{3697a558-3ed3-49be-a4c1-c1a4448653b4}REG_BINARY Binary Data
{935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY Binary Data
{941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Provider
{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}REG_BINARY Binary Data
{4b153735-1049-4480-aab4-d1b9bdc03710}REG_BINARY Binary Data
{1bebc969-61a5-4732-a177-847a0817862a}REG_BINARY Binary Data
{839cd73f-1907-49ea-9aa5-0e6be9048087}REG_BINARY Binary Data
{aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}REG_BINARY Binary Data
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\SubLayer
{b3cdd441-af90-41ba-a745-7c6008ff2300}REG_BINARY Binary Data
{b3cdd441-af90-41ba-a745-7c6008ff2301}REG_BINARY Binary Data
{b3cdd441-af90-41ba-a745-7c6008ff2302}REG_BINARY Binary Data
{9ba30013-c84e-47e5-ac6e-1e1aed72fa69}REG_BINARY Binary Data
{8c36b346-4e0c-4049-8b55-5295ac35567c}REG_BINARY Binary Data
--------------fltmgr:--------------
Type: 2
State: 4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE: 0
SERVICE_EXIT_CODE: 0
CHECKPOINT: 0
WAIT_HINT: 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FltMgr
AttachWhenLoaded REG_DWORD 1
DisplayName REG_SZ @%SystemRoot%\system32\drivers\fltmgr.sys,-10001
ErrorControl REG_DWORD 3
Group REG_SZ FSFilter Infrastructure
ImagePath REG_EXPAND_SZ system32\drivers\fltmgr.sys
Start REG_DWORD 0
Tag REG_DWORD 1
Type REG_DWORD 2
Description REG_SZ @%SystemRoot%\system32\drivers\fltmgr.sys,-10000
C:\WINDOWS\system32\drivers\fltmgr.sys
File Size: 360792 BYTES FileVersion: 6.3.9600.17090 MD5: [6592d192e2823c043edbc010e7774053]
C:\WINDOWS\SysWOW64\olepro32.dll
File Size: 80384 BYTES FileVersion: 6.3.9600.16384 MD5: [0fc9b04c7f729498b41a19fa55c33573]
MBAM Registry Settings and License Info:
========================================
--------------Settings:--------------
Advanced:
AutomaticQuarantine: true
AutostartProtection: true
LimitedMode: false
StartSilentMode: false
StartupDelay: 0
ApplicationState:
First-Run-After-Installation: false
General:
DaysUntilNotifyExpiration: 5
Language:
RightClickAccess: true
SilentErrors: false
Logging:
ExportLog: true
Notification:
ProtectionTray:
DisplayMilliseconds: 7000
ScanHistory:
Duration_Complete: 2000
Duration_Driver: 0
Duration_Filesystem: 0
Duration_Heuristics: 0
Duration_Loading: 0
Duration_MasterBootRecord: 0
Duration_Memory: 40000
Duration_PreScan: 3000
Duration_Registry: 12000
Duration_Sector: 0
Duration_Startup: 13000
ItemCount_Complete: 0
ItemCount_Driver: 0
ItemCount_Filesystem: 0
ItemCount_Heuristics: 0
ItemCount_Loading: 0
ItemCount_MasterBootRecord: 0
ItemCount_Memory: 2797
ItemCount_PreScan: 0
ItemCount_Registry: 637
ItemCount_Sector: 0
ItemCount_Startup: 1483
LastScanDateEpoch: 1425395637168
LastScanType: 1 (Threat Scan)
Update:
LastUpdate: 2014-07-17T23:03:49
NotifyInstallReady: true
NotifyOutdatedDatabase: 1
ProxyPassword:
ProxyPort: 0
ProxyServer:
ProxyUsername:
UseProxy: false
UseProxyAuthentication: false
--------------Account:--------------
Account Status: Premium
Expiration Time: 2034/06/25 19:23:27
Activation Time: 2014/06/25 19:23:27
Trial Used: false
--------------Access Policies:--------------
Scheduler Queue:
================
tasks:
5e7ebea2-0b33-4128-9099-c88ddfcc5630:
parameters:
CheckForUpdatesBeforeScanStart: false
ProcessLaunchedFromScheduler: true
ScanConfig:
ExitWhenNoMalwareDetected: false
FileSystemOption: true
RebootSystemWhenMalwareDetected: false
RemoveMalwareAutomaticallyWhenScanEnds: false
ScanArchives: true
ScanHeuristic: true
ScanMemoryObjects: true
ScanPUM: 2
ScanPUP: 2
ScanRegistry: true
ScanRootkits: false
ScanStartup: true
ScanTargets:
ScanType: 1 (Threat Scan)
Silent: true
StartTaskFromSystemAccount: false
TaskType: 0
triggers:
7aac6cd6-1af0-40c1-9471-28baa867892e:
dateinterval: 0:0:0
lastscheduled: Thu, 05 Mar 2015 19:04:45.710949 +0000
lasttriggered: Thu, 05 Mar 2015 19:04:45.710949 +0000
nextscheduled: Thu, 05 Mar 2015 20:04:45.710949 +0000
recovery: 00:00:00
start: Tue, 03 Mar 2015 14:13:56 +0000
timeinterval: 01:00:00
type: 3
uuid: 7aac6cd6-1af0-40c1-9471-28baa867892e
type: scan
uuid: 5e7ebea2-0b33-4128-9099-c88ddfcc5630
90bc4336-09b0-4a97-ab20-e2165a367be4:
parameters:
CheckForUpdatesBeforeScanStart: true
ProcessLaunchedFromScheduler: true
ScanConfig:
ExitWhenNoMalwareDetected: false
