| |
| |||||||
Log-Analyse und Auswertung: Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
21.02.2015, 13:34
| #1 |
| |  Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe Hallo, vorgestern hat Malwarebytes folgenden Fund gemeldet (bei einem Routine-Scan): Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 19.02.2015 Scan Time: 18:26:00 Logfile: t.txt Administrator: No Version: 2.00.4.1028 Malware Database: v2015.02.19.07 Rootkit Database: v2015.02.03.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 8.1 CPU: x64 File System: NTFS User: Anonymous Scan Type: Custom Scan Result: Completed Objects Scanned: 696648 Time Elapsed: 1 hr, 33 min, 2 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 1 PUP.Optional.IEPluginServices.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginService, Delete-on-Reboot, [2330f030f09ae0568c35217f996a06fa], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 1 Backdoor.Bot.ED, D:\Spiele\Steam\Steam\SteamApps\common\Deus Ex Human Revolution Director's Cut\MakeAppXml.exe, Quarantined, [da79eb35761458de31d8a77e50b202fe], Physical Sectors: 0 (No malicious items detected) (end) War die Meldung falsch-positiv? Danke schonmal für eure Hilfe. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01 Ran by Anonymous (ATTENTION: The logged in user is not administrator) on XMG on 21-02-2015 12:48:50 Running from D:\Users\Anonymous\Desktop Loaded Profiles: Anonymous & postgres (Available profiles: Admin & Anonymous & postgres) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) Failed to access process -> smss.exe Failed to access process -> csrss.exe Failed to access process -> wininit.exe Failed to access process -> services.exe Failed to access process -> lsass.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> nvvsvc.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> igfxCUIService.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> spoolsv.exe Failed to access process -> svchost.exe Failed to access process -> armsvc.exe Failed to access process -> AppleMobileDeviceService.exe Failed to access process -> officeclicktorun.exe Failed to access process -> EMET_Service.exe Failed to access process -> dasHost.exe Failed to access process -> GMouseService.exe Failed to access process -> GfExperienceService.exe Failed to access process -> HeciServer.exe Failed to access process -> mbbService.exe Failed to access process -> NvNetworkService.exe Failed to access process -> nvstreamsvc.exe Failed to access process -> PnkBstrA.exe Failed to access process -> pg_ctl.exe Failed to access process -> PowerBiosServer.exe Failed to access process -> postgres.exe Failed to access process -> conhost.exe Failed to access process -> psia.exe Failed to access process -> svchost.exe Failed to access process -> TeamViewer_Service.exe Failed to access process -> postgres.exe Failed to access process -> nvstreamsvc.exe Failed to access process -> conhost.exe Failed to access process -> ViakaraokeSrv.exe Failed to access process -> MsMpEng.exe Failed to access process -> postgres.exe Failed to access process -> postgres.exe Failed to access process -> postgres.exe Failed to access process -> postgres.exe Failed to access process -> WmiPrvSE.exe Failed to access process -> NisSrv.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> PresentationFontCache.exe Failed to access process -> SearchIndexer.exe Failed to access process -> GoogleCrashHandler.exe Failed to access process -> GoogleCrashHandler64.exe Failed to access process -> svchost.exe Failed to access process -> WmiPrvSE.exe Failed to access process -> IntelMeFWService.exe Failed to access process -> jhi_service.exe Failed to access process -> LMS.exe Failed to access process -> NASvc.exe Failed to access process -> wmpnetwk.exe Failed to access process -> csrss.exe Failed to access process -> winlogon.exe Failed to access process -> dwm.exe Failed to access process -> nvvsvc.exe Failed to access process -> SearchProtocolHost.exe (Microsoft Corporation) C:\Program Files (x86)\EMET 5.1\EMET_Agent.exe Failed to access process -> nvstreamsvc.exe Failed to access process -> conhost.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe () C:\Windows\System32\igfxTray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Spotify Ltd) D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () C:\Program Files (x86)\Hotkey\Hotkey.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe (ArcSoft Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 6\TotalMedia Server\TM Server.exe () C:\Genius\ioCentre\gTaskBar.exe () C:\Genius\ioCentre\gMouseTask.exe () C:\Genius\ioCentre\gKbdTask.exe (ioCentre) C:\Genius\ioCentre\gIoCentreFunMgm.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe Failed to access process -> sua.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe Failed to access process -> SearchFilterHost.exe Failed to access process -> svchost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5672624 2013-03-27] (VIA) HKLM\...\Run: [MBCfg64] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\MBCfg64.dll,RunDLLEntry MBCfg64 HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050224 2013-04-02] (Synaptics Incorporated) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation) HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Sound Blaster Cinema] => C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe [711680 2012-11-29] (Creative Technology Ltd) HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.) HKLM-x32\...\Run: [ioCentre] => C:\Genius\ioCentre\gTaskBar.exe [60928 2009-09-03] () HKLM-x32\...\Run: [Setup Utility 12.0] => C:\Program Files (x86)\Navigator12\Setup Utility\clickertray.exe HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [465320 2014-10-29] (Microsoft Corporation) Winlogon\Notify\igfxcui: igfxdev.dll [X] HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation) HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [OpenDNS Updater] => C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe [839680 2010-06-16] () HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify Web Helper] => D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-06] (Spotify Ltd) HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify] => D:\Users\Anonymous\AppData\Roaming\Spotify\spotify.exe [6737976 2015-01-06] (Spotify Ltd) HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {7f2a5a89-99a3-11e3-82c8-0090f5edbf18} - "E:\AutoRun.exe" HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {90f2ab75-41ad-11e4-8319-582c80139263} - "E:\LGAutoRun.exe" AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [177624 2015-01-10] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [164568 2015-01-10] (NVIDIA Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mysn.de/ HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mysn.de URLSearchHook: [S-1-5-21-1788917750-2918846918-3832768059-1010] ATTENTION ==> Default URLSearchHook is missing. SearchScopes: HKLM -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox SearchScopes: HKLM-x32 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default FF SearchEngineOrder.1: Ask Search FF Homepage: google.