| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
10.02.2015, 14:17
| #1 |
| |  Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Sehr geehrtes Trojaner-Board Team! Erstmal vielen lieben Dank dafür, dass Sie hier den support anbieten! Zum Problem: Gestern habe ich mehrere Bedrohungen eingefangen. Diese habe ich versucht mit diversen Programmen zu entfernen. Nun habe ich mit Malwarebytes mehr ale 200 Bedrohungen gefunden. Daraufhin habe ich Ihre Regeln befolgt und die Analyse mit den Programmen "defogger, FRST und Gmer" durchgeführt. Die entsprechenden log-Dateien, sowie die log-Datei von Malwarebytes stelle ich nachfolgend ins Forum mit der großen Bitte mir eventl. hierzu weiter zu helfen. Vielen DANK und Grüße davide0308 Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 10.02.2015 Suchlauf-Zeit: 11:16:31 Logdatei: Malware_10_02_2015.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.10.06 Rootkit Datenbank: v2015.02.03.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Da Wee Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 382489 Verstrichene Zeit: 30 Min, 10 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 4 PUP.Optional.WindowsProtectManger.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 1540, , [3a94c4586822de5809bf6600659b3fc1] PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, 2108, , [efdf48d44e3c5dd90707fd0d3fc338c8] PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\CmdShell.exe, 4800, , [329c0a1284065adcca821b726c9714ec] PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\HPNotify.exe, 5060, , [329c0a1284065adcca821b726c9714ec] Module: 9 PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowerWatchFF.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowserAction.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\IeWatchDog.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec], Registrierungsschlüssel: 9 PUP.Optional.WindowsProtectManger.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, , [3a94c4586822de5809bf6600659b3fc1], PUP.Optional.XTab.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHProtect Service, , [efdf48d44e3c5dd90707fd0d3fc338c8], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [537bb16b8406f4429e8719ee28db936d], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, , [537bb16b8406f4429e8719ee28db936d], PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, , [19b551cbb7d3231390bb830a4cb74ab6], PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\mystartsearchSoftware, , [65697f9da3e776c09491eaaba45f14ec], PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, , [953956c6b0dad0669f0cd82fb451fb05], PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, , [894524f8d9b1d0660511c2e18d767789], PUP.Optional.WindowsMangerProtect.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, , [06c853c9e1a9d0660d3eb1e7b94a06fa], Registrierungswerte: 2 PUP.Optional.FFToolbar.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|fftoolbar2014@etech.com, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com, , [8b436ab20d7d85b1509585071be8ac54] PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, smt, , [894524f8d9b1d0660511c2e18d767789] Registrierungsdaten: 14 PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[69658e8e038745f1678066467d889868] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[fad4fb21d8b2eb4bd9587f2e46bfe719] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[834b809c8307ea4ce64abbf27b8a728e] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[c40a58c4a4e673c308b11b9f51b458a8] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[a727bc6092f836001b17fdb03dc8649c] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[2ca29b81098137ff65821f8db64f22de] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[725ca874d3b7c373a78aab02fc09e41c] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[379726f6f39745f10b2504a99075d52b] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[7f4f5dbfc4c6fb3bd4e5308a38cd9868] PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[4c82e03c0585e94dbd75e7c658ad6799] PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[7a5485971a703afc1a9d7d3d09fcfb05] PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346),,[488619037f0b58de83b0f4b99f66be42] PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[5e7061bbe1a9c76fd85d04a964a1f50b] PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}),,[8648e23a96f48ea8e054a10c1de8e818] Ordner: 40 PUP.Optional.XTab.A, C:\Program Files (x86)\XTab, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\image, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\weather, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MindSpark.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\FromDocToPDF_65, , [e1edc953d9b1ab8bbbb544157c87a25e], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, , [fdd12af296f492a484d90d5aa3606f91], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, , [fdd12af296f492a484d90d5aa3606f91], PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, , [a6283ae258326dc93aca6a1a2ad9ad53], PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, , [a6283ae258326dc93aca6a1a2ad9ad53], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\content, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\skin, , [339b0f0d92f8ba7c959df98b6b98a65a], Dateien: 124 PUP.Optional.WindowsProtectManger.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, , [3a94c4586822de5809bf6600659b3fc1], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ProtectService.exe, , [efdf48d44e3c5dd90707fd0d3fc338c8], PUP.Optional.SupTab.A, C:\Program Files (x86)\XTab\SupTab.dll, , [537bb16b8406f4429e8719ee28db936d], PUP.Optional.OpenCandy, C:\$Recycle.Bin\S-1-5-21-206210334-1080461088-3002721162-1002\$RXXSV1E.exe, , [339b74a8e2a843f3b2b17966dc29847c], PUP.Optional.Wajam.A, C:\Users\Da Wee\AppData\Local\Temp\E0A3.tmp, , [7a5447d5d0bab87e7a650d0adb278080], PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nse2813.tmp, , [a02ecb516a20e35395940a1652b39070], PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nsi42A5.tmp, , [a5299587fd8d75c1e44557c94db8629e], PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nso39BB.tmp, , [a727d4486b1f0e287faaa67a07feac54], PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\nsvF023.tmp, , [b01ee13ba8e2bb7bec3d61bfc93c5fa1], PUP.Optional.Somoto, C:\Users\Da Wee\AppData\Local\Temp\bitool.dll, , [21ade9330585e551728c8d3580827e82], PUP.Optional.Wajam.A, C:\Users\Da Wee\AppData\Local\Temp\3307.tmp, , [c40ac15b5931da5c2cb31007c63ca858], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Local\Temp\setup.exe, , [25a99e7e65258ea86028d31e11f4768a], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\uninstall.exe, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowerWatchCH.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowerWatchFF.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\BrowserAction.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\CmdShell.exe, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\conf, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\HPNotify.exe, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\IeWatchDog.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\install.data, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcp110.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\msvcr110.dll, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\searchProvider.xml, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\about_bk.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\btn_apply.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\close.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf.xml, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\conf_back.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\input_bk.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\logo.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\main.xml, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_1.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\radio_2.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\rigth_arrow.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\skin\settings.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\data.html, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE.html, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\indexIE8.html, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\main.css, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\ver.txt, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\arrow.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\default_add_logo.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\default_add_logo_hover.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\default_logo.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\googlelogo.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\googlelogo2.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\google_trends.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon128.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon16.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\icon48.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\loading.gif, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\logo32.ico, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\img\weather\0.png, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\common.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\ga.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\ie8.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery-1.11.0.min.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\jquery.autocomplete.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\js.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\library.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit-ie8.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\js\xagainit2.0.js, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\en-US\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-419\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\es-ES\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-BE\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CA\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-CH\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-FR\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\fr-LU\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-CH\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\it-IT\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pl\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\pt-BR\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\ru-MO\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\tr-TR\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\vi-VI\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-CN\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.XTab.A, C:\Program Files (x86)\XTab\web\_locales\zh-TW\messages.json, , [329c0a1284065adcca821b726c9714ec], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\MessageBox.xml, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\422.json, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\uninstallDlg2.xml, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\UninstallManager.exe, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\bg.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\bg1.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\bk_shadow.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\button.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\button1.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\checkbox.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\checkbox_select.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\checked.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\close.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\loading_bg.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\loading_light.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\min.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\scrollbar.bmp, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\Thumbs.db, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\unchecked.png, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code1.jpg, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code2.jpg, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code3.jpg, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code4.jpg, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code5.jpg, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\code6.jpg, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\images\code\Thumbs.db, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log\UninstallManager_2015-02-09[17-53-28-696].log, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log\UninstallManager_2015-02-09[17-54-03-617].log, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\mystartsearch\log\UninstallManager_2015-02-09[18-19-14-329].log, , [616d83997713c96d1b74ade5709306fa], PUP.Optional.MyStartSearch.