ExportLog: true
FileSystemOption: true
RebootSystemWhenMalwareDetected: false
RemoveMalwareAutomaticallyWhenScanEnds: false
ScanArchives: true
ScanExtra: true
ScanHeuristic: true
ScanMemoryObjects: true
ScanPUM: 2
ScanPUP: 2
ScanRegistry: true
ScanRootkits: false
ScanStartup: true
ScanTargets:
ScanType: 1 (Threat Scan)
Silent: true
TerminateExplorerWhenMalwareIsRemoved: false
StartTaskFromSystemAccount: false
TaskType: 0
triggers:
6d7c30f9-93f5-4612-802d-568411c3e122:
dateinterval: 1:0:0
lastscheduled: Thu, 05 Mar 2015 00:00:06.219142 +0000
lasttriggered: Thu, 05 Mar 2015 00:00:06.219142 +0000
nextscheduled: Thu, 05 Mar 2015 23:52:54.219142 +0000
recovery: 23:00:00
start: Thu, 26 Jun 2014 03:05:23 +0100
timeinterval: 00:00:00
type: 4
uuid: 6d7c30f9-93f5-4612-802d-568411c3e122
type: scan
uuid: 90bc4336-09b0-4a97-ab20-e2165a367be4
fe0e7cc5-1a6c-4e1d-9c52-f879e4ff428c:
parameters:
NotifyWhenUpdateCompletes: true
ProcessLaunchedFromScheduler: true
TaskType: 3
triggers:
96f87719-1e68-4d0b-bc5f-c8bb5f8426d4:
dateinterval: 0:0:0
lastscheduled: Thu, 05 Mar 2015 19:04:45.710949 +0000
lasttriggered: Thu, 05 Mar 2015 19:04:45.710949 +0000
nextscheduled: Thu, 05 Mar 2015 20:11:49.710949 +0000
recovery: 00:00:00
start: Wed, 25 Jun 2014 19:56:50.261896 +0100
timeinterval: 01:00:00
type: 3
uuid: 96f87719-1e68-4d0b-bc5f-c8bb5f8426d4
type: update
uuid: fe0e7cc5-1a6c-4e1d-9c52-f879e4ff428c
Pending File Rename Operations:
================================
If any Malwarebytes Anti-Malware items are listed below, the user must reboot to complete a Malwarebytes Anti-Malware upgrade installation.
Pending File Rename Operations:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\
PendingFileRenameOperations REG_MULTI_SZ \??\C:\Program Files (x86)\Avira\AntiVir Desktop\aeheur.dll.tmp
MBAMProtector Registry Values:
==============================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector
Type REG_DWORD 2
Start REG_DWORD 3
ErrorControl REG_DWORD 1
ImagePath REG_EXPAND_SZ \??\C:\WINDOWS\system32\drivers\mbam.sys
Group REG_SZ FSFilter Anti-Virus
DependOnService REG_MULTI_SZ FltMgr
WOW64 REG_DWORD 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances
DefaultInstance REG_SZ MBAMProtector Instance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances\MBAMProtector Instance
Altitude REG_SZ 328800
Flags REG_DWORD 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Parameters
PassThruFile REG_DWORD 0
ProductPath REG_DWORD 0
MBAMService Registry Values:
============================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService
Type REG_DWORD 16
Start REG_DWORD 2
ErrorControl REG_DWORD 1
ImagePath REG_EXPAND_SZ "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe"
DependOnService REG_MULTI_SZ MBAMProtector
WOW64 REG_DWORD 1
ObjectName REG_SZ LocalSystem
DelayedAutostart REG_DWORD 0
MBAMScheduler Registry Values:
==============================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMScheduler
Type REG_DWORD 16
Start REG_DWORD 2
ErrorControl REG_DWORD 1
ImagePath REG_EXPAND_SZ "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe"
WOW64 REG_DWORD 1
ObjectName REG_SZ LocalSystem
Terminal Services Status for (null) entries in PM logs and GetUserToken errors:
===============================================================================
--------------TERMService:--------------
Type: 32
State: 1 (The service is not running.) (State is stopped)
WIN32_EXIT_CODE: 1077
SERVICE_EXIT_CODE: 0
CHECKPOINT: 0
WAIT_HINT: 0
TermService Start is set to: 3 (Manual Startup)
Proxy Status: No proxy is Set
LAN Settings:
=============
only 'Automatically detect settings' is selected
SystemPartition:
================
HKEY_LOCAL_MACHINE\SYSTEM\Setup\
SystemPartition REG_SZ \Device\HarddiskVolume2
Balloon Tips Status:
====================
Enabled
Time Format Settings:
=====================
Should be:
h:mm:ss tt
AM
PM
:
Currently:
REG_SZ HH:mm:ss
REG_SZ
REG_SZ
REG_SZ
Language and Regional Settings:
===============================
ACP: Language is English (United States)
MACCP: Language is English (United States)
OEMCP: 850 Please refer to this link for details: Here
Startup Folders for Error_Expanding_Variables Check:
====================================================
All Users Startup Folder Exists.