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: DownloadHelper - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-21] FF Extension: SoundCloud Downloader - Technowise - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2015-02-06] Chrome: ======= CHR Profile: D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-09] CHR Extension: (Google Drive) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-09] CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06] CHR Extension: (YouTube) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-09] CHR Extension: (Google Search) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-09] CHR Extension: (Google Wallet) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-09] CHR Extension: (Gmail) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-09] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S4 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [44064 2013-07-08] (ArcSoft, Inc.) S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation) R2 EMET_Service; C:\Program Files (x86)\EMET 5.1\EMET_Service.exe [31880 2014-11-09] (Microsoft Corporation) R2 GeniusMouseService; C:\Genius\ioCentre\GMouseService.exe [16384 2010-03-11] () [File not signed] R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation) R2 lmhosts; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation) R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 NlaSvc; C:\Windows\System32\svchost.exe [38792 2014-10-29] (Microsoft Corporation) R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation) R2 nsi; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-17] () R2 postgresql-8.4; C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2014-04-09] (PostgreSQL Global Development Group) [File not signed] R2 PowerBiosServer; C:\Program Files (x86)\Hotkey\PowerBiosServer.exe [46080 2013-07-09] () [File not signed] S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.) R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 AirplaneModeHid; C:\Windows\system32\DRIVERS\AirplaneModeHid.sys [26888 2013-06-28] (Insyde Corporation) R1 ArcCtrl; C:\Windows\System32\drivers\ArcCtrl.sys [3315392 2013-08-21] () S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) S3 gHidPnp; C:\Windows\System32\Drivers\gHidPnp.Sys [25088 2009-11-02] () S3 gMouUsb16; C:\Windows\System32\drivers\gMouUsb16.sys [11776 2009-06-25] () S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation) R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation) S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R1 RrNetCapFilterDriver; C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys [24744 2013-12-18] (Audials AG) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-02] (Synaptics Incorporated) S1 SSHDRV76; C:\Windows\SysWOW64\drivers\SSHDRV76.sys [53760 2014-01-08] () [File not signed] R3 VMfilt; C:\Windows\system32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-21 12:48 - 2015-02-21 12:48 - 00021929 _____ () D:\Users\Anonymous\Desktop\FRST.txt 2015-02-21 12:48 - 2015-02-21 12:48 - 00000000 ____D () C:\FRST 2015-02-21 12:46 - 2015-02-21 12:46 - 02086912 _____ (Farbar) D:\Users\Anonymous\Desktop\FRST64.exe 2015-02-21 11:46 - 2015-02-21 11:48 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (3) 2015-02-20 22:09 - 2015-02-20 22:09 - 00001314 _____ () D:\Users\Anonymous\Desktop\t.txt 2015-02-20 21:52 - 2015-02-20 21:52 - 00000023 _____ () D:\Users\postgres\postmaster.pid 2015-02-20 16:18 - 2015-02-20 16:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-20 16:18 - 2015-02-20 16:18 - 00000997 _____ () D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-20 16:18 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-20 16:18 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-20 16:18 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-19 16:38 - 2015-02-19 16:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\Steam 2015-02-19 01:02 - 2015-02-19 01:11 - 02001353 _____ (BOSS Development Team) D:\Users\Anonymous\Downloads\BOSS.Installer.exe.opdownload 2015-02-18 15:23 - 2015-02-18 15:23 - 00000000 ____D () D:\Users\Admin\AppData\Roaming\InstallShield 2015-02-12 09:55 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-12 09:55 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-11 14:38 - 2015-02-11 14:38 - 00001341 _____ () D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2015-02-11 07:42 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-11 07:42 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-11 07:42 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-02-11 07:42 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-02-11 07:42 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-11 07:42 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-11 07:42 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-11 07:42 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-11 07:41 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll 2015-02-11 07:41 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-11 07:41 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-11 07:41 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-11 07:41 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-11 07:41 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-11 07:41 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-11 07:41 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-11 07:41 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-11 07:41 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-11 07:41 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-11 07:41 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-11 07:41 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-11 07:41 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-11 07:41 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-02-11 07:41 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-11 07:41 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-02-11 07:41 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-11 07:41 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-11 07:41 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-11 07:41 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-11 07:41 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-11 07:41 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-11 07:41 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-02-11 07:41 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-02-11 07:41 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2015-02-11 07:41 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-11 07:41 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-02-11 07:41 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-11 07:41 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-11 07:41 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-11 07:41 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-11 07:41 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-11 07:41 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-11 07:41 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-11 07:41 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-11 07:41 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-11 07:41 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-11 07:41 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-02-11 07:41 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-02-11 07:41 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-11 07:41 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-11 07:41 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-11 07:41 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml 2015-02-04 16:59 - 2015-02-04 16:59 - 1117766084 _____ () D:\Users\Anonymous\Documents\w.pcapng 2015-01-31 14:03 - 2015-01-31 14:03 - 00094335 _____ () D:\Users\Anonymous\Downloads\1 R7OCp3d9b8QPRtvqrqCvGQ.jpeg 2015-01-30 17:20 - 2015-01-30 17:20 - 00210149 _____ () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis.zip 2015-01-30 17:20 - 2015-01-30 17:20 - 00000000 ____D () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis 2015-01-30 10:58 - 2015-01-30 10:58 - 556246770 _____ () C:\Windows\MEMORY.DMP 2015-01-27 10:43 - 2015-01-27 10:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\SysWOW64\NV 2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\system32\NV 2015-01-24 14:47 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 18566296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 16009120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-01-24 14:47 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 02902456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00031376 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys 2015-01-24 14:40 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2015-01-24 14:40 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-21 12:49 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_stat_tmp 2015-02-21 12:47 - 2014-09-07 13:29 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (2) 2015-02-21 12:38 - 2014-01-02 17:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-21 12:10 - 2013-12-13 21:12 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-21 12:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2015-02-21 11:52 - 2013-12-10 22:26 - 01423543 _____ () C:\Windows\WindowsUpdate.log 2015-02-21 11:27 - 2013-12-13 21:12 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-21 11:23 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_log 2015-02-20 21:59 - 2013-10-09 08:11 