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\searchplugins\mystartsearch.xml, , [775779a32466162041e3791ca162b24e], PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, , [fdd12af296f492a484d90d5aa3606f91], PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update\conf, , [a6283ae258326dc93aca6a1a2ad9ad53], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome.manifest, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\install.rdf, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\content\toolbar.xul, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.FFToolbar.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com\chrome\skin\icon.png, , [339b0f0d92f8ba7c959df98b6b98a65a], PUP.Optional.QuickStart.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), ,[7e50b16ba1e9af878276f6fdf80de61a] Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:16 on 10/02/2015 (Da Wee)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015 Ran by Da Wee (administrator) on DAWEE-PC on 10-02-2015 12:21:59 Running from C:\Users\Da Wee\Downloads Loaded Profiles: UpdatusUser & Da Wee & (Available profiles: UpdatusUser & Da Wee) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (XTab system) C:\Program Files (x86)\XTab\ProtectService.exe (Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE () C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe (SearchProtect) C:\Program Files (x86)\XTab\CmdShell.exe (CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe (XTab system) C:\Program Files (x86)\XTab\HPNotify.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe () C:\Users\Da Wee\Downloads\Defogger.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.) HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.) HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.) HKLM-x32\...\Run: [ArcadeMovieService] => C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-08-26] (CyberLink Corp.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-01] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries) HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-21-206210334-1080461088-3002721162-1000\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-21-206210334-1080461088-3002721162-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2015-02-01] (SUPERAntiSpyware) HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] () HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd) HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2015-02-01] (SUPERAntiSpyware) HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] () HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries) HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd) HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries) HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [241984 2011-10-16] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-16] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe () Startup: C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. ProxyServer: [.DEFAULT] => http=127.0.0.1:53101;https=127.0.0.1:53101 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1423502226&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423492772&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms} SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&ts=1423502338&type=default&q={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1423492425&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346 FireFox: ======== FF ProfilePath: C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default FF NewTab: chrome://quick_start/content/index.html FF DefaultSearchEngine: mystartsearch FF SelectedSearchEngine: mystartsearch FF Homepage: hxxp://www.google.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-206210334-1080461088-3002721162-1002: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF Plugin HKU\S-1-5-21-206210334-1080461088-3002721162-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF SearchPlugin: C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\searchplugins\mystartsearch.xml FF Extension: FF Toolbar - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\fftoolbar2014@etech.com [2015-02-09] FF Extension: [verify-U]-Add-on - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\verify-u_2@cybits.de [2012-11-18] FF Extension: Garmin Communicator - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-07] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-02-01] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-02-01] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2015-02-01] FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\extensions\fftoolbar2014@etech.com ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-13] (SUPERAntiSpyware.com) R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries) R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation) R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [487056 2015-02-09] (SysTool PasSame LIMITED) S2 [verify-U]; C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-10] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed] S1 [verify-U]_System; C:\Windows\SysWOW64\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG) [File not signed] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-10 12:21 - 2015-02-10 12:22 - 00025151 _____ () C:\Users\Da Wee\Downloads\FRST.txt 2015-02-10 12:21 - 2015-02-10 12:22 - 00000000 ____D () C:\FRST 2015-02-10 12:20 - 2015-02-10 12:20 - 02132992 _____ (Farbar) C:\Users\Da Wee\Downloads\FRST64.exe 2015-02-10 12:16 - 2015-02-10 12:16 - 00000474 _____ () C:\Users\Da Wee\Downloads\defogger_disable.log 2015-02-10 12:16 - 2015-02-10 12:16 - 00000000 _____ () C:\Users\Da Wee\defogger_reenable 2015-02-10 12:15 - 2015-02-10 12:15 - 00050477 _____ () C:\Users\Da Wee\Downloads\Defogger.exe 2015-02-10 11:49 - 2015-02-10 11:50 - 00000000 ____D () C:\Users\Da Wee\Desktop\Sicherung 2015-02-10 11:15 - 2015-02-10 11:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-10 11:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-10 11:15 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-10 11:13 - 2015-02-10 11:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Da Wee\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-09 19:15 - 2015-02-10 10:24 - 00003272 _____ () C:\Windows\PFRO.log 2015-02-09 19:15 - 2015-02-10 10:24 - 00000112 _____ () C:\Windows\setupact.log 2015-02-09 19:15 - 2015-02-09 19:15 - 00000000 _____ () C:\Windows\setuperr.log 2015-02-09 19:14 - 2015-02-09 19:14 - 00000789 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 02-09-2015 - 19-07-30.log 2015-02-09 18:04 - 2015-02-09 18:04 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Apps\2.0 2015-02-09 16:48 - 2015-02-09 16:48 - 00000000 ____D () C:\Users\Da Wee\Documents\SICHERUNG 2015-02-09 15:36 - 2015-02-09 15:36 - 00000000 ____D () C:\ProgramData\IHProtectUpDate 2015-02-09 15:35 - 2015-02-09 18:19 - 00000000 ____D () C:\Program Files (x86)\XTab 2015-02-09 15:35 - 2015-02-09 15:35 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect 2015-02-09 15:34 - 2015-02-09 18:21 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\mystartsearch 2015-02-09 15:32 - 2015-02-09 16:44 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\DAEMON Tools Lite 2015-02-09 15:30 - 2015-02-09 16:31 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite 2015-02-09 13:32 - 2015-02-09 13:32 - 00002148 _____ () C:\Users\Public\Desktop\WISO steuer Start 2015.lnk 2015-02-09 13:29 - 2015-02-09 13:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO steuer Start 2015 2015-02-01 10:30 - 2015-02-01 10:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-16 20:12 - 2015-01-16 20:12 - 00001597 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 01-16-2015 - 20-04-49.log 2015-01-16 19:48 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-16 19:48 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-16 19:48 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-16 19:48 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-16 19:48 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-01-16 19:48 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-16 19:47 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-16 19:47 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-01-16 19:47 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-01-16 19:47 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-01-16 19:47 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-01-16 19:47 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-01-16 19:47 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-10 12:16 - 2012-02-03 20:35 - 00000000 ____D () C:\Users\Da Wee 2015-02-10 11:52 - 2011-11-17 13:03 - 01070415 _____ () C:\Windows\WindowsUpdate.log 2015-02-10 11:37 - 2012-07-06 20:10 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\Malwarebytes 2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2015-02-10 10:41 - 2012-02-03 21:11 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2015-02-10 10:39 - 2013-08-27 20:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2015-02-10 10:34 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-10 10:34 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-10 10:27 - 2012-02-04 10:35 - 00000000 ____D () C:\ProgramData\clear.fi 2015-02-10 10:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-09 18:21 - 2012-02-03 21:03 - 00001146 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-02-09 18:21 - 2012-02-03 21:03 - 00001134 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-02-09 18:21 - 2012-02-03 20:39 - 00001425 _____ () C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-02-09 18:18 - 2011-11-17 21:55 - 00699682 _____ () C:\Windows\system32\perfh007.dat 2015-02-09 18:18 - 2011-11-17 21:55 - 00149790 _____ () C:\Windows\system32\perfc007.dat 2015-02-09 18:18 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-09 16:37 - 2012-02-05 22:07 - 00000793 _____ () C:\Windows\wiso.ini 2015-02-09 13:39 - 2012-02-05 21:18 - 00000000 ____D () C:\Users\Da Wee\Documents\Steuer 2015-02-09 13:24 - 2012-02-05 21:57 - 00000000 ____D () C:\Program Files (x86)\WISO 2015-02-09 13:24 - 2011-10-14 04:15 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-02-09 10:24 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-02-06 18:20 - 2012-02-03 21:22 - 00000000 ____D () C:\Program Files\CCleaner 2015-02-06 17:37 - 2012-07-06 20:10 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-02-06 17:37 - 2012-04-09 09:02 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-06 17:37 - 2011-10-14 04:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-02-02 18:09 - 2012-04-28 21:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-26 18:10 - 2014-06-24 19:33 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Adobe 2015-01-16 20:14 - 2013-08-18 19:55 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-16 20:14 - 2012-02-04 19:27 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe ==================== Files in the root of some directories ======= 2011-11-17 13:30 - 2011-11-17 13:32 - 0015230 _____ () C:\ProgramData\ArcadeDeluxe5.log Some content of TEMP: ==================== C:\Users\Da Wee\AppData\Local\Temp\bitool.dll C:\Users\Da Wee\AppData\Local\Temp\setup.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-08 10:06 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by Da Wee at 2015-02-10 12:23:25
Running from C:\Users\Da Wee\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.100 - NTI Corporation)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1904 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3504 - Acer Incorporated)
Acer Games (HKLM-x32\...\WildTangent acer Master Uninstall) (Version: 1.0.2.5 - WildTangent)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3504 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0913.2011 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3500 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 14.8.4.1 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
clear.fi (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 1.0.2024.00 - CyberLink Corp.)