Current User's Startup Folder Exists.
Context Menu Entries:
=====================
HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt
(Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\MBAMShlExt
(Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt
(Default): REG_SZ MBAMShlExt Class
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt\CLSID
(Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt\CurVer
(Default): REG_SZ MBAMExt.MBAMShlExt.1
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1
(Default): REG_SZ MBAMShlExt Class
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1\CLSID
(Default): REG_SZ {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}
(Default): REG_SZ IMBAMShlExt
HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\ProxyStubClsid32
(Default): REG_SZ {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\TypeLib
(Default): REG_SZ {AFF1A83B-6C83-4342-8E68-1648DE06CB65}
Version REG_SZ 1.0
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}
(Default): REG_SZ MBAMShlExt Class
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32
(Default): REG_SZ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamext.dll
ThreadingModel REG_SZ Apartment
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\ProgID
(Default): REG_SZ MBAMExt.MBAMShlExt.1
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\TypeLib
(Default): REG_SZ {AFF1A83B-6C83-4342-8E68-1648DE06CB65}
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\VersionIndependentProgID
(Default): REG_SZ MBAMExt.MBAMShlExt
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0
(Default): REG_SZ MBAMExt 1.0 Type Library
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0\win32
(Default): REG_SZ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamext.dll
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS
(Default): REG_SZ 0
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\HELPDIR
(Default): REG_SZ C:\Program Files (x86)\Malwarebytes Anti-Malware
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0
(Default): REG_SZ MBAMExt 1.0 Type Library
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0\win32
(Default): REG_SZ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamext.dll
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS
(Default): REG_SZ 0
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\HELPDIR
(Default): REG_SZ C:\Program Files (x86)\Malwarebytes Anti-Malware
List of MBAM Related Directories:
=================================
C:\Program Files (x86)\Malwarebytes Anti-Malware\
7z.dll File Size: 920888 BYTES FileVersion: 9.20.0.0 MD5: [9f522b2708cab181c0f137abbcd1de2e]
changes.txt File Size: 2261 BYTES FileVersion: N/A MD5: [af70267bdf9a37a96f1a79a5c3720ae6]
license.rtf File Size: 39478 BYTES FileVersion: N/A MD5: [8627b31943a534aad30d154c2b2c1aaf]
master.conf File Size: 1258 BYTES FileVersion: N/A MD5: [9702ca5e82d3756c6d8af34a2ababaea]
mbam.dll File Size: 579896 BYTES FileVersion: 1.0.7.0 MD5: [d32c2a98859cb22d57a665f15f351e7d]
mbam.exe File Size: 6970168 BYTES FileVersion: 1.0.0.532 MD5: [4fbc630768570e6ac35c3de8f6ec79f5]
mbamcore.dll File Size: 1680696 BYTES FileVersion: 1.0.11.0 MD5: [f722fa26739eafcbd8d5f3829b632cd7]
mbamdor.exe File Size: 54072 BYTES FileVersion: 1.0.1.0 MD5: [4da2f2da54a92850f56c0db712058188]
mbamext.dll File Size: 184632 BYTES FileVersion: 3.0.4.0 MD5: [945bb364b09f3a8e998dbff02a0a5a58]
mbampt.exe File Size: 39736 BYTES FileVersion: 1.0.0.0 MD5: [9acd7583584c93ee542c273df8e91dc1]
mbamscheduler.exe File Size: 1809720 BYTES FileVersion: 3.0.2.0 MD5: [d84aea3f3329d622dfc1297dddf6163b]
mbamservice.exe File Size: 860472 BYTES FileVersion: 3.0.2.0 MD5: [4f45ed469906494f9bf754e476390dbd]
mbamsrv.dll File Size: 4437816 BYTES FileVersion: 1.1.0.0 MD5: [9b48e38c35f08fa831b387a0b27c40aa]
mbamtoast.dll File Size: 96568 BYTES FileVersion: 1.70.0.0 MD5: [cb3f6732c7027a65f56bcb4cc7c481d3]
msvcp100.dll File Size: 421688 BYTES FileVersion: 10.0.40219.325 MD5: [e4b829081e639e42985853bae754a53d]
msvcr100.dll File Size: 774456 BYTES FileVersion: 10.0.40219.325 MD5: [80fcedbe920e9cbe30d9d3665bd6efed]
QtCore4.dll File Size: 2732856 BYTES FileVersion: 4.8.4.0 MD5: [30490eed6a1e20e8259c0b9c58f488fe]
QtGui4.dll File Size: 8575288 BYTES FileVersion: 4.8.4.0 MD5: [15e21aa7d0c0c994cd565eeb96d13c20]