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-20 21:59 - 2013-08-23 00:24 - 00765582 _____ () C:\Windows\system32\perfh007.dat 2015-02-20 21:59 - 2013-08-23 00:24 - 00159366 _____ () C:\Windows\system32\perfc007.dat 2015-02-20 21:52 - 2014-02-22 16:14 - 00000080 _____ () D:\Users\postgres\postmaster.opts 2015-02-20 21:52 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\global 2015-02-20 21:52 - 2014-02-22 16:02 - 00000000 ____D () D:\Users\postgres 2015-02-20 21:52 - 2014-01-06 01:55 - 00033999 _____ () C:\Windows\setupact.log 2015-02-20 21:52 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-20 16:22 - 2014-01-05 01:13 - 00057090 _____ () C:\Windows\PFRO.log 2015-02-20 16:18 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-20 16:17 - 2013-12-20 08:47 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner 2015-02-20 16:15 - 2014-09-30 21:31 - 00000000 ____D () C:\AdwCleaner 2015-02-20 16:14 - 2014-12-05 20:36 - 00000110 _____ () C:\AdwCleanerDebug.txt 2015-02-20 14:23 - 2013-12-10 22:23 - 00000000 __SHD () C:\Recovery 2015-02-20 14:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-02-20 04:00 - 2014-05-09 14:53 - 00155136 ___SH () D:\Users\Anonymous\Desktop\Thumbs.db 2015-02-19 02:44 - 2014-02-05 01:54 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\CrashDumps 2015-02-19 01:54 - 2014-02-19 03:11 - 00000000 ____D () D:\Users\Anonymous\Documents\My Games 2015-02-18 21:22 - 2014-02-17 04:20 - 00005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-02-18 21:22 - 2014-01-19 09:43 - 00000000 ____D () D:\Users\Anonymous\Documents\Camtasia Studio 2015-02-18 16:49 - 2014-02-18 12:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\dxhr 2015-02-16 02:57 - 2013-12-13 21:58 - 00000000 ____D () D:\Users\Anonymous 2015-02-12 20:18 - 2014-01-12 23:31 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Spotify 2015-02-12 20:18 - 2014-01-12 23:20 - 00000000 ____D () D:\Users\Anonymous\AppData\Roaming\Spotify 2015-02-12 13:44 - 2015-01-21 16:23 - 00000000 ____D () D:\Users\Anonymous\dwhelper 2015-02-12 10:48 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2015-02-12 10:48 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-02-11 22:23 - 2013-12-15 17:56 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\PokerStars.FR 2015-02-11 13:58 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2015-02-11 10:12 - 2013-08-22 15:44 - 00484104 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-11 08:14 - 2013-12-13 23:54 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-11 08:06 - 2013-12-13 23:54 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-08 17:20 - 2014-02-10 09:52 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\eclipse 2015-02-06 23:11 - 2013-12-13 21:27 - 00002070 _____ () D:\Users\Public\Desktop\Google Chrome.lnk 2015-02-05 09:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-05 01:42 - 2014-02-02 01:10 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Audible 2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-31 14:22 - 2014-06-25 16:17 - 00178688 ___SH () D:\Users\Anonymous\Downloads\Thumbs.db 2015-01-30 10:58 - 2014-01-02 15:32 - 00000000 ____D () C:\Windows\Minidump 2015-01-29 10:46 - 2013-12-22 00:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-28 00:44 - 2014-10-16 09:07 - 00000000 ____D () D:\Users\Anonymous\Downloads\Informatik 2015-01-27 22:53 - 2014-09-12 15:29 - 00000000 ____D () D:\Users\Admin\AppData\Local\Adobe 2015-01-25 12:46 - 2013-12-13 21:47 - 00000000 ____D () D:\Users\Admin 2015-01-24 14:48 - 2014-10-18 15:22 - 00000000 ____D () C:\Temp 2015-01-23 03:55 - 2015-01-03 17:14 - 00000000 ____D () D:\Users\Anonymous\workspace1 ==================== Files in the root of some directories ======= 2014-03-01 02:25 - 2014-03-01 02:25 - 2987391 _____ () D:\Users\Anonymous\AppData\Local\ASbs.ac 2014-02-17 04:20 - 2015-02-18 21:22 - 0005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-04-17 16:28 - 2014-04-17 16:28 - 0005037 _____ () C:\ProgramData\flwjycbm.bab Some content of TEMP: ==================== D:\Users\Admin\AppData\Local\Temp\AskPIP_FF_.exe D:\Users\Admin\AppData\Local\Temp\Quarantine.exe D:\Users\Admin\AppData\Local\Temp\sfamcc00001.dll D:\Users\Admin\AppData\Local\Temp\sfextra.dll D:\Users\Admin\AppData\Local\Temp\SIInvoker.exe D:\Users\Admin\AppData\Local\Temp\sqlite3.dll D:\Users\Admin\AppData\Local\Temp\xmlUpdater.exe D:\Users\Admin\AppData\Local\Temp\{0D87D2C5-67A7-407E-A3D9-268B0FB322F3}-34.0.1847.137_chrome_installer.exe D:\Users\Admin\AppData\Local\Temp\{58DD2574-8B53-4D6A-BDE3-F14ACA9DBD5B}-34.0.1847.137_chrome_installer.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Anonymous at 2015-02-21 12:49:09
Running from D:\Users\Anonymous\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Airplane Mode Hid Installer (HKLM-x32\...\InstallShield_{5E5B067F-52A4-447E-A3F1-D6DD10565E73}) (Version: 2.0.0.6 - )
Airplane Mode Hid Installer (x32 Version: 2.0.0.6 - ) Hidden
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia Theatre 6 (HKLM-x32\...\InstallShield_{5232358C-7C23-4319-8271-E43F924196AC}) (Version: 6.5.1.150 - ArcSoft)
ArcSoft TotalMedia Theatre 6 (x32 Version: 6.5.1.150 - ArcSoft) Hidden
Assassin's Creed IV Black Flag (HKLM-x32\...\Uplay Install 273) (Version: - Ubisoft)
Audials (HKLM-x32\...\{15FA1110-CA8E-43E4-BD79-A28A897CD563}) (Version: 11.0.48200.0 - Audials AG)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1694499172.4759644.48.2147344384 - Audible, Inc.)
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version: - Rocksteady Studios)
BioShock (HKLM-x32\...\Steam App 7670) (Version: - 2K Boston)
BlackChipPoker (HKLM-x32\...\FE4D6F94-B3D5-484b-94F7-8BC45DEB7A82) (Version: 16.6 - IGSoft)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Camtasia Studio 8 (HKLM-x32\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
CarbonPoker (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\CarbonPoker) (Version: 6.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version: - Relic Entertainment)
CREVbeta (HKLM-x32\...\{6B7961D1-A7A3-4F1A-927B-E1EFACB9AE4F}) (Version: 2.9.4 - CardRunnersEV)
Democracy 3 (HKLM-x32\...\Steam App 245470) (Version: - Positech Games)
Deus Ex: Human Revolution - Director's Cut (HKLM-x32\...\Steam App 238010) (Version: - Eidos Montreal)
EMET 5.1 (HKLM-x32\...\{72E7AE20-5B12-4F27-AF5E-DA03E3C09466}) (Version: 5.1 - Microsoft Corporation)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Game Studios)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version: - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
FormatFactory 3.3.4.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.4.0 - Format Factory)
Full Tilt Poker.Eu (HKLM-x32\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.4.1.WIN.FullTilt.EU - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version: - )
Hotkey 8.0135 (HKLM-x32\...\InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}) (Version: 8.0135 - NoteBook)
Hotkey 8.0135 (x32 Version: 8.0135 - NoteBook) Hidden
Insyde Airplane Mode HID Mini-Driver (HKLM\...\AirplaneModeHid) (Version: 1.3.0.0 - Insyde Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
ioCentre (HKLM-x32\...\{A2B4621B-CEB9-4E44-95FD-3500D4DB3727}) (Version: 1.02.000 - KYE)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Knights Of Honor (HKLM-x32\...\{7911C404-9AFA-4BB2-B9B7-E47423D87528}) (Version: 1.00 - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version: - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version: - )
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nero 2014 (HKLM-x32\...\{0128492C-AB60-43BE-9D9A-8CA622CAF06E}) (Version: 15.0.07700 - Nero AG)
Nero BackItUp 12 Essentials (HKLM-x32\...\{0E3368AC-FB29-4C5E-938E-FA11C12D035E}) (Version: 12.0.01200 - Nero AG)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 12.0.4000 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 15.1.0030 - Nero AG)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenDNS Updater 2.2.1 (HKLM-x32\...\OpenDNS Updater) (Version: 2.2.1 - )
Opera Stable 27.0.1689.69 (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Opera 27.0.1689.69) (Version: 27.0.1689.69 - Opera Software ASA)
Oracle VM VirtualBox 4.3.20 (HKLM\...\{DD8F7A7A-852F-4648-8A73-B8FC1DF5F082}) (Version: 4.3.20 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Port Royale 2 (HKLM-x32\...\Steam App 12470) (Version: - Ascaron Entertainment ltd.)