clear.fi (x32 Version: 1.0.1517_36458 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 1.0.2024.00 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 9.0.8026 - CyberLink Corp.) Hidden
clear.fi Client (HKLM-x32\...\{43AAE145-83CF-4C96-9A5E-756CEFCE879F}) (Version: 1.00.3500 - Acer Incorporated)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.7 - Dolby Laboratories Inc)
eBay Worldwide (HKLM-x32\...\{D3E5A972-9A15-427D-AE78-8181A5FD943C}) (Version: 2.2.0409 - OEM)
Elevated Installer (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
ETDWare PS/2-X64 8.0.6.3_WHQL (HKLM\...\Elantech) (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
Evernote v. 4.5.1 (HKLM-x32\...\{28921580-E4BB-11E0-9FD7-1CC1DEF07CBE}) (Version: 4.5.1.5451 - Evernote Corp.)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free FLV Converter V 7.5.0 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.5.0.0 - Koyote Soft)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Garmin Express (HKLM-x32\...\{817c6bb8-ea2d-4e12-abbc-e33c3de43f64}) (Version: 3.2.16.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Java 7 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Acer Inc.)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden
Nero Burning ROM 11 (HKLM-x32\...\{E656D89A-8CBB-497F-918F-8361A4071C26}) (Version: 11.0.10400 - Nero AG)
newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9002 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9002 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 285.64 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 285.64 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}) (Version: 9.10.0514 - NVIDIA Corporation)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6438 - Realtek Semiconductor Corp.)
Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.)
Samsung AllShare (x32 Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.) Hidden
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
StreamTransport version: 1.0.2.2171 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.0.1142 - SUPERAntiSpyware.com)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.18051 - TeamViewer)
Torchlight (x32 Version: 2.2.0.97 - WildTangent) Hidden
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3504 - Acer Incorporated)
WildTangent Games App (Acer Games) (x32 Version: 4.0.5.14 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 4.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)
WISO Steuer 2012 (HKLM-x32\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7303 - Buhl Data Service GmbH)
WISO Steuer 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
WISO Steuer 2014 (HKLM-x32\...\{DE0C16AA-A72B-4197-B40F-1B7E52E9EE35}) (Version: 21.00.8480 - Buhl Data Service GmbH)
WISO steuer:Start 2015 (HKLM-x32\...\{E1B43AA8-73CC-498F-9E3E-BA9F0008146B}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
16-12-2014 18:17:55 Windows Update
18-12-2014 19:00:18 Windows Update
19-12-2014 21:48:05 Installiert WISO steuer:Start 2015
22-12-2014 15:03:19 Windows Update
29-12-2014 14:00:29 Windows Update
07-01-2015 11:06:56 Windows Update
11-01-2015 10:22:07 Windows Update
16-01-2015 19:47:42 Windows Update
16-01-2015 20:13:39 Windows Update
26-01-2015 17:43:23 Windows Update
01-02-2015 10:20:40 Windows Update
05-02-2015 18:23:11 Windows Update
09-02-2015 10:36:16 Windows Update
09-02-2015 13:14:30 Entfernt WISO steuer:Start 2015
09-02-2015 13:24:02 Installiert WISO steuer:Start 2015
09-02-2015 15:32:20 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
09-02-2015 15:37:23 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
09-02-2015 17:49:59 Removed Apple Application Support
09-02-2015 17:51:35 Removed Apple Mobile Device Support
09-02-2015 18:15:54 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
10-02-2015 10:28:38 Removed iTunes
10-02-2015 10:34:40 Removed iTunes
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {19A64B5B-FFF2-4774-9BF1-EC54A8E4D149} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3DD17974-5CB1-40F2-9CB9-DE0649FA0AB1} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-08-24] (CyberLink)
Task: {3F044062-13A5-41E3-8DCC-57750A9AFD06} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-07-23] ()
Task: {50A05B06-FCE2-4213-AC40-7F918B810D8F} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-08-24] (CyberLink Corp.)
Task: {542DD518-C15C-42B6-96A2-0D30B7A5A282} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5502789F-A822-4A18-BB65-E00B5F778DEC} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-08-24] (Acer Incorporated)
Task: {7E0D7E15-EDCA-470A-A964-82B9731D6095} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2011-08-09] (Acer)
Task: {8137E10E-10ED-42F1-A0B9-445E1841F50A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {B3136869-CD7A-4445-80C7-7D39ACAB3F8F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {DB18FC88-3F4F-4B8B-B1A2-651749EB6826} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2009-01-21 16:45 - 2009-01-21 16:45 - 01401856 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2012-02-24 21:47 - 2012-02-17 20:55 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2011-10-14 04:57 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2015-01-21 03:06 - 2015-01-21 03:06 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-02-10 12:15 - 2015-02-10 12:15 - 00050477 _____ () C:\Users\Da Wee\Downloads\Defogger.exe
2012-01-05 14:22 - 2012-01-05 14:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2011-08-24 18:03 - 2011-08-24 18:03 - 00206216 _____ () C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
2014-10-22 19:28 - 2014-10-22 19:28 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\c152a64e30c5b94894d75ac86aa7aad2\IsdiInterop.ni.dll
2011-10-14 04:15 - 2011-04-30 08:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 01135616 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMSWrap.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00656896 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ContentDirectoryPresenter.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00105472 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMCDP.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00098816 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\FolderCDP.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00077312 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MetadataFramework.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00520234 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\sqlite3.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00450560 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MoodExtractor.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 05717504 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMImgExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00029184 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AutoChaptering.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00147456 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexpat.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoThumb.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 04671488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avcodec-52.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00070656 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avutil-50.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00686080 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avformat-52.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00152064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\swscale-0.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00027648 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AudioExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00063488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ID3Driver.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00366592 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\tag.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00289792 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libThumbnail.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00023040 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RichInfoDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ThumbnailMaker.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00133120 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoMetadataDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00290304 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libKeyFrame.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\SECMetaDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ImageExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\photoDriver.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00399826 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexif-12.dll.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00013824 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\TextExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00031232 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\Autobackup.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00054784 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RosettaAllShare.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00044032 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\us.dll
2015-02-01 10:30 - 2015-02-01 10:31 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
2013-07-10 17:07 - 2013-07-10 17:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Registry Areas =====================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-206210334-1080461088-3002721162-500 - Administrator - Disabled)
Da Wee (S-1-5-21-206210334-1080461088-3002721162-1002 - Administrator - Enabled) => C:\Users\Da Wee
Gast (S-1-5-21-206210334-1080461088-3002721162-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-206210334-1080461088-3002721162-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-206210334-1080461088-3002721162-1000 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/10/2015 10:25:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/09/2015 07:16:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/09/2015 07:12:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 161617
Error: (02/09/2015 07:12:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 161617
Error: (02/09/2015 07:12:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/09/2015 07:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3557
Error: (02/09/2015 07:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3557
Error: (02/09/2015 07:09:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/09/2015 07:09:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2371
Error: (02/09/2015 07:09:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2371
System errors:
=============
Error: (02/10/2015 10:25:28 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet:
%%2
Error: (02/10/2015 10:25:24 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
[verify-U]_System
Error: (02/10/2015 10:24:37 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\[verify-U]-driver.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (02/09/2015 07:16:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet:
%%2
Error: (02/09/2015 07:16:12 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
[verify-U]_System
Error: (02/09/2015 07:15:22 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\[verify-U]-driver.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (02/09/2015 05:51:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/09/2015 05:51:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (02/09/2015 04:39:56 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet:
%%2
Error: (02/09/2015 04:39:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
[verify-U]_System
Microsoft Office Sessions:
=========================
Error: (03/11/2013 03:49:24 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 428 seconds with 360 seconds of active time. This session ended with a crash.