QtNetwork4.dll File Size: 909112 BYTES FileVersion: 4.8.4.0 MD5: [d7588d42e29080c32a003bee465160d8]
unins000.dat File Size: 23072 BYTES FileVersion: N/A MD5: [fac020ffb31097943aeef8d7a4552512]
unins000.exe File Size: 720281 BYTES FileVersion: 51.52.0.0 MD5: [c83db9e4930485eaf971e90043da9e2e]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Chameleon
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Chameleon\Windows
chameleon.chm File Size: 235882 BYTES FileVersion: N/A MD5: [c4190b71f037714aa77aba294434ba5b]
firefox.com File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
firefox.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
firefox.pif File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
firefox.scr File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
iexplore.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.com File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.pif File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.scr File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-killer.exe File Size: 1181496 BYTES FileVersion: N/A MD5: [c6927fd8f7e9105b64db5d5a08b53731]
rundll32.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
svchost.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
windows.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
winlogon.exe File Size: 750392 BYTES FileVersion: 3.0.4.0 MD5: [09882e8edd1144e6ef1af6d1f98305ee]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\imageformats
qgif4.dll File Size: 32568 BYTES FileVersion: 4.8.4.0 MD5: [e59f533c26c8375cd120b4791482217e]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Languages
lang_bg.qm File Size: 144048 BYTES FileVersion: N/A MD5: [9ccb79999432d56b9843a3e2b2c90325]
lang_bs.qm File Size: 145523 BYTES FileVersion: N/A MD5: [6ab7a6274d4f9f7553c944f5c66201ba]
lang_ca.qm File Size: 132254 BYTES FileVersion: N/A MD5: [68a83ec63b6e7bc5dbdd412bcc49c6ce]
lang_cs.qm File Size: 141243 BYTES FileVersion: N/A MD5: [6b8acee7f461fa69b83d2c45c3725427]
lang_da.qm File Size: 130101 BYTES FileVersion: N/A MD5: [8539796784746218b229419e99ab308d]
lang_de.qm File Size: 149462 BYTES FileVersion: N/A MD5: [fcd3bc376ad219396e8c7d3c87cd8864]
lang_el.qm File Size: 149912 BYTES FileVersion: N/A MD5: [74f13f95f63fe96c08e571598df052d6]
lang_en.qm File Size: 115961 BYTES FileVersion: N/A MD5: [8c9da1c0ce06b89f8d323bf948bfba4e]
lang_es.qm File Size: 130487 BYTES FileVersion: N/A MD5: [33e1c6d40b841cc2e783ec8d8102e66f]
lang_et.qm File Size: 138126 BYTES FileVersion: N/A MD5: [aa215b5f37a72a69854c9163ac543b51]
lang_fi.qm File Size: 144256 BYTES FileVersion: N/A MD5: [18912c339939c3a6629004ec900f4fe4]
lang_fr.qm File Size: 149253 BYTES FileVersion: N/A MD5: [ec2bf2f431c4273f151b8c8a7b84c387]
lang_he.qm File Size: 116101 BYTES FileVersion: N/A MD5: [9e692744e77051c6ce14df32f9b71920]
lang_hr.qm File Size: 139841 BYTES FileVersion: N/A MD5: [3e3737fe86eb595c5f6817eebf731aa7]
lang_hu.qm File Size: 145621 BYTES FileVersion: N/A MD5: [52d3d7fcf8c8db071ef0573a1357c2fd]
lang_id.qm File Size: 143102 BYTES FileVersion: N/A MD5: [80473d2c73d2f54f2b23c9316f2d0ceb]
lang_it.qm File Size: 146851 BYTES FileVersion: N/A MD5: [7e7aea7d0b433d7e912ed9f0887684a7]
lang_ja.qm File Size: 121282 BYTES FileVersion: N/A MD5: [19ac79b7a5e05d665e417c2dd75afc94]
lang_ko.qm File Size: 118033 BYTES FileVersion: N/A MD5: [de213178c14490bf452ea45278d3442d]
lang_nl.qm File Size: 146325 BYTES FileVersion: N/A MD5: [5aec6f6bdc5e6c28744e6ef374709eeb]
lang_no.qm File Size: 142918 BYTES FileVersion: N/A MD5: [4388c08217618af2e24173af6f5d3f97]
lang_pl.qm File Size: 145434 BYTES FileVersion: N/A MD5: [699700c889447d1f9b607c04f07fff67]
lang_pt_BR.qm File Size: 131739 BYTES FileVersion: N/A MD5: [a3430222223d59da8ec6ea1edae5ee2f]
lang_pt_PT.qm File Size: 149128 BYTES FileVersion: N/A MD5: [afdf1907af4c95f9af510d5fc1bb9067]
lang_ro.qm File Size: 121166 BYTES FileVersion: N/A MD5: [1672a2b3a9807a1497fe43824c0026c0]
lang_ru.qm File Size: 122186 BYTES FileVersion: N/A MD5: [d4dd1eea2b0f52aba2fca4d159c387f7]
lang_sk.qm File Size: 119827 BYTES FileVersion: N/A MD5: [8b200d162e8028843e41aa1a927cfd84]
lang_sl.qm File Size: 143191 BYTES FileVersion: N/A MD5: [1760a6aa6990b2f0c4c71ec04b25ac9c]