PostgreSQL 8.4 (HKLM-x32\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden
Pro Evolution Soccer 2013 (HKLM-x32\...\{C2523AE6-F335-4D0B-BC15-1C07E4ACE629}) (Version: 1.00.0000 - KONAMI)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.27040 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.49 - Piriform)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SMPlayer 0.8.6.0 (HKLM-x32\...\SMPlayer) (Version: 0.8.6.0 - Ricardo Villalba)
Sound Blaster Cinema (HKLM-x32\...\{8801CA65-921A-4CCC-9D63-879D1D0BAA97}) (Version: 1.00.03 - Creative Technology Limited)
Spotify (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.5.1.1 - Synaptics Incorporated)
TDM-GCC (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\TDM-GCC) (Version: 1.1309.0 - TDM)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version: - CD Projekt RED)
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version: - The Creative Assembly)
Uplay (HKLM-x32\...\Uplay) (Version: 4.5 - Ubisoft)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
Video DVD Maker v3.30.0.75 (HKLM-x32\...\{1A3E23D7-7A1E-43EC-B35D-EB2A31BED943}) (Version: - )
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Mobile Device Center Driver Update (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows-Treiberpaket - Insyde (AirplaneModeHid) HIDClass (07/01/2013 1.3.0.0) (HKLM\...\E38E8D276444640BFCE21B5A73FD63C479B76259) (Version: 07/01/2013 1.3.0.0 - Insyde)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 1.12.3 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.3 - The Wireshark developer community, hxxp://www.wireshark.org)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2014-06-13 17:30 - 00002180 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com 127.0.0.1
127.0.0.1 activate.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-1.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 adobe-dns-4.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 activate.wip.adobe.com
127.0.0.1 activate.wip1.adobe.com
127.0.0.1 activate.wip2.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 activate.wip4.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 ereg.wip.adobe.com
127.0.0.1 ereg.wip1.adobe.com
127.0.0.1 ereg.wip2.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 hl2rcv.adobe.com
127.0.0.1 ood.opsource.net
127.0.0.1 preactivate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 t3dns.adobe.com
127.0.0.1 wip.adobe.com
127.0.0.1 wip1.adobe.com
There are 9 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) ==============
2014-11-09 16:10 - 2014-11-09 16:10 - 00166536 _____ () C:\Program Files (x86)\EMET 5.1\HelperLib.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045192 _____ () C:\Program Files (x86)\EMET 5.1\TrayIconSubsystem.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045704 _____ () C:\Program Files (x86)\EMET 5.1\TelemetrySubsystem.dll
2014-02-08 18:19 - 2014-02-08 18:19 - 00348160 _____ () C:\Program Files (x86)\EMET 5.1\DevExpress.UserSkins.HighContrast.dll
2014-01-25 02:22 - 2014-10-03 16:36 - 00457616 _____ () C:\Windows\system32\igfxTray.exe
2013-12-10 22:30 - 2012-11-14 14:22 - 00078456 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2013-12-10 22:30 - 2012-11-14 14:22 - 00386168 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-12-10 22:33 - 2012-11-01 11:23 - 00089600 _____ () C:\Windows\SYSTEM32\CmdRtr64.DLL
2013-12-10 22:33 - 2012-11-01 11:21 - 00325120 _____ () C:\Windows\SYSTEM32\APOMgr64.DLL
2013-09-27 12:02 - 2013-09-27 12:02 - 04903424 _____ () C:\Program Files (x86)\Hotkey\Hotkey.exe
2013-12-12 13:38 - 2009-09-03 11:30 - 00060928 _____ () C:\Genius\ioCentre\gTaskBar.exe
2013-12-12 13:38 - 2009-09-03 10:45 - 00161280 _____ () C:\Genius\ioCentre\GenXML.dll
2013-12-12 13:38 - 2011-08-05 10:01 - 00961536 _____ () C:\Genius\ioCentre\gMouseTask.exe
2013-12-12 13:38 - 2009-09-03 11:22 - 00063488 _____ () C:\Genius\ioCentre\gfMedia.dll
2013-12-12 13:38 - 2011-06-09 14:26 - 00052224 _____ () C:\Genius\ioCentre\gfBrowser.dll
2013-12-12 13:38 - 2009-09-03 11:23 - 00020992 _____ () C:\Genius\ioCentre\gfOffice.dll
2013-12-12 13:38 - 2009-09-03 11:24 - 00027648 _____ () C:\Genius\ioCentre\gfSystem.dll
2013-12-12 13:38 - 2009-09-03 11:18 - 00040960 _____ () C:\Genius\ioCentre\gfEmail.dll
2013-12-12 13:38 - 2011-08-04 16:45 - 00266752 _____ () C:\Genius\ioCentre\gDevMgm.dll
2013-12-12 13:38 - 2011-08-04 16:48 - 00758784 _____ () C:\Genius\ioCentre\gKbdTask.exe
2013-12-12 13:38 - 2009-09-03 10:55 - 00069120 _____ () C:\Genius\ioCentre\gAutoScroll.dll
2013-12-12 13:38 - 2009-09-03 10:54 - 00249344 _____ () C:\Genius\ioCentre\gAutoPan.dll
2013-12-12 13:38 - 2009-09-03 11:06 - 00259072 _____ () C:\Genius\ioCentre\gZoom.dll
2013-12-12 13:38 - 2009-09-03 11:25 - 00025088 _____ () C:\Genius\ioCentre\gIoCentreHook.dll
2013-12-12 13:38 - 2009-09-03 11:05 - 00048640 _____ () C:\Genius\ioCentre\gTaskSwitch.dll
2013-12-12 13:38 - 2010-04-07 18:05 - 00258560 _____ () C:\Genius\ioCentre\gDeskMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00246784 _____ () C:\Genius\ioCentre\gKbStatus.dll
2013-12-12 13:38 - 2009-09-03 10:59 - 00053760 _____ () C:\Genius\ioCentre\gIMMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00143360 _____ () C:\Genius\ioCentre\gPreset.dll
2013-12-12 13:38 - 2009-09-03 10:58 - 00044544 _____ () C:\Genius\ioCentre\gIMHook.dll
2013-12-12 13:38 - 2009-09-03 11:04 - 00056832 _____ () C:\Genius\ioCentre\gTabSwitch.dll
2013-12-10 22:29 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: D:\Users\Anonymous\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Control Panel\Desktop\\Wallpaper -> D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: Media is not connected to internet.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: ADExchange => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
HKLM\...\StartupApproved\StartupFolder: => "Secunia PSI Tray.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\StartupApproved\Run: => "AudialsNotifier"
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\StartupApproved\Run: => "Spotify"
==================== Accounts: =============================
Admin (S-1-5-21-1788917750-2918846918-3832768059-1007 - Administrator - Enabled) => D:\Users\Admin
Administrator (S-1-5-21-1788917750-2918846918-3832768059-500 - Administrator - Disabled)
Anonymous (S-1-5-21-1788917750-2918846918-3832768059-1008 - Limited - Enabled) => D:\Users\Anonymous
Gast (S-1-5-21-1788917750-2918846918-3832768059-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1788917750-2918846918-3832768059-1012 - Limited - Enabled)
postgres (S-1-5-21-1788917750-2918846918-3832768059-1010 - Limited - Enabled) => D:\Users\postgres
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools (T:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable).
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable).
Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
System errors:
=============
Error: (02/20/2015 11:09:42 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (02/20/2015 09:52:05 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Windows\SysWow64\drivers\SSHDRV76.sys
Error: (02/20/2015 09:52:04 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x12
Error: (02/20/2015 09:51:52 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084WSearchNicht verfügbar{9E175B68-F52A-11D8-B9A5-505054503030}
Error: (02/20/2015 09:51:52 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (02/20/2015 09:51:21 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1068netprofmNicht verfügbar{A47979D2-C419-11D9-A5B4-001185AD2B89}
Error: (02/20/2015 09:51:21 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (02/20/2015 09:51:21 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (02/20/2015 09:51:21 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (02/20/2015 06:27:19 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}
Microsoft Office Sessions:
=========================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE tools (T:)Falscher Parameter. (0x80070057)
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable)
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable)
Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
CodeIntegrity Errors:
===================================
Date: 2015-02-20 17:44:23.753
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2015-02-15 13:39:06.049
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.897
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.635
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.479
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.204
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.045
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:04.745
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:04.590
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:04.319
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Percentage of memory in use: 40%
Total physical RAM: 8111.55 MB
Available physical RAM: 4794.08 MB
Total Pagefile: 16303.55 MB
Available Pagefile: 11464.72 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:435.72 GB) (Free:348.12 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.39 GB) (Free:412.05 GB) NTFS
Drive r: (Recovery Image) (Fixed) (Total:10.74 GB) (Free:10.66 GB) NTFS
Drive t: (Windows RE tools) (Fixed) (Total:0.29 GB) (Free:0.27 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
|
|
21.02.2015, 14:32
| #2 | |
| /// the machine /// TB-Ausbilder    | Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe hi,
__________________Zitat:
Gecrackte Software deinstallieren, vorher gibt es keinen Support.