Error: (03/15/2012 07:51:40 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 294 seconds with 240 seconds of active time. This session ended with a crash.
Error: (03/11/2012 01:16:23 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5606 seconds with 540 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz
Percentage of memory in use: 37%
Total physical RAM: 8043.86 MB
Available physical RAM: 5045.2 MB
Total Pagefile: 16085.9 MB
Available Pagefile: 13246.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:578.07 GB) (Free:469.11 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: D5A70C26)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=578.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-02-10 13:07:07 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD64 rev.01.0 596,17GB Running: Gmer-19357.exe; Driver: C:\Users\DAWEE~1\AppData\Local\Temp\kwloapow.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448 fffff80003201000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 495 fffff8000320102f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...] ---- User code sections - GMER 2.1 ---- .text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\XTab\ProtectService.exe[2108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\XTab\ProtectService.exe[2108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3984] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[1368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[1368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Launch Manager\LManager.exe[352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Launch Manager\LManager.exe[352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\XTab\cmdshell.exe[4800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\XTab\cmdshell.exe[4800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\XTab\HPNotify.exe[5060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\XTab\HPNotify.exe[5060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[4356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[4356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [4356] entry point in ".rdata" section 00000000627f71e6 .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075b88791 5 bytes JMP 00000001588953fc .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 0000000075cc6143 5 bytes JMP 000000015935f68e .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 00000000753f3e59 5 bytes JMP 00000001588c10b7 .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 00000000753f3eae 5 bytes JMP 00000001588cb0be .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 00000000753f4731 5 bytes JMP 00000001588fb5dc .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000753f5dee 5 bytes JMP 00000001588fc50f ? C:\Windows\system32\mssprxy.dll [1736] entry point in ".rdata" section 00000000627f71e6 .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Program Files (x86)\Common Files\SYSTEM\MSMAPI\1031\MSMAPI32.DLL!HrDispatchNotifications@4 + 112 0000000065e81b80 4 bytes [32, 9D, F1, 74] .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Users\Da Wee\Downloads\Defogger.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Users\Da Wee\Downloads\Defogger.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 166 000000002f101afc 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 253 000000002f101b53 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 320 000000002f101b96 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 390 000000002f101bdc 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 738 000000002f101d38 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 937 000000002f101dff 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 958 000000002f101e14 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 970 000000002f101e20 2 bytes [10, 2F] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075b88791 5 bytes JMP 00000001588953fc .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 0000000075cc6143 5 bytes JMP 000000015935f68e .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 00000000753f3e59 5 bytes JMP 00000001588c10b7 .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 00000000753f3eae 5 bytes JMP 00000001588cb0be .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 00000000753f4731 5 bytes JMP 00000001588fb5dc .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000753f5dee 5 bytes JMP 00000001588fc50f .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ae1465 2 bytes [AE, 75] .text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ae14bb 2 bytes [AE, 75] .text ... * 2 ---- EOF - GMER 2.1 ---- |
|
10.02.2015, 14:35
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Hi und
__________________ das ist nur Adware... Zukünftig bitte beachten: Zitat:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind. Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen. Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter. Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
10.02.2015, 16:18
| #3 |
| | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Hi Cosinus,
__________________vielen Dank für die schneller Antwort und den Hinweis hinsichtl. dem Speicherort. Anbei die von dir erwähnten log-Dateien. Adwcleaner AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v4.110 - Bericht erstellt 10/02/2015 um 15:17:01
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-05.2 [Lokal]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Da Wee - DAWEE-PC
# Gestarted von : C:\Users\Da Wee\Desktop\AdwCleaner_4.110.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : WindowsMangerProtect
Dienst Gelöscht : IHProtect Service
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\ProgramData\IHProtectUpDate
Ordner Gelöscht : C:\Program Files (x86)\XTab
Ordner Gelöscht : C:\Users\Da Wee\AppData\Roaming\mystartsearch
Ordner Gelöscht : C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\fftoolbar2014@etech.com
Datei Gelöscht : C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\searchplugins\mystartsearch.xml
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [fftoolbar2014@etech.com]
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
Schlüssel Gelöscht : HKLM\SOFTWARE\SupTab
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\mystartsearchSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\IHProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17496
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Mozilla Firefox v35.0.1 (x86 de)
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.defaultenginename", "mystartsearch");
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.alias", "mystartsearch");
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/web/favicon.ico");
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.name", "mystartsearch");
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=dspp&ts=1423502293&from=smt&uid=WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346&q={searchTerms}");
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "mystartsearch");
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[nkbtpxnm.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
*************************
AdwCleaner[R0].txt - [7157 Bytes] - [10/02/2015 15:05:56]
AdwCleaner[S0].txt - [5210 Bytes] - [10/02/2015 15:17:01]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5269 Bytes] ##########
[/CODE] JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Home Premium x64
Ran by Da Wee on 10.02.2015 at 15:42:23,30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Da Wee\appdata\local\{27EC4CBF-DEED-4DD5-9635-A1E0F6DB796E}
Successfully deleted: [Empty Folder] C:\Users\Da Wee\appdata\local\{3A2C3BA4-45C1-4736-8A8A-7CC66FEDAE3E}
Successfully deleted: [Empty Folder] C:\Users\Da Wee\appdata\local\{90D22D3F-204B-4085-AD44-DF76F41A3A48}
Successfully deleted: [Empty Folder] C:\Users\Da Wee\appdata\local\{A8EA35E2-B3C2-4EF2-B147-A9FFB0C47196}
Successfully deleted: [Empty Folder] C:\Users\Da Wee\appdata\local\{D55598CD-1C8B-441D-8B13-1BD30EBDA487}
Successfully deleted: [Empty Folder] C:\Users\Da Wee\appdata\local\{E6DADBC8-20D2-49EA-BAF6-29CA8E7DCB8D}
~~~ FireFox
Successfully deleted the following from C:\Users\Da Wee\AppData\Roaming\mozilla\firefox\profiles\nkbtpxnm.default\prefs.js
user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");
user_pref("browser.search.searchengine.ptid", "smt");
user_pref("browser.search.searchengine.uid", "WDCXWD6400BPVT-22HXZT3_WD-WXR1A81C9346C9346");