lang_sr.qm File Size: 143261 BYTES FileVersion: N/A MD5: [377d15c0da0249f4a7a58978b6307d81]
lang_sv.qm File Size: 142525 BYTES FileVersion: N/A MD5: [2587ead21967296fefdd0ee0684fe8b4]
lang_tr.qm File Size: 142194 BYTES FileVersion: N/A MD5: [880fcbe97ec6f13ec094f7371b5b295f]
lang_vi.qm File Size: 126874 BYTES FileVersion: N/A MD5: [c61281786b5bfec68afc742a19f6abd9]
lang_zh_tr.qm File Size: 110870 BYTES FileVersion: N/A MD5: [f223d83580b1ee35edea13293cb2c80d]
C:\Program Files (x86)\Malwarebytes Anti-Malware\\Plugins
fixdamage.exe File Size: 821560 BYTES FileVersion: 1.1.0.1010 MD5: [3a4dcd021d9f3a5305a22e5e309da305]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware
actions.ref File Size: 314 BYTES FileVersion: N/A MD5: [b26a36c0696e299fdfebe180c09c2737]
domains.ref File Size: 38 BYTES FileVersion: N/A MD5: [8c30b536b67543eb68e68b9640d4d498]
exclusions.dat File Size: 140 BYTES FileVersion: N/A MD5: [724d5aeeb7e57420d425044679ee5209]
ips.ref File Size: 33 BYTES FileVersion: N/A MD5: [8a1c580788ea8de3f32862c2c1cf373c]
rules.ref File Size: 8863610 BYTES FileVersion: N/A MD5: [9d389c002ea17dd045da4895ddec27e0]
S-1-5-18-0-ntuser.dat File Size: 704512 BYTES FileVersion: N/A MD5: [6b5a548b3dfd3c0cabef14b49b51b1bd]
S-1-5-18-0-ntuser.dat.LOG1 File Size: 57344 BYTES FileVersion: N/A MD5: [17df360f3e11285083f09d36011be5e3]
S-1-5-18-0-ntuser.dat.LOG2 File Size: 143360 BYTES FileVersion: N/A MD5: [33a008b39aa31fcdd90f964e8db3cf01]
S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [6816fb565f2eaaa62f26c6ec8cda8ffa]
S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [a1dac2b305a9d35bad4c5d886e2d4f81]
S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-1-ntuser.dat File Size: 704512 BYTES FileVersion: N/A MD5: [dc49f2f183e3be3d2d4ff1e5218c4088]
S-1-5-18-1-ntuser.dat.LOG1 File Size: 188416 BYTES FileVersion: N/A MD5: [bfddbaa227db76c6c289f94bb9ea7d07]
S-1-5-18-1-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [8a293a2f1884cc0fb6834778ba015784]
S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [9a802aa7c09a84796a35e00685b38f00]
S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [040282b950b3ab2e6b81a7e0cb4d2c4c]
S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-2-ntuser.dat File Size: 700416 BYTES FileVersion: N/A MD5: [b8fd93873e3865df577bd1bb8672a810]
S-1-5-18-2-ntuser.dat.LOG1 File Size: 200704 BYTES FileVersion: N/A MD5: [8f12924d39789720d6f58f11c9cfd6d1]
S-1-5-18-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [c61160b6331c15a6c1f2f0bd8c616f5e]
S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [5fb0fbf8cf89a143fe48c5d4eb2646f8]
S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [4ff1b9e4316eb27a844c1c57a79e3ad1]
S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-3-ntuser.dat File Size: 712704 BYTES FileVersion: N/A MD5: [3464492656b64b88ca6d84746c06cc97]
S-1-5-18-3-ntuser.dat.LOG1 File Size: 86016 BYTES FileVersion: N/A MD5: [b25cbd6f5f1ea5ff24db1e6a405fe0c7]
S-1-5-18-3-ntuser.dat.LOG2 File Size: 110592 BYTES FileVersion: N/A MD5: [3d0d55eb386a7e92f27c85f6bf8e509b]
S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [35f9d299a6569d9699d7d5c42fdae8b6]
S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [f367c43fcfbe4027108300860c3d6402]
S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-4-ntuser.dat File Size: 712704 BYTES FileVersion: N/A MD5: [693505122959e46a3ef6ca7a37ac5a29]
S-1-5-18-4-ntuser.dat.LOG1 File Size: 192512 BYTES FileVersion: N/A MD5: [829765f1af24b9188e1af6e90f3c9ace]
S-1-5-18-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [55045203021b326be7a3b540bd176612]
S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [0dcb7cacac4379ecf42e1e11a7e4cc69]
S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-0-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [d6fba4138ff9fdeb197162b8c53fce80]
S-1-5-19-0-ntuser.dat.LOG1 File Size: 40960 BYTES FileVersion: N/A MD5: [693879c7f81b823b5fd4478b653acabd]
S-1-5-19-0-ntuser.dat.LOG2 File Size: 147456 BYTES FileVersion: N/A MD5: [ea691b7e114538b59fea5404eacc52cb]
S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [c74d8888757cdec6746e33125b523700]
S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [de89f5907934d3d64235d70cb728df3c]