__________________ |
|
21.02.2015, 15:49
| #3 |
| | Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe Danke für den Hinweis.
__________________[CODE FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01 Ran by Anonymous (ATTENTION: The logged in user is not administrator) on XMG on 21-02-2015 15:19:18 Running from D:\Users\Anonymous\Desktop Loaded Profiles: Admin & Anonymous & postgres (Available profiles: Admin & Anonymous & postgres) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) Failed to access process -> smss.exe Failed to access process -> csrss.exe Failed to access process -> wininit.exe Failed to access process -> services.exe Failed to access process -> lsass.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> nvvsvc.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> igfxCUIService.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> spoolsv.exe Failed to access process -> svchost.exe Failed to access process -> armsvc.exe Failed to access process -> AppleMobileDeviceService.exe Failed to access process -> officeclicktorun.exe Failed to access process -> EMET_Service.exe Failed to access process -> dasHost.exe Failed to access process -> GMouseService.exe Failed to access process -> GfExperienceService.exe Failed to access process -> HeciServer.exe Failed to access process -> mbbService.exe Failed to access process -> NvNetworkService.exe Failed to access process -> nvstreamsvc.exe Failed to access process -> PnkBstrA.exe Failed to access process -> pg_ctl.exe Failed to access process -> PowerBiosServer.exe Failed to access process -> postgres.exe Failed to access process -> conhost.exe Failed to access process -> psia.exe Failed to access process -> svchost.exe Failed to access process -> TeamViewer_Service.exe Failed to access process -> postgres.exe Failed to access process -> nvstreamsvc.exe Failed to access process -> conhost.exe Failed to access process -> ViakaraokeSrv.exe Failed to access process -> MsMpEng.exe Failed to access process -> postgres.exe Failed to access process -> postgres.exe Failed to access process -> postgres.exe Failed to access process -> postgres.exe Failed to access process -> WmiPrvSE.exe Failed to access process -> NisSrv.exe Failed to access process -> svchost.exe Failed to access process -> svchost.exe Failed to access process -> PresentationFontCache.exe Failed to access process -> SearchIndexer.exe Failed to access process -> GoogleCrashHandler.exe Failed to access process -> GoogleCrashHandler64.exe Failed to access process -> svchost.exe Failed to access process -> WmiPrvSE.exe Failed to access process -> IntelMeFWService.exe Failed to access process -> jhi_service.exe Failed to access process -> LMS.exe Failed to access process -> NASvc.exe Failed to access process -> wmpnetwk.exe Failed to access process -> csrss.exe Failed to access process -> winlogon.exe Failed to access process -> dwm.exe Failed to access process -> nvvsvc.exe Failed to access process -> SearchProtocolHost.exe (Microsoft Corporation) C:\Program Files (x86)\EMET 5.1\EMET_Agent.exe Failed to access process -> nvstreamsvc.exe Failed to access process -> conhost.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe () C:\Windows\System32\igfxTray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Spotify Ltd) D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () C:\Program Files (x86)\Hotkey\Hotkey.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe () C:\Genius\ioCentre\gTaskBar.exe () C:\Genius\ioCentre\gMouseTask.exe () C:\Genius\ioCentre\gKbdTask.exe (ioCentre) C:\Genius\ioCentre\gIoCentreFunMgm.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe Failed to access process -> sua.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5672624 2013-03-27] (VIA) HKLM\...\Run: [MBCfg64] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\MBCfg64.dll,RunDLLEntry MBCfg64 HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050224 2013-04-02] (Synaptics Incorporated) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation) HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM-x32\...\Run: [Sound Blaster Cinema] => C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe [711680 2012-11-29] (Creative Technology Ltd) HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.) HKLM-x32\...\Run: [ioCentre] => C:\Genius\ioCentre\gTaskBar.exe [60928 2009-09-03] () HKLM-x32\...\Run: [Setup Utility 12.0] => C:\Program Files (x86)\Navigator12\Setup Utility\clickertray.exe HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [465320 2014-10-29] (Microsoft Corporation) Winlogon\Notify\igfxcui: igfxdev.dll [X] HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation) HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [OpenDNS Updater] => C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe [839680 2010-06-16] () HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify Web Helper] => D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-06] (Spotify Ltd) HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify] => D:\Users\Anonymous\AppData\Roaming\Spotify\spotify.exe [6737976 2015-01-06] (Spotify Ltd) HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {7f2a5a89-99a3-11e3-82c8-0090f5edbf18} - "E:\AutoRun.exe" HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {90f2ab75-41ad-11e4-8319-582c80139263} - "E:\LGAutoRun.exe" AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [177624 2015-01-10] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [164568 2015-01-10] (NVIDIA Corporation) ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mysn.de/ HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mysn.de URLSearchHook: [S-1-5-21-1788917750-2918846918-3832768059-1007] ATTENTION ==> Default URLSearchHook is missing. URLSearchHook: [S-1-5-21-1788917750-2918846918-3832768059-1010] ATTENTION ==> Default URLSearchHook is missing. SearchScopes: HKLM -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox SearchScopes: HKLM-x32 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default FF SearchEngineOrder.1: Ask Search FF Homepage: google.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: DownloadHelper - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-21] FF Extension: SoundCloud Downloader - Technowise - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2015-02-06] Chrome: ======= CHR Profile: D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-09] CHR Extension: (Google Drive) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-09] CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06] CHR Extension: (YouTube) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-09] CHR Extension: (Google Search) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-09] CHR Extension: (Google Wallet) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-09] CHR Extension: (Gmail) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-09] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation) R2 EMET_Service; C:\Program Files (x86)\EMET 5.1\EMET_Service.exe [31880 2014-11-09] (Microsoft Corporation) R2 GeniusMouseService; C:\Genius\ioCentre\GMouseService.exe [16384 2010-03-11] () [File not signed] R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation) R2 lmhosts; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation) R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 NlaSvc; C:\Windows\System32\svchost.exe [38792 2014-10-29] (Microsoft Corporation) R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation) R2 nsi; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-17] () R2 postgresql-8.4; C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2014-04-09] (PostgreSQL Global Development Group) [File not signed] R2 PowerBiosServer; C:\Program Files (x86)\Hotkey\PowerBiosServer.exe [46080 2013-07-09] () [File not signed] S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.) R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 AirplaneModeHid; C:\Windows\system32\DRIVERS\AirplaneModeHid.sys [26888 2013-06-28] (Insyde Corporation) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) S3 gHidPnp; C:\Windows\System32\Drivers\gHidPnp.Sys [25088 2009-11-02] () S3 gMouUsb16; C:\Windows\System32\drivers\gMouUsb16.sys [11776 2009-06-25] () S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation) R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation) S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-02] (Synaptics Incorporated) S1 SSHDRV76; C:\Windows\SysWOW64\drivers\SSHDRV76.sys [53760 2014-01-08] () [File not signed] R3 VMfilt; C:\Windows\system32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation) R1 ArcCtrl; system32\drivers\ArcCtrl.sys [X] U3 pgldipow; \??