Emptied folder: C:\Users\Da Wee\AppData\Roaming\mozilla\firefox\profiles\nkbtpxnm.default\minidumps [234 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.02.2015 at 15:51:02,54
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST64 FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by Da Wee (administrator) on DAWEE-PC on 10-02-2015 15:53:25
Running from C:\Users\Da Wee\Desktop
Loaded Profiles: UpdatusUser & Da Wee (Available profiles: UpdatusUser & Da Wee)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
() C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] => C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-08-26] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-01] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-206210334-1080461088-3002721162-1000\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2015-02-01] (SUPERAntiSpyware)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [241984 2011-10-16] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-16] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:53101;https=127.0.0.1:53101
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-206210334-1080461088-3002721162-1002: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Extension: [verify-U]-Add-on - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\verify-u_2@cybits.de [2012-11-18]
FF Extension: Garmin Communicator - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-02-01]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-02-01]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2015-02-01]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-13] (SUPERAntiSpyware.com)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 [verify-U]; C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-10] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S1 [verify-U]_System; C:\Windows\SysWOW64\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG) [File not signed]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-10 15:53 - 2015-02-10 15:54 - 00016367 _____ () C:\Users\Da Wee\Desktop\FRST.txt
2015-02-10 15:51 - 2015-02-10 15:51 - 00001768 _____ () C:\Users\Da Wee\Desktop\JRT.txt
2015-02-10 15:40 - 2015-02-10 15:40 - 00005365 _____ () C:\Users\Da Wee\Desktop\AdwCleaner[S0].txt
2015-02-10 15:05 - 2015-02-10 15:17 - 00000000 ____D () C:\AdwCleaner
2015-02-10 15:02 - 2015-02-10 15:02 - 00000246 _____ () C:\Users\Da Wee\Downloads\defogger_enable.log
2015-02-10 14:59 - 2015-02-10 15:00 - 01388274 _____ (Thisisu) C:\Users\Da Wee\Desktop\JRT.exe
2015-02-10 14:56 - 2015-02-10 14:57 - 02112512 _____ () C:\Users\Da Wee\Desktop\AdwCleaner_4.110.exe
2015-02-10 12:42 - 2015-02-10 12:42 - 00380416 _____ () C:\Users\Da Wee\Downloads\Gmer-19357.exe
2015-02-10 12:23 - 2015-02-10 12:24 - 00033314 _____ () C:\Users\Da Wee\Downloads\Addition.txt
2015-02-10 12:21 - 2015-02-10 15:53 - 00000000 ____D () C:\FRST
2015-02-10 12:21 - 2015-02-10 12:24 - 00034441 _____ () C:\Users\Da Wee\Downloads\FRST.txt
2015-02-10 12:20 - 2015-02-10 15:01 - 02132992 _____ (Farbar) C:\Users\Da Wee\Desktop\FRST64.exe
2015-02-10 12:16 - 2015-02-10 12:16 - 00000474 _____ () C:\Users\Da Wee\Downloads\defogger_disable.log
2015-02-10 12:15 - 2015-02-10 12:15 - 00050477 _____ () C:\Users\Da Wee\Downloads\Defogger.exe
2015-02-10 11:49 - 2015-02-10 13:06 - 00000000 ____D () C:\Users\Da Wee\Desktop\Sicherung
2015-02-10 11:15 - 2015-02-10 11:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-02-10 11:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-10 11:15 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-10 11:13 - 2015-02-10 11:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Da Wee\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-09 19:15 - 2015-02-10 15:18 - 00003644 _____ () C:\Windows\PFRO.log
2015-02-09 19:15 - 2015-02-10 15:18 - 00000168 _____ () C:\Windows\setupact.log
2015-02-09 19:15 - 2015-02-09 19:15 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-09 19:14 - 2015-02-09 19:14 - 00000789 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 02-09-2015 - 19-07-30.log
2015-02-09 18:04 - 2015-02-09 18:04 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Apps\2.0
2015-02-09 16:48 - 2015-02-09 16:48 - 00000000 ____D () C:\Users\Da Wee\Documents\SICHERUNG
2015-02-09 15:32 - 2015-02-09 16:44 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\DAEMON Tools Lite
2015-02-09 15:30 - 2015-02-09 16:31 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2015-02-09 13:32 - 2015-02-09 13:32 - 00002148 _____ () C:\Users\Public\Desktop\WISO steuer Start 2015.lnk
2015-02-09 13:29 - 2015-02-09 13:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO steuer Start 2015
2015-02-01 10:30 - 2015-02-01 10:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-16 20:12 - 2015-01-16 20:12 - 00001597 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 01-16-2015 - 20-04-49.log
2015-01-16 19:48 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-16 19:48 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-16 19:48 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-16 19:48 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-16 19:48 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-16 19:48 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-16 19:47 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-16 19:47 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-16 19:47 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-16 19:47 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-16 19:47 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-16 19:47 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-16 19:47 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-10 15:53 - 2011-11-17 13:03 - 01116660 _____ () C:\Windows\WindowsUpdate.log
2015-02-10 15:37 - 2012-07-06 20:10 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-10 15:28 - 2012-02-04 10:35 - 00000000 ____D () C:\ProgramData\clear.fi
2015-02-10 15:28 - 2012-02-03 21:11 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-02-10 15:26 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-10 15:26 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-10 15:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-10 15:02 - 2012-02-03 20:35 - 00000000 ____D () C:\Users\Da Wee
2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\Malwarebytes
2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-10 10:39 - 2013-08-27 20:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-02-09 18:21 - 2012-02-03 21:03 - 00001146 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-09 18:21 - 2012-02-03 21:03 - 00001134 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-09 18:21 - 2012-02-03 20:39 - 00001425 _____ () C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-09 18:18 - 2011-11-17 21:55 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-02-09 18:18 - 2011-11-17 21:55 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-02-09 18:18 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-09 16:37 - 2012-02-05 22:07 - 00000793 _____ () C:\Windows\wiso.ini
2015-02-09 13:39 - 2012-02-05 21:18 - 00000000 ____D () C:\Users\Da Wee\Documents\Steuer
2015-02-09 13:24 - 2012-02-05 21:57 - 00000000 ____D () C:\Program Files (x86)\WISO
2015-02-09 13:24 - 2011-10-14 04:15 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-09 10:24 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-06 18:20 - 2012-02-03 21:22 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-06 17:37 - 2012-07-06 20:10 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 17:37 - 2012-04-09 09:02 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 17:37 - 2011-10-14 04:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 18:09 - 2012-04-28 21:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 18:10 - 2014-06-24 19:33 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Adobe
2015-01-16 20:14 - 2013-08-18 19:55 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 20:14 - 2012-02-04 19:27 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2011-11-17 13:30 - 2011-11-17 13:32 - 0015230 _____ () C:\ProgramData\ArcadeDeluxe5.log
Some content of TEMP:
====================
C:\Users\Da Wee\AppData\Local\Temp\bitool.dll
C:\Users\Da Wee\AppData\Local\Temp\Quarantine.exe
C:\Users\Da Wee\AppData\Local\Temp\setup.exe
C:\Users\Da Wee\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-08 10:06
==================== End Of Log ============================
--- --- --- --- --- --- Gruß davide0308 |
|
10.02.2015, 23:12
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. 