S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-1-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [0c954c292b80656ed027ee52dece738e]
S-1-5-19-1-ntuser.dat.LOG1 File Size: 176128 BYTES FileVersion: N/A MD5: [f173fb29966b9783a7bf1ea64a16851d]
S-1-5-19-1-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [4eeb87f219a266db2e0c7f4b566d25bf]
S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [917673819023ee076376302bb87b598b]
S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [36f848c02d37e91c64e2148fe60184d4]
S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-2-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [a70fbd74ae178cc6a57ca8a066936591]
S-1-5-19-2-ntuser.dat.LOG1 File Size: 176128 BYTES FileVersion: N/A MD5: [0f1b17a3d340653987ba6eb3ca299d82]
S-1-5-19-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [b3020c2527bc3bbc3cf89905cd43cf99]
S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [f5c72a7130b0f558a5f93c0d1d81c5c4]
S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [3eb7a869dcc93cd5425e5b40de8edc02]
S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-3-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [4ecce3622ebd5abf3a0a469ed2938a89]
S-1-5-19-3-ntuser.dat.LOG1 File Size: 61440 BYTES FileVersion: N/A MD5: [d73a49af316e4d6914f379d83628d743]
S-1-5-19-3-ntuser.dat.LOG2 File Size: 118784 BYTES FileVersion: N/A MD5: [0929a50906ea17f3711c8d3a5dcd8afa]
S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [b499b912185317472c4337bbd38e33f7]
S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [cdaffa84768ab0dce3518da0daa914d0]
S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-4-ntuser.dat File Size: 212992 BYTES FileVersion: N/A MD5: [4d8615cf98078169ee9ac868735e3d70]
S-1-5-19-4-ntuser.dat.LOG1 File Size: 180224 BYTES FileVersion: N/A MD5: [9c986f305ad1a3aeb93bae21bfebc093]
S-1-5-19-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [c1742f9a374dd21e977e2fadd46e0857]
S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [a3736b15fe4ab7eaaee4e4d17bb7bdf3]
S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-0-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [37b515e2b33f7c426df7d60886a3e1bb]
S-1-5-20-0-ntuser.dat.LOG1 File Size: 36864 BYTES FileVersion: N/A MD5: [8262eeb34e5574000c517f69873f5f18]
S-1-5-20-0-ntuser.dat.LOG2 File Size: 135168 BYTES FileVersion: N/A MD5: [41f208fae388ad47d0d906c6bff8f8a9]
S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [df2b10fb871b43805ef865decfb65a3a]
S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [388767cd11750a20bacb7f286034b0ec]
S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-1-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [cee596e968eb3635b0e6cb4feecb2cc1]
S-1-5-20-1-ntuser.dat.LOG1 File Size: 159744 BYTES FileVersion: N/A MD5: [e35f52c3f51f72cae4a5ae2b5f1645a3]
S-1-5-20-1-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [754d89ad01a0816c775f39e67e307170]
S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [fe6c9c8982df9dabffc4a651d49675b2]
S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [809a0090dc7a077d4e9fa9cfbf6587b6]
S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-2-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [f6609b88ab6fb82c595a81d1c7eb5abf]
S-1-5-20-2-ntuser.dat.LOG1 File Size: 159744 BYTES FileVersion: N/A MD5: [0b9ebfeb9018492f871e90e47ca9708d]
S-1-5-20-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [2b96e77dad94e2fd05267b4e59227dfe]
S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [069295c78b53051b7b2fbafc6e009a8c]
S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [9251a87c755dd08f9cf34f1fc41321b9]
S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-3-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [82dae0b7f5134b0e34247ed64bc45748]
S-1-5-20-3-ntuser.dat.LOG1 File Size: 53248 BYTES FileVersion: N/A MD5: [11cac051b53cbdf73363e10415186eaf]
S-1-5-20-3-ntuser.dat.LOG2 File Size: 106496 BYTES FileVersion: N/A MD5: [f3928cb9d5c607cf95f342ce48b0b34e]
S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [0bc13804a4a0264c9e957bac31de33b7]
S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [5246dd537049fee8b997a33fd54c1147]