\D:\Users\Admin\AppData\Local\Temp\pgldipow.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-21 15:19 - 2015-02-21 15:19 - 00021877 _____ () D:\Users\Anonymous\Desktop\FRST.txt 2015-02-21 13:12 - 2015-02-21 13:13 - 00064633 _____ () D:\Users\Admin\Desktop\gmer.txt 2015-02-21 13:10 - 2015-02-21 13:10 - 00064633 _____ () D:\Users\Admin\Desktop\save.log 2015-02-21 12:48 - 2015-02-21 15:19 - 00000000 ____D () C:\FRST 2015-02-21 12:46 - 2015-02-21 12:46 - 02086912 _____ (Farbar) D:\Users\Anonymous\Desktop\FRST64.exe 2015-02-21 11:46 - 2015-02-21 11:48 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (3) 2015-02-20 22:09 - 2015-02-20 22:09 - 00001314 _____ () D:\Users\Anonymous\Desktop\t.txt 2015-02-20 21:52 - 2015-02-20 21:52 - 00000023 _____ () D:\Users\postgres\postmaster.pid 2015-02-20 16:18 - 2015-02-20 16:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-20 16:18 - 2015-02-20 16:18 - 00000997 _____ () D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-20 16:18 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-20 16:18 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-20 16:18 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-19 16:38 - 2015-02-19 16:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\Steam 2015-02-19 01:02 - 2015-02-19 01:11 - 02001353 _____ (BOSS Development Team) D:\Users\Anonymous\Downloads\BOSS.Installer.exe.opdownload 2015-02-18 15:23 - 2015-02-18 15:23 - 00000000 ____D () D:\Users\Admin\AppData\Roaming\InstallShield 2015-02-12 09:55 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-12 09:55 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-11 14:38 - 2015-02-11 14:38 - 00001341 _____ () D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2015-02-11 07:42 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-11 07:42 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-11 07:42 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-02-11 07:42 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-02-11 07:42 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-11 07:42 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-11 07:42 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-11 07:42 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-11 07:41 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll 2015-02-11 07:41 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-11 07:41 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-11 07:41 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-11 07:41 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-11 07:41 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-11 07:41 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-11 07:41 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-11 07:41 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-11 07:41 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-11 07:41 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-11 07:41 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-11 07:41 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-11 07:41 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-11 07:41 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-02-11 07:41 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-11 07:41 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-02-11 07:41 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-11 07:41 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-11 07:41 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-11 07:41 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-11 07:41 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-11 07:41 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-11 07:41 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-02-11 07:41 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-02-11 07:41 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2015-02-11 07:41 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-11 07:41 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-02-11 07:41 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-11 07:41 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-11 07:41 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-11 07:41 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-11 07:41 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-11 07:41 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-11 07:41 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-11 07:41 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-11 07:41 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-11 07:41 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-11 07:41 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-02-11 07:41 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-02-11 07:41 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-11 07:41 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-11 07:41 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-11 07:41 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml 2015-02-04 16:59 - 2015-02-04 16:59 - 1117766084 _____ () D:\Users\Anonymous\Documents\w.pcapng 2015-01-31 14:03 - 2015-01-31 14:03 - 00094335 _____ () D:\Users\Anonymous\Downloads\1 R7OCp3d9b8QPRtvqrqCvGQ.jpeg 2015-01-30 17:20 - 2015-01-30 17:20 - 00210149 _____ () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis.zip 2015-01-30 17:20 - 2015-01-30 17:20 - 00000000 ____D () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis 2015-01-30 10:58 - 2015-01-30 10:58 - 556246770 _____ () C:\Windows\MEMORY.DMP 2015-01-27 10:43 - 2015-01-27 10:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\SysWOW64\NV 2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\system32\NV 2015-01-24 14:47 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 18566296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 16009120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-01-24 14:47 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 02902456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-01-24 14:47 - 2015-01-10 09:07 - 00031376 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys 2015-01-24 14:40 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2015-01-24 14:40 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-21 15:19 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_stat_tmp 2015-02-21 15:10 - 2013-12-13 21:12 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-21 15:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2015-02-21 14:57 - 2014-05-09 14:53 - 00155136 ___SH () D:\Users\Anonymous\Desktop\Thumbs.db 2015-02-21 14:57 - 2013-12-10 22:30 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-02-21 14:38 - 2014-01-02 17:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-21 14:36 - 2014-09-12 15:29 - 00000000 ____D () D:\Users\Admin\AppData\Local\Adobe 2015-02-21 14:30 - 2013-12-10 22:26 - 01429806 _____ () C:\Windows\WindowsUpdate.log 2015-02-21 14:11 - 2013-12-13 21:27 - 00002070 _____ () D:\Users\Public\Desktop\Google Chrome.lnk 2015-02-21 12:47 - 2014-09-07 13:29 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (2) 2015-02-21 11:27 - 2013-12-13 21:12 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-21 11:23 