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
11.02.2015, 08:45
| #5 |
| | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Guten Morgen Cosinus, anbei die beiden log-files: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by Da Wee (administrator) on DAWEE-PC on 11-02-2015 08:19:42
Running from C:\Users\Da Wee\Desktop
Loaded Profiles: UpdatusUser & Da Wee (Available profiles: UpdatusUser & Da Wee)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
() C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Program Files (x86)\Garmin\Express Self Updater\esu.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] => C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [177448 2011-08-26] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-01] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-206210334-1080461088-3002721162-1000\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2015-02-01] (SUPERAntiSpyware)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\MountPoints2: {a9c21fff-1113-11e1-8783-806e6f6e6963} - D:\start.exe /auto
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-07-23] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [241984 2011-10-16] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-16] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:53101;https=127.0.0.1:53101
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-206210334-1080461088-3002721162-1002: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Extension: [verify-U]-Add-on - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\verify-u_2@cybits.de [2012-11-18]
FF Extension: Garmin Communicator - C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-05-07]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-02-01]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-02-01]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2015-02-01]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-13] (SUPERAntiSpyware.com)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [438616 2014-07-23] (Garmin Ltd or its subsidiaries)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 [verify-U]; C:\Program Files (x86)\[verify-U] AVS\[verify-U]-Service.exe [143360 2008-01-28] (Cybit AG) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-10] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S1 [verify-U]_System; C:\Windows\SysWOW64\drivers\[verify-U]-driver.sys [16128 2007-11-07] (Cybits AG) [File not signed]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-10 15:54 - 2015-02-10 15:56 - 00028880 _____ () C:\Users\Da Wee\Desktop\Addition.txt
2015-02-10 15:53 - 2015-02-11 08:20 - 00016573 _____ () C:\Users\Da Wee\Desktop\FRST.txt
2015-02-10 15:51 - 2015-02-10 15:51 - 00001768 _____ () C:\Users\Da Wee\Desktop\JRT.txt
2015-02-10 15:40 - 2015-02-10 15:40 - 00005365 _____ () C:\Users\Da Wee\Desktop\AdwCleaner[S0].txt
2015-02-10 15:05 - 2015-02-10 15:17 - 00000000 ____D () C:\AdwCleaner
2015-02-10 15:02 - 2015-02-10 15:02 - 00000246 _____ () C:\Users\Da Wee\Downloads\defogger_enable.log
2015-02-10 14:59 - 2015-02-10 15:00 - 01388274 _____ (Thisisu) C:\Users\Da Wee\Desktop\JRT.exe
2015-02-10 14:56 - 2015-02-10 14:57 - 02112512 _____ () C:\Users\Da Wee\Desktop\AdwCleaner_4.110.exe
2015-02-10 12:42 - 2015-02-10 12:42 - 00380416 _____ () C:\Users\Da Wee\Downloads\Gmer-19357.exe
2015-02-10 12:23 - 2015-02-10 12:24 - 00033314 _____ () C:\Users\Da Wee\Downloads\Addition.txt
2015-02-10 12:21 - 2015-02-11 08:19 - 00000000 ____D () C:\FRST
2015-02-10 12:21 - 2015-02-10 12:24 - 00034441 _____ () C:\Users\Da Wee\Downloads\FRST.txt
2015-02-10 12:20 - 2015-02-10 15:01 - 02132992 _____ (Farbar) C:\Users\Da Wee\Desktop\FRST64.exe
2015-02-10 12:16 - 2015-02-10 12:16 - 00000474 _____ () C:\Users\Da Wee\Downloads\defogger_disable.log
2015-02-10 12:15 - 2015-02-10 12:15 - 00050477 _____ () C:\Users\Da Wee\Downloads\Defogger.exe
2015-02-10 11:49 - 2015-02-10 13:06 - 00000000 ____D () C:\Users\Da Wee\Desktop\Sicherung
2015-02-10 11:15 - 2015-02-10 11:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-02-10 11:15 - 2015-02-10 11:15 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-02-10 11:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-10 11:15 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-10 11:13 - 2015-02-10 11:13 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Da Wee\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-09 19:15 - 2015-02-11 08:08 - 00000224 _____ () C:\Windows\setupact.log
2015-02-09 19:15 - 2015-02-10 15:18 - 00003644 _____ () C:\Windows\PFRO.log
2015-02-09 19:15 - 2015-02-09 19:15 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-09 19:14 - 2015-02-09 19:14 - 00000789 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 02-09-2015 - 19-07-30.log
2015-02-09 18:04 - 2015-02-09 18:04 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Apps\2.0
2015-02-09 16:48 - 2015-02-09 16:48 - 00000000 ____D () C:\Users\Da Wee\Documents\SICHERUNG
2015-02-09 15:32 - 2015-02-09 16:44 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\DAEMON Tools Lite
2015-02-09 15:30 - 2015-02-09 16:31 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2015-02-09 13:32 - 2015-02-09 13:32 - 00002148 _____ () C:\Users\Public\Desktop\WISO steuer Start 2015.lnk
2015-02-09 13:29 - 2015-02-09 13:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO steuer Start 2015
2015-02-01 10:30 - 2015-02-01 10:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-16 20:12 - 2015-01-16 20:12 - 00001597 _____ () C:\Users\Da Wee\Desktop\SUPERAntiSpyware Scan Log - 01-16-2015 - 20-04-49.log
2015-01-16 19:48 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-16 19:48 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-16 19:48 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-16 19:48 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-16 19:48 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-16 19:48 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-16 19:47 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-16 19:47 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-16 19:47 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-16 19:47 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-16 19:47 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-16 19:47 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-16 19:47 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-11 08:18 - 2011-11-17 13:03 - 01271985 _____ () C:\Windows\WindowsUpdate.log
2015-02-11 08:16 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-11 08:16 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-11 08:10 - 2012-02-04 10:35 - 00000000 ____D () C:\ProgramData\clear.fi
2015-02-11 08:08 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-10 22:37 - 2012-07-06 20:10 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-10 19:35 - 2012-02-03 21:11 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-02-10 19:33 - 2012-02-05 22:07 - 00000793 _____ () C:\Windows\wiso.ini
2015-02-10 15:02 - 2012-02-03 20:35 - 00000000 ____D () C:\Users\Da Wee
2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\Users\Da Wee\AppData\Roaming\Malwarebytes
2015-02-10 11:15 - 2012-02-03 21:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-10 10:39 - 2013-08-27 20:15 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-02-09 18:21 - 2012-02-03 21:03 - 00001146 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-02-09 18:21 - 2012-02-03 21:03 - 00001134 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-02-09 18:21 - 2012-02-03 20:39 - 00001425 _____ () C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-09 18:18 - 2011-11-17 21:55 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-02-09 18:18 - 2011-11-17 21:55 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-02-09 18:18 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-09 13:39 - 2012-02-05 21:18 - 00000000 ____D () C:\Users\Da Wee\Documents\Steuer
2015-02-09 13:24 - 2012-02-05 21:57 - 00000000 ____D () C:\Program Files (x86)\WISO
2015-02-09 13:24 - 2011-10-14 04:15 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-09 10:24 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-06 18:20 - 2012-02-03 21:22 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-06 17:37 - 2012-07-06 20:10 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-06 17:37 - 2012-04-09 09:02 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-06 17:37 - 2011-10-14 04:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 18:09 - 2012-04-28 21:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 18:10 - 2014-06-24 19:33 - 00000000 ____D () C:\Users\Da Wee\AppData\Local\Adobe
2015-01-16 20:14 - 2013-08-18 19:55 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 20:14 - 2012-02-04 19:27 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2011-11-17 13:30 - 2011-11-17 13:32 - 0015230 _____ () C:\ProgramData\ArcadeDeluxe5.log
Some content of TEMP:
====================
C:\Users\Da Wee\AppData\Local\Temp\bitool.dll
C:\Users\Da Wee\AppData\Local\Temp\Quarantine.exe
C:\Users\Da Wee\AppData\Local\Temp\setup.exe
C:\Users\Da Wee\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-08 10:06
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-02-2015
Ran by Da Wee at 2015-02-11 08:22:57
Running from C:\Users\Da Wee\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.100 - NTI Corporation)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1904 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3504 - Acer Incorporated)
Acer Games (HKLM-x32\...\WildTangent acer Master Uninstall) (Version: 1.0.2.5 - WildTangent)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3504 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0913.2011 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-206210334-1080461088-3002721162-1002\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 14.8.4.1 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
clear.fi (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 1.0.2024.00 - CyberLink Corp.)
clear.fi (x32 Version: 1.0.1517_36458 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 1.0.2024.00 - CyberLink Corp.) Hidden
clear.fi (x32 Version: 9.0.8026 - CyberLink Corp.) Hidden
clear.fi Client (HKLM-x32\...\{43AAE145-83CF-4C96-9A5E-756CEFCE879F}) (Version: 1.00.3500 - Acer Incorporated)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.7 - Dolby Laboratories Inc)
eBay Worldwide (HKLM-x32\...\{D3E5A972-9A15-427D-AE78-8181A5FD943C}) (Version: 2.2.0409 - OEM)
Elevated Installer (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
ETDWare PS/2-X64 8.0.6.3_WHQL (HKLM\...\Elantech) (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
Evernote v. 4.5.1 (HKLM-x32\...\{28921580-E4BB-11E0-9FD7-1CC1DEF07CBE}) (Version: 4.5.1.5451 - Evernote Corp.)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free FLV Converter V 7.5.0 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.5.0.0 - Koyote Soft)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Garmin Express (HKLM-x32\...\{817c6bb8-ea2d-4e12-abbc-e33c3de43f64}) (Version: 3.2.16.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.16.0 - Garmin Ltd or its subsidiaries) Hidden
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Java 7 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle)
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Acer Inc.)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98 - WildTangent) Hidden
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden
Nero Burning ROM 11 (HKLM-x32\...\{E656D89A-8CBB-497F-918F-8361A4071C26}) (Version: 11.0.10400 - Nero AG)
newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9002 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9002 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 285.64 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 285.64 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}) (Version: 9.10.0514 - NVIDIA Corporation)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6438 - Realtek Semiconductor Corp.)
Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.)
Samsung AllShare (x32 Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.) Hidden
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
StreamTransport version: 1.0.2.2171 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.0.1142 - SUPERAntiSpyware.com)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.18051 - TeamViewer)
Torchlight (x32 Version: 2.2.0.97 - WildTangent) Hidden
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3504 - Acer Incorporated)
WildTangent Games App (Acer Games) (x32 Version: 4.0.5.14 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 4.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)
WISO Steuer 2012 (HKLM-x32\...\{0CC1DAFB-40C8-4903-953D-471E541477C7}) (Version: 19.00.7303 - Buhl Data Service GmbH)
WISO Steuer 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
WISO Steuer 2014 (HKLM-x32\...\{DE0C16AA-A72B-4197-B40F-1B7E52E9EE35}) (Version: 21.00.8480 - Buhl Data Service GmbH)
WISO steuer:Start 2015 (HKLM-x32\...\{E1B43AA8-73CC-498F-9E3E-BA9F0008146B}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
16-12-2014 18:17:55 Windows Update
18-12-2014 19:00:18 Windows Update
19-12-2014 21:48:05 Installiert WISO steuer:Start 2015
22-12-2014 15:03:19 Windows Update
29-12-2014 14:00:29 Windows Update
07-01-2015 11:06:56 Windows Update
11-01-2015 10:22:07 Windows Update
16-01-2015 19:47:42 Windows Update
16-01-2015 20:13:39 Windows Update
26-01-2015 17:43:23 Windows Update
01-02-2015 10:20:40 Windows Update
05-02-2015 18:23:11 Windows Update
09-02-2015 10:36:16 Windows Update
09-02-2015 13:14:30 Entfernt WISO steuer:Start 2015
09-02-2015 13:24:02 Installiert WISO steuer:Start 2015
09-02-2015 15:32:20 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
09-02-2015 15:37:23 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
09-02-2015 17:49:59 Removed Apple Application Support
09-02-2015 17:51:35 Removed Apple Mobile Device Support
09-02-2015 18:15:54 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
10-02-2015 10:28:38 Removed iTunes
10-02-2015 10:34:40 Removed iTunes
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {19A64B5B-FFF2-4774-9BF1-EC54A8E4D149} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3DD17974-5CB1-40F2-9CB9-DE0649FA0AB1} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-08-24] (CyberLink)
Task: {3F044062-13A5-41E3-8DCC-57750A9AFD06} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-07-23] ()
Task: {50A05B06-FCE2-4213-AC40-7F918B810D8F} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-08-24] (CyberLink Corp.)
Task: {542DD518-C15C-42B6-96A2-0D30B7A5A282} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5502789F-A822-4A18-BB65-E00B5F778DEC} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-08-24] (Acer Incorporated)
Task: {7E0D7E15-EDCA-470A-A964-82B9731D6095} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2011-08-09] (Acer)
Task: {8137E10E-10ED-42F1-A0B9-445E1841F50A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-06] (Adobe Systems Incorporated)
Task: {B3136869-CD7A-4445-80C7-7D39ACAB3F8F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {DB18FC88-3F4F-4B8B-B1A2-651749EB6826} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2011-10-14 04:57 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Da Wee\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2015-01-21 03:06 - 2015-01-21 03:06 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-05-10 17:41 - 2014-07-23 07:44 - 00024920 _____ () C:\Program Files (x86)\Garmin\Express Self Updater\esu.exe
2014-08-13 10:02 - 2014-08-13 10:02 - 00070144 _____ () C:\Windows\system32\config\systemprofile\AppData\Local\assembly\dl3\JO167BOH.JNQ\O4R43AZ4.2X4\787b95fc\009abe61_41a6cf01\Garmin.Cartography.Services.Rce.Core.Dto.DLL
2014-08-13 10:02 - 2014-08-13 10:02 - 00159232 _____ () C:\Windows\system32\config\systemprofile\AppData\Local\assembly\dl3\JO167BOH.JNQ\O4R43AZ4.2X4\e75bad7e\009abe61_41a6cf01\protobuf-net.DLL
2012-01-05 14:22 - 2012-01-05 14:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 14:22 - 2012-01-05 14:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2011-08-24 18:03 - 2011-08-24 18:03 - 00206216 _____ () C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
2014-10-22 19:28 - 2014-10-22 19:28 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\c152a64e30c5b94894d75ac86aa7aad2\IsdiInterop.ni.dll
2011-10-14 04:15 - 2011-04-30 08:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 01135616 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMSWrap.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00656896 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ContentDirectoryPresenter.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00105472 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMCDP.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00098816 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\FolderCDP.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00077312 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MetadataFramework.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00520234 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\sqlite3.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00450560 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\MoodExtractor.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 05717504 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\DCMImgExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00029184 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AutoChaptering.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00147456 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexpat.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoThumb.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 04671488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avcodec-52.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00070656 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avutil-50.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00686080 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\avformat-52.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00152064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\swscale-0.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00027648 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AudioExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00063488 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ID3Driver.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00366592 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\tag.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00289792 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libThumbnail.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00023040 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RichInfoDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00017920 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ThumbnailMaker.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00133120 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\VideoMetadataDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00290304 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libKeyFrame.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\SECMetaDriver.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00012288 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\ImageExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00024064 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\photoDriver.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00399826 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\libexif-12.dll.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00013824 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\TextExtractor.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00031232 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\Autobackup.dll
2012-02-22 15:46 - 2012-02-22 15:46 - 00054784 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\RosettaAllShare.dll
2012-01-05 21:40 - 2012-01-05 21:40 - 00044032 _____ () C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\us.dll
2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
2013-07-10 17:07 - 2013-07-10 17:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2015-02-01 10:30 - 2015-02-01 10:31 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Registry Areas =====================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-206210334-1080461088-3002721162-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Da Wee\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-206210334-1080461088-3002721162-500 - Administrator - Disabled)
Da Wee (S-1-5-21-206210334-1080461088-3002721162-1002 - Administrator - Enabled) => C:\Users\Da Wee
Gast (S-1-5-21-206210334-1080461088-3002721162-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-206210334-1080461088-3002721162-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-206210334-1080461088-3002721162-1000 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/11/2015 08:09:22 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/10/2015 07:06:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmain14.dll, Version: 2014.21.4.8571, Zeitstempel: 0x53144f64
Name des fehlerhaften Moduls: bdrm.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Ausnahmecode: 0xc0000005
Fehleroffset: 0x07b29914
ID des fehlerhaften Prozesses: 0xf94
Startzeit der fehlerhaften Anwendung: 0xwmain14.dll0
Pfad der fehlerhaften Anwendung: wmain14.dll1
Pfad des fehlerhaften Moduls: wmain14.dll2
Berichtskennung: wmain14.dll3
Error: (02/10/2015 07:05:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmain14.dll, Version: 2014.21.4.8571, Zeitstempel: 0x53144f64
Name des fehlerhaften Moduls: bdrm.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Ausnahmecode: 0xc0000005
Fehleroffset: 0x07b2a9b6
ID des fehlerhaften Prozesses: 0xf94
Startzeit der fehlerhaften Anwendung: 0xwmain14.dll0
Pfad der fehlerhaften Anwendung: wmain14.dll1
Pfad des fehlerhaften Moduls: wmain14.dll2
Berichtskennung: wmain14.dll3
System errors:
=============
Error: (02/11/2015 08:09:01 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "[verify-U]-Service" wurde mit folgendem Fehler beendet:
%%2
Error: (02/11/2015 08:08:58 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
[verify-U]_System
Error: (02/11/2015 08:08:11 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\[verify-U]-driver.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (02/10/2015 04:57:11 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
Error: (03/11/2013 03:49:24 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 428 seconds with 360 seconds of active time. This session ended with a crash.