S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-4-ntuser.dat File Size: 155648 BYTES FileVersion: N/A MD5: [f791ad2fbf9ed206ad764fece74901ff]
S-1-5-20-4-ntuser.dat.LOG1 File Size: 159744 BYTES FileVersion: N/A MD5: [7abcd573c17b1958c4703b29189ada25]
S-1-5-20-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [afb6a248b897db712fd870dd974f8002]
S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [c15f2fb49eaa094288ceeebc09a2d093]
S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat File Size: 1470464 BYTES FileVersion: N/A MD5: [cac242444602a56a61d3fd2493f16dac]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat.LOG1 File Size: 94208 BYTES FileVersion: N/A MD5: [044580c8b2c5bbc144158df6f75fa70d]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat.LOG2 File Size: 569344 BYTES FileVersion: N/A MD5: [7281d5c1eebc1fac15e593850dce4589]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [98d931e4d1f33fda69f6bd8e23925b7f]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [e9897af43c5b038e280125234e83e662]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat File Size: 1474560 BYTES FileVersion: N/A MD5: [8024b722285aaf3fa0094aff5c59e718]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat.LOG1 File Size: 634880 BYTES FileVersion: N/A MD5: [12991ffddde2d8c861a2ef93f69aa72f]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat.LOG2 File Size: 16384 BYTES FileVersion: N/A MD5: [26b6a0842eecb4f9d72dfe251cf7f615]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [fba12a1a28f34d43f13de017033d08f2]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [e814135258c24add4119aabb1db0bafe]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat File Size: 1478656 BYTES FileVersion: N/A MD5: [5184759010cc9a5299c4e5b881864b37]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat.LOG1 File Size: 618496 BYTES FileVersion: N/A MD5: [eb1ea80e80ac81799adb3619c17ab3d1]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat.LOG2 File Size: 8192 BYTES FileVersion: N/A MD5: [78c4fa70f03a23518e2e91d0466587ef]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [4bdb135aa24c26b13ea4f6052799e1b4]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [3797bbde08845bcedbda757e7fd1af16]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat File Size: 1482752 BYTES FileVersion: N/A MD5: [4b4bc2246e2c5cc1009e36df5cd08b81]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat.LOG1 File Size: 225280 BYTES FileVersion: N/A MD5: [26a024ac1268ac8ae931e46b27dcbf35]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat.LOG2 File Size: 417792 BYTES FileVersion: N/A MD5: [5e5ac93b13a971dbc5377ca342cbe759]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [84800fdf96a01e2b6ad91a33b1ac1035]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [bde9d199371386ae7b8acc400d24ddc4]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat File Size: 1486848 BYTES FileVersion: N/A MD5: [4c14a1d143f6ee22c782a4b34be9fc0b]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat.LOG1 File Size: 671744 BYTES FileVersion: N/A MD5: [fd2f134b1f086613378020e943a1ec14]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat.LOG2 File Size: 0 BYTES FileVersion: N/A MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TM.blf File Size: 65536 BYTES FileVersion: N/A MD5: [f1d06ffa7126d9c6a7104459a19f437b]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [7b4a055edccc0410a78566b71cd345b4]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms File Size: 524288 BYTES FileVersion: N/A MD5: [59071590099d21dd439896592338bf95]
swissarmy.ref File Size: 21903 BYTES FileVersion: N/A MD5: [68cc3f4cebf0705040feee779c643c8e]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Configuration
build.conf File Size: 194 BYTES FileVersion: N/A MD5: [01dd2fbf24bfb8fc2536095eb00acb5b]
database.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]
gatekeeper.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]
license.conf File Size: 573 BYTES FileVersion: N/A MD5: [6533c5568b403e8733a23fa8e231d210]
manifest.conf File Size: 2133 BYTES FileVersion: N/A MD5: [5ec7491212d5b62725246dcbc0fca59e]
marketing.conf File Size: 1434 BYTES FileVersion: N/A MD5: [19533c40d9c9778b2ab423dbcf063d80]
net.conf File Size: 333 BYTES FileVersion: N/A MD5: [b576a0e7c7c483ebed18a884d7c8945e]