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_log 2015-02-20 21:59 - 2013-10-09 08:11 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-20 21:59 - 2013-08-23 00:24 - 00765582 _____ () C:\Windows\system32\perfh007.dat 2015-02-20 21:59 - 2013-08-23 00:24 - 00159366 _____ () C:\Windows\system32\perfc007.dat 2015-02-20 21:52 - 2014-02-22 16:14 - 00000080 _____ () D:\Users\postgres\postmaster.opts 2015-02-20 21:52 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\global 2015-02-20 21:52 - 2014-02-22 16:02 - 00000000 ____D () D:\Users\postgres 2015-02-20 21:52 - 2014-01-06 01:55 - 00033999 _____ () C:\Windows\setupact.log 2015-02-20 21:52 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-20 16:22 - 2014-01-05 01:13 - 00057090 _____ () C:\Windows\PFRO.log 2015-02-20 16:18 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-20 16:17 - 2013-12-20 08:47 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner 2015-02-20 16:15 - 2014-09-30 21:31 - 00000000 ____D () C:\AdwCleaner 2015-02-20 16:14 - 2014-12-05 20:36 - 00000110 _____ () C:\AdwCleanerDebug.txt 2015-02-20 14:23 - 2013-12-10 22:23 - 00000000 __SHD () C:\Recovery 2015-02-20 14:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-02-19 02:44 - 2014-02-05 01:54 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\CrashDumps 2015-02-19 01:54 - 2014-02-19 03:11 - 00000000 ____D () D:\Users\Anonymous\Documents\My Games 2015-02-18 21:22 - 2014-02-17 04:20 - 00005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-02-18 21:22 - 2014-01-19 09:43 - 00000000 ____D () D:\Users\Anonymous\Documents\Camtasia Studio 2015-02-18 16:49 - 2014-02-18 12:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\dxhr 2015-02-16 02:57 - 2013-12-13 21:58 - 00000000 ____D () D:\Users\Anonymous 2015-02-12 20:18 - 2014-01-12 23:31 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Spotify 2015-02-12 20:18 - 2014-01-12 23:20 - 00000000 ____D () D:\Users\Anonymous\AppData\Roaming\Spotify 2015-02-12 13:44 - 2015-01-21 16:23 - 00000000 ____D () D:\Users\Anonymous\dwhelper 2015-02-12 10:48 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2015-02-12 10:48 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-02-11 22:23 - 2013-12-15 17:56 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\PokerStars.FR 2015-02-11 13:58 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2015-02-11 10:12 - 2013-08-22 15:44 - 00484104 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-11 08:14 - 2013-12-13 23:54 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-11 08:06 - 2013-12-13 23:54 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-08 17:20 - 2014-02-10 09:52 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\eclipse 2015-02-05 09:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-05 01:42 - 2014-02-02 01:10 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Audible 2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-31 14:22 - 2014-06-25 16:17 - 00178688 ___SH () D:\Users\Anonymous\Downloads\Thumbs.db 2015-01-30 10:58 - 2014-01-02 15:32 - 00000000 ____D () C:\Windows\Minidump 2015-01-29 10:46 - 2013-12-22 00:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-28 00:44 - 2014-10-16 09:07 - 00000000 ____D () D:\Users\Anonymous\Downloads\Informatik 2015-01-25 12:46 - 2013-12-13 21:47 - 00000000 ____D () D:\Users\Admin 2015-01-24 14:48 - 2014-10-18 15:22 - 00000000 ____D () C:\Temp 2015-01-23 03:55 - 2015-01-03 17:14 - 00000000 ____D () D:\Users\Anonymous\workspace1 ==================== Files in the root of some directories ======= 2014-03-01 02:25 - 2014-03-01 02:25 - 2987391 _____ () D:\Users\Anonymous\AppData\Local\ASbs.ac 2014-02-17 04:20 - 2015-02-18 21:22 - 0005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-04-17 16:28 - 2014-04-17 16:28 - 0005037 _____ () C:\ProgramData\flwjycbm.bab Some content of TEMP: ==================== D:\Users\Admin\AppData\Local\Temp\AskPIP_FF_.exe D:\Users\Admin\AppData\Local\Temp\Quarantine.exe D:\Users\Admin\AppData\Local\Temp\sfamcc00001.dll D:\Users\Admin\AppData\Local\Temp\sfextra.dll D:\Users\Admin\AppData\Local\Temp\SIInvoker.exe D:\Users\Admin\AppData\Local\Temp\sqlite3.dll D:\Users\Admin\AppData\Local\Temp\xmlUpdater.exe D:\Users\Admin\AppData\Local\Temp\{0D87D2C5-67A7-407E-A3D9-268B0FB322F3}-34.0.1847.137_chrome_installer.exe D:\Users\Admin\AppData\Local\Temp\{58DD2574-8B53-4D6A-BDE3-F14ACA9DBD5B}-34.0.1847.137_chrome_installer.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ CODE] Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Anonymous at 2015-02-21 15:19:34
Running from D:\Users\Anonymous\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Airplane Mode Hid Installer (HKLM-x32\...\InstallShield_{5E5B067F-52A4-447E-A3F1-D6DD10565E73}) (Version: 2.0.0.6 - )
Airplane Mode Hid Installer (x32 Version: 2.0.0.6 - ) Hidden
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Assassin's Creed IV Black Flag (HKLM-x32\...\Uplay Install 273) (Version: - Ubisoft)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1694499172.4759644.48.2147344384 - Audible, Inc.)
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version: - Rocksteady Studios)
BioShock (HKLM-x32\...\Steam App 7670) (Version: - 2K Boston)
BlackChipPoker (HKLM-x32\...\FE4D6F94-B3D5-484b-94F7-8BC45DEB7A82) (Version: 16.6 - IGSoft)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Camtasia Studio 8 (HKLM-x32\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
CarbonPoker (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\CarbonPoker) (Version: 6.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version: - Relic Entertainment)
CREVbeta (HKLM-x32\...\{6B7961D1-A7A3-4F1A-927B-E1EFACB9AE4F}) (Version: 2.9.4 - CardRunnersEV)
Democracy 3 (HKLM-x32\...\Steam App 245470) (Version: - Positech Games)
Deus Ex: Human Revolution - Director's Cut (HKLM-x32\...\Steam App 238010) (Version: - Eidos Montreal)
EMET 5.1 (HKLM-x32\...\{72E7AE20-5B12-4F27-AF5E-DA03E3C09466}) (Version: 5.1 - Microsoft Corporation)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Game Studios)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version: - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
FormatFactory 3.3.4.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.4.0 - Format Factory)
Full Tilt Poker.Eu (HKLM-x32\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.4.1.WIN.FullTilt.EU - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version: - )
Hotkey 8.0135 (HKLM-x32\...\InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}) (Version: 8.0135 - NoteBook)
Hotkey 8.0135 (x32 Version: 8.0135 - NoteBook) Hidden
Insyde Airplane Mode HID Mini-Driver (HKLM\...\AirplaneModeHid) (Version: 1.3.0.0 - Insyde Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
ioCentre (HKLM-x32\...\{A2B4621B-CEB9-4E44-95FD-3500D4DB3727}) (Version: 1.02.000 - KYE)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Knights Of Honor (HKLM-x32\...\{7911C404-9AFA-4BB2-B9B7-E47423D87528}) (Version: 1.00 - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version: - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version: - )
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nero 2014 (HKLM-x32\...\{0128492C-AB60-43BE-9D9A-8CA622CAF06E}) (Version: 15.0.07700 - Nero AG)
Nero BackItUp 12 Essentials (HKLM-x32\...\{0E3368AC-FB29-4C5E-938E-FA11C12D035E}) (Version: 12.0.01200 - Nero AG)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 12.0.4000 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 15.1.0030 - Nero AG)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenDNS Updater 2.2.1 (HKLM-x32\...\OpenDNS Updater) (Version: 2.2.1 - )
Opera Stable 27.0.1689.69 (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Opera 27.0.1689.69) (Version: 27.0.1689.69 - Opera Software ASA)
Oracle VM VirtualBox 4.3.20 (HKLM\...\{DD8F7A7A-852F-4648-8A73-B8FC1DF5F082}) (Version: 4.3.20 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Port Royale 2 (HKLM-x32\...\Steam App 12470) (Version: - Ascaron Entertainment ltd.)
PostgreSQL 8.4 (HKLM-x32\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden
Pro Evolution Soccer 2013 (HKLM-x32\...\{C2523AE6-F335-4D0B-BC15-1C07E4ACE629}) (Version: 1.00.0000 - KONAMI)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.27040 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.49 - Piriform)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SMPlayer 0.8.6.0 (HKLM-x32\...\SMPlayer) (Version: 0.8.6.0 - Ricardo Villalba)
Sound Blaster Cinema (HKLM-x32\...\{8801CA65-921A-4CCC-9D63-879D1D0BAA97}) (Version: 1.00.03 - Creative Technology Limited)
Spotify (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.5.1.1 - Synaptics Incorporated)
TDM-GCC (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\TDM-GCC) (Version: 1.1309.0 - TDM)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version: - CD Projekt RED)
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version: - The Creative Assembly)
Uplay (HKLM-x32\...\Uplay) (Version: 4.5 - Ubisoft)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
Video DVD Maker v3.30.0.75 (HKLM-x32\...\{1A3E23D7-7A1E-43EC-B35D-EB2A31BED943}) (Version: - )
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Mobile Device Center Driver Update (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows-Treiberpaket - Insyde (AirplaneModeHid) HIDClass (07/01/2013 1.3.0.0) (HKLM\...\E38E8D276444640BFCE21B5A73FD63C479B76259) (Version: 07/01/2013 1.3.0.0 - Insyde)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 1.12.3 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.3 - The Wireshark developer community, hxxp://www.wireshark.org)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2015-02-21 14:49 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) ==============
2014-11-09 16:10 - 2014-11-09 16:10 - 00166536 _____ () C:\Program Files (x86)\EMET 5.1\HelperLib.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045192 _____ () C:\Program Files (x86)\EMET 5.1\TrayIconSubsystem.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045704 _____ () C:\Program Files (x86)\EMET 5.1\TelemetrySubsystem.dll
2014-02-08 18:19 - 2014-02-08 18:19 - 00348160 _____ () C:\Program Files (x86)\EMET 5.1\DevExpress.UserSkins.HighContrast.dll
2014-01-25 02:22 - 2014-10-03 16:36 - 00457616 _____ () C:\Windows\system32\igfxTray.exe
2013-12-10 22:30 - 2012-11-14 14:22 - 00078456 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2013-12-10 22:30 - 2012-11-14 14:22 - 00386168 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-12-10 22:33 - 2012-11-01 11:23 - 00089600 _____ () C:\Windows\SYSTEM32\CmdRtr64.DLL
2013-12-10 22:33 - 2012-11-01 11:21 - 00325120 _____ () C:\Windows\SYSTEM32\APOMgr64.DLL
2013-09-27 12:02 - 2013-09-27 12:02 - 04903424 _____ () C:\Program Files (x86)\Hotkey\Hotkey.exe
2013-12-12 13:38 - 2009-09-03 11:30 - 00060928 _____ () C:\Genius\ioCentre\gTaskBar.exe
2013-12-12 13:38 - 2009-09-03 10:45 - 00161280 _____ () C:\Genius\ioCentre\GenXML.dll
2013-12-12 13:38 - 2011-08-05 10:01 - 00961536 _____ () C:\Genius\ioCentre\gMouseTask.exe
2013-12-12 13:38 - 2009-09-03 11:22 - 00063488 _____ () C:\Genius\ioCentre\gfMedia.dll
2013-12-12 13:38 - 2011-06-09 14:26 - 00052224 _____ () C:\Genius\ioCentre\gfBrowser.dll
2013-12-12 13:38 - 2009-09-03 11:23 - 00020992 _____ () C:\Genius\ioCentre\gfOffice.dll
2013-12-12 13:38 - 2009-09-03 11:24 - 00027648 _____ () C:\Genius\ioCentre\gfSystem.dll
2013-12-12 13:38 - 2009-09-03 11:18 - 00040960 _____ () C:\Genius\ioCentre\gfEmail.dll
2013-12-12 13:38 - 2011-08-04 16:45 - 00266752 _____ () C:\Genius\ioCentre\gDevMgm.dll
2013-12-12 13:38 - 2011-08-04 16:48 - 00758784 _____ () C:\Genius\ioCentre\gKbdTask.exe
2013-12-12 13:38 - 2009-09-03 10:55 - 00069120 _____ () C:\Genius\ioCentre\gAutoScroll.dll
2013-12-12 13:38 - 2009-09-03 10:54 - 00249344 _____ () C:\Genius\ioCentre\gAutoPan.dll
2013-12-12 13:38 - 2009-09-03 11:06 - 00259072 _____ () C:\Genius\ioCentre\gZoom.dll
2013-12-12 13:38 - 2009-09-03 11:25 - 00025088 _____ () C:\Genius\ioCentre\gIoCentreHook.dll
2013-12-12 13:38 - 2009-09-03 11:05 - 00048640 _____ () C:\Genius\ioCentre\gTaskSwitch.dll
2013-12-12 13:38 - 2010-04-07 18:05 - 00258560 _____ () C:\Genius\ioCentre\gDeskMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00246784 _____ () C:\Genius\ioCentre\gKbStatus.dll
2013-12-12 13:38 - 2009-09-03 10:59 - 00053760 _____ () C:\Genius\ioCentre\gIMMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00143360 _____ () C:\Genius\ioCentre\gPreset.dll
2013-12-12 13:38 - 2009-09-03 10:58 - 00044544 _____ () C:\Genius\ioCentre\gIMHook.dll
2013-12-12 13:38 - 2009-09-03 11:04 - 00056832 _____ () C:\Genius\ioCentre\gTabSwitch.dll
2013-12-10 22:29 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: D:\Users\Anonymous\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Control Panel\Desktop\\Wallpaper -> D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: ADExchange => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
HKLM\...\StartupApproved\StartupFolder: => "Secunia PSI Tray.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\StartupApproved\Run: => "Spotify"
==================== Accounts: =============================
Admin (S-1-5-21-1788917750-2918846918-3832768059-1007 - Administrator - Enabled) => D:\Users\Admin
Administrator (S-1-5-21-1788917750-2918846918-3832768059-500 - Administrator - Disabled)
Anonymous (S-1-5-21-1788917750-2918846918-3832768059-1008 - Limited - Enabled) => D:\Users\Anonymous
Gast (S-1-5-21-1788917750-2918846918-3832768059-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1788917750-2918846918-3832768059-1012 - Limited - Enabled)
postgres (S-1-5-21-1788917750-2918846918-3832768059-1010 - Limited - Enabled) => D:\Users\postgres
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools (T:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable).
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable).
Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
DETAIL - Das System kann die angegebene Datei nicht finden.
System errors:
=============
Error: (02/21/2015 02:22:32 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (02/21/2015 02:22:02 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (02/21/2015 02:17:19 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (02/21/2015 02:16:49 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (02/21/2015 01:51:50 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (02/21/2015 01:51:20 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (02/21/2015 01:46:37 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (02/21/2015 01:46:07 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (02/20/2015 11:09:42 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (02/20/2015 09:52:05 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Windows\SysWow64\drivers\SSHDRV76.sys
Microsoft Office Sessions:
=========================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE tools (T:)Falscher Parameter. (0x80070057)
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable)
Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.
System Error:
0xC0000039 (unresolvable)
Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.
CodeIntegrity Errors:
===================================
Date: 2015-02-20 17:44:23.753
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2015-02-15 13:39:06.049
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.897
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.635
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.479
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.204
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:05.045
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:04.745
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:04.590
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-02-15 13:39:04.319
Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Percentage of memory in use: 45%
Total physical RAM: 8111.55 MB
Available physical RAM: 4400.98 MB
Total Pagefile: 16303.55 MB
Available Pagefile: 11541.41 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:435.72 GB) (Free:352.13 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.39 GB) (Free:412.05 GB) NTFS
Drive r: (Recovery Image) (Fixed) (Total:10.74 GB) (Free:10.66 GB) NTFS
Drive t: (Windows RE tools) (Fixed) (Total:0.29 GB) (Free:0.27 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
|
|
22.02.2015, 08:34
| #4 |
| /// the machine /// TB-Ausbilder | Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe Unsere Tools brauchen immer Adminrechte. Lass die von MBAM gefundenen Dateien bitte bei Virustotal scannen. Dateien online auf Viren prüfen - so geht's - Anleitungen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.02.2015, 19:48
| #5 |
| | Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe 0/57 bei Virustotal Malwarebytes findet auch nichts mehr. Soll Ich die anderen Tools jetzt nochmal mit Adminrechten ausführen ? |
|
23.02.2015, 12:16
| #6 |
| /// the machine /// TB-Ausbilder | Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe Da die Funde ja Fehlalarme waren, nö 
__________________ --> Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe |
|
| Themen zu Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe |
| .dll, adobe, adobe flash player, adware, backdoor, browser, defender, device driver, dll, downloader, explorer, firefox, flash player, geforce, homepage, iexplore.exe, malware, mozilla, notebook, nvidia, office 365, onedrive, opera, photoshop, popup, rundll, security, software, system, uplay, virtualbox, windows |
Linear-Darstellung