Error: (03/15/2012 07:51:40 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 294 seconds with 240 seconds of active time. This session ended with a crash.
Error: (03/11/2012 01:16:23 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5606 seconds with 540 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz
Percentage of memory in use: 42%
Total physical RAM: 8043.86 MB
Available physical RAM: 4625.39 MB
Total Pagefile: 16085.9 MB
Available Pagefile: 12533.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:578.07 GB) (Free:468.69 GB) NTFS
Drive d: (ST2015) (CDROM) (Total:0.58 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: D5A70C26)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=578.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Gruß davide0308 |
|
11.02.2015, 09:27
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:53101;https=127.0.0.1:53101
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
EmptyTemp:
Hosts:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ --> Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! |
|
11.02.2015, 16:13
| #7 |
| | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Hallo Cosinus, anbei die Fixlog Datei. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-02-2015
Ran by Da Wee at 2015-02-11 16:03:42 Run:1
Running from C:\Users\Da Wee\Desktop
Loaded Profiles: UpdatusUser & Da Wee (Available profiles: UpdatusUser & Da Wee)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:53101;https=127.0.0.1:53101
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-206210334-1080461088-3002721162-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
EmptyTemp:
Hosts:
*****************
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-206210334-1080461088-3002721162-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 192.4 MB temporary data.
The system needed a reboot.
==== End of Fixlog 16:03:50 ====
Davide0308 |
|
11.02.2015, 16:36
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
13.02.2015, 17:41
| #9 |
| | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Hallo Cosinus, anbei die beiden log-files: MBAM Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 11.02.2015 Suchlauf-Zeit: 18:42:04 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.11.05 Rootkit Datenbank: v2015.02.03.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Da Wee Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 383345 Verstrichene Zeit: 33 Min, 54 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 1 PUP.Optional.MindSpark.A, C:\Users\Da Wee\AppData\Roaming\Mozilla\Firefox\Profiles\nkbtpxnm.default\FromDocToPDF_65, In Quarantäne, [c17069b4008a80b68b5ec59558ab29d7], Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ef896951e150e742b4413fe91b55e010
# engine=22449
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-13 08:41:48
# local_time=2015-02-13 09:41:48 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 176589 117994518 0 0
# scanned=751
# found=9
# cleaned=0
# scan_time=1165
sh=497D88F38E21229D95650E02708207190CB6849E ft=1 fh=64a74ba51bf40770 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir"
sh=5468230F587DE9F869DB9E22083131DCFD9451F2 ft=1 fh=07a842c13464288e vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir"
sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"
sh=599F4EB498D7C05A680386C1D3E1FC3DD68A8FA9 ft=1 fh=bd87bce3b868a7f1 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir"
sh=6F2DDAFE7B526A4CC60D75CCB1D4EBEA6F5D0DDC ft=1 fh=a836ee7136df2313 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir"
sh=1DFF39C0F7B7617C8292510F1833B282CD0A1F21 ft=1 fh=18ddbd645dd0ae9c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir"
sh=DF7B974F73F65FDF917E9C3AB8B8EC9FD97FC2A0 ft=1 fh=0e3a711fc1c46ea8 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir"
sh=606D4414333C04E362F60B505926C78BB0B6C694 ft=1 fh=2f7c44d7fdd8d932 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir"
sh=0641D63D85DA4259B27FA455972E762B6FC04092 ft=1 fh=b7e7d2287abcc02c vn="Variante von Win32/ELEX.BH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ef896951e150e742b4413fe91b55e010
# engine=22449
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-13 04:20:37
# local_time=2015-02-13 05:20:37 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 200517 118022046 0 0
# scanned=69434
# found=9
# cleaned=0
# scan_time=27476
sh=497D88F38E21229D95650E02708207190CB6849E ft=1 fh=64a74ba51bf40770 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir"
sh=5468230F587DE9F869DB9E22083131DCFD9451F2 ft=1 fh=07a842c13464288e vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir"
sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowserAction.dll.vir"
sh=599F4EB498D7C05A680386C1D3E1FC3DD68A8FA9 ft=1 fh=bd87bce3b868a7f1 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\CmdShell.exe.vir"
sh=6F2DDAFE7B526A4CC60D75CCB1D4EBEA6F5D0DDC ft=1 fh=a836ee7136df2313 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir"
sh=1DFF39C0F7B7617C8292510F1833B282CD0A1F21 ft=1 fh=18ddbd645dd0ae9c vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\IeWatchDog.dll.vir"
sh=DF7B974F73F65FDF917E9C3AB8B8EC9FD97FC2A0 ft=1 fh=0e3a711fc1c46ea8 vn="Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\ProtectService.exe.vir"
sh=606D4414333C04E362F60B505926C78BB0B6C694 ft=1 fh=2f7c44d7fdd8d932 vn="Variante von Win32/ELEX.BM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\SupTab.dll.vir"
sh=0641D63D85DA4259B27FA455972E762B6FC04092 ft=1 fh=b7e7d2287abcc02c vn="Variante von Win32/ELEX.BH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"
davide0308 |
|
13.02.2015, 22:21
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Nur Adware-Reste... Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.02.2015, 11:06
| #11 |
| | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! Hallo Cosinus, vielen DANK für deine HILFE!!! Was das Thema "erforderliche Programme" auf dem Rechner angeht, bin ich nicht so bewandt. Was für Programme gegen Viren, Malware, etc. empfiehlst du generell? Aktuell habe ich auf dem Rechner: -Super-Anti-Spyware -Microsoft Security Essentials -CCleaner -Windows Wirewall Wie von dir erwähnt, installiere ich noch gegen tracking-cookies zusätzlich Ghostery. Gruß davide0308 |
|
15.02.2015, 16:51
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! CCleaner kannste behalten, aber Flossen weg von der Registry-Reinigungsfunktion! Superantispyware ist überflüssig, kannste deinstallieren. MSE und Windows-Firewall sind ein gutes Gespann. Dann wären wir durch! Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Es empfiehlt sich Malwarebytes Anti-Malware zu behalten und damit wöchentlich nach Malware zu scannen. Helfen kann dir dabei delfix: Die Reihenfolge ist hier entscheidend.
Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Start, Systemsteuerung, Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers: Prüfen => Adobe - Flash Player Downloadlinks findest du hier => Browsers and Plugins - FilePony.de Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Windows 7: Über 200 Bedrohungen mit malwarebytes gefunden! |
| bonjour, converter, desktop, downloader, excel, fehler, firefox, flash player, helper, home, homepage, iexplore.exe, install.exe, installation, installmanager.exe, launch, mozilla, mp3, msiexec.exe, popup, problem, protectwindowsmanager.exe, realtek, registry, security, software, svchost.exe, symantec, windows, wiso |
Linear-Darstellung