notifications.conf File Size: 4 BYTES FileVersion: N/A MD5: [2261e7eca4cd0615a97263c0ad5045c2]
scheduler.conf File Size: 3560 BYTES FileVersion: N/A MD5: [db3ba362555a1f6544572e7abe4105c5]
settings.conf File Size: 1975 BYTES FileVersion: N/A MD5: [dff1ce75f5c62dddfefc2af5eeefcea1]
statistics.conf File Size: 597 BYTES FileVersion: N/A MD5: [fa51cb4303462862730bfec3e07d250b]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs
mbam-log-2014-07-02 (05-37-23).xml File Size: 2480 BYTES FileVersion: N/A MD5: [f0860c31a50545886f522dc0065e6b36]
mbam-log-2014-07-04 (10-08-48).xml File Size: 2480 BYTES FileVersion: N/A MD5: [b01af37b8d8b2ff93409c28809c77bae]
mbam-log-2014-07-06 (17-20-06).xml File Size: 2480 BYTES FileVersion: N/A MD5: [198bc1155af42a83248762304264e550]
mbam-log-2014-07-08 (18-15-12).xml File Size: 2480 BYTES FileVersion: N/A MD5: [cf59bc88413237e63aefcd0d57d26c99]
mbam-log-2014-07-10 (14-55-11).xml File Size: 2482 BYTES FileVersion: N/A MD5: [ce08bcd85e4f45f52fc824f221914d2e]
mbam-log-2014-07-11 (14-45-56).xml File Size: 2480 BYTES FileVersion: N/A MD5: [03f03869fdb7036e103a3581abf117c9]
mbam-log-2014-07-14 (11-11-06).xml File Size: 2480 BYTES FileVersion: N/A MD5: [7b61e8032c7139f315c13d80958a6737]
mbam-log-2014-07-15 (11-59-08).xml File Size: 2480 BYTES FileVersion: N/A MD5: [190fbf0e33fbeaf94b9128c088c65269]
mbam-log-2014-07-16 (11-07-15).xml File Size: 2480 BYTES FileVersion: N/A MD5: [c4f23f5a929fa9c1310ffea6d471b301]
mbam-log-2014-07-17 (18-49-53).xml File Size: 2480 BYTES FileVersion: N/A MD5: [a7cf455ddeec6445faf7ead514141aa4]
mbam-log-2015-03-03 (14-19-26).xml File Size: 2474 BYTES FileVersion: N/A MD5: [7c08691c88836b275fa976ea45051a41]
mbam-log-2015-03-03 (15-13-56).xml File Size: 2474 BYTES FileVersion: N/A MD5: [57bb5756a737d08a59a0c1ef4965c425]
protection-log-2014-06-25.xml File Size: 4755 BYTES FileVersion: N/A MD5: [6a6ba3f9191502e108e7083c716d576f]
protection-log-2014-06-27.xml File Size: 2112 BYTES FileVersion: N/A MD5: [67f885f5ec15ab5fef8ec1d38fd5050e]
protection-log-2014-06-28.xml File Size: 3281 BYTES FileVersion: N/A MD5: [d11b95d9b66f1fe99010514ca6a276ce]
protection-log-2014-07-02.xml File Size: 9862 BYTES FileVersion: N/A MD5: [16ba74d628a6f900dea0f9c4c91002a6]
protection-log-2014-07-03.xml File Size: 8223 BYTES FileVersion: N/A MD5: [1b2a7e95598399d50673bfac6fb143a6]
protection-log-2014-07-04.xml File Size: 21529 BYTES FileVersion: N/A MD5: [1066272ee8b08219bf01430a2be5aa7d]
protection-log-2014-07-05.xml File Size: 2110 BYTES FileVersion: N/A MD5: [565177150da82da687ced8f491e704c9]
protection-log-2014-07-06.xml File Size: 2109 BYTES FileVersion: N/A MD5: [48c5db4acb7f1f6595e0fcae30154bd8]
protection-log-2014-07-07.xml File Size: 14415 BYTES FileVersion: N/A MD5: [c352467d2ee0e1fd713135edd2d07047]
protection-log-2014-07-08.xml File Size: 14838 BYTES FileVersion: N/A MD5: [4960bc0f3a0f7e0bd1b7f33b1859778b]
protection-log-2014-07-09.xml File Size: 10452 BYTES FileVersion: N/A MD5: [f376d745fb29107a63b1d3a63c3f79e4]
protection-log-2014-07-10.xml File Size: 3588 BYTES FileVersion: N/A MD5: [bfa6d1a28f268b72dd6d7dc8744bbe6c]
protection-log-2014-07-11.xml File Size: 6217 BYTES FileVersion: N/A MD5: [1adba58d5d46661ee5babe519cfee22c]
protection-log-2014-07-13.xml File Size: 8270 BYTES FileVersion: N/A MD5: [f2a1713de43ebf36c24044621cad8dcd]
protection-log-2014-07-14.xml File Size: 10323 BYTES FileVersion: N/A MD5: [f8807c44cbabd77440a8d60355860e96]
protection-log-2014-07-15.xml File Size: 4474 BYTES FileVersion: N/A MD5: [1f43a87b631162a3d382588781b4dd3b]
protection-log-2014-07-16.xml File Size: 10326 BYTES FileVersion: N/A MD5: [37ecfe715087e046d6be81a1a645cf07]
protection-log-2014-07-17.xml File Size: 2111 BYTES FileVersion: N/A MD5: [4c4cbd7cddc112cc2eb52924fe7b6b88]
protection-log-2014-07-18.xml File Size: 2112 BYTES FileVersion: N/A MD5: [47e69f65115acc7b31dd13487f6ec74a]
C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Quarantine
Malware Exclusions:
===================
Web Exclusions:
================
Quarantined Items:
===================
Unable to access quarantine information: Error code 20002===============================================================
END OF FILE
Gruß
bD |
So funktioniert es:
AdwCleaner auf deinen Desktop.
SecurityCheck und:
