Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Tencent nicht deinstallierbar + AMWB Server nicht erreichbar

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 11.03.2015, 17:24   #1
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Hallo,

ich würde gerne noch einmal um Hilfe bitten. Wir haben einen Rechner mit deutschen Win 8.1 und AMWB Pro in England, der von Tencent Programmen "infiziert" ist, die wir nicht deinstalliert bekommen. Außerdem baut der AMWB keine Verbindung mit dem Update Server auf. Zusätzlcih war vor kurzem ein Bluescreen Event. Wir wisse nicht, ob die drei Dinge zusammenhängen, würden aber gerne eure Hilfe in Ansprich nehmen. Wir haben auch im AMWB Forum nachgefragt, bisher aber keien Rückmeldung bekommen.

Wei lder Rechner in UK ist, dauert es immer ein wenig, bis ich Rückmeldung von dort bekomme, daher die Bitte um Geduld bei etwas länger dauerneder Kommunikation.

Anbei die Scans.

Danke
bD

Alt 11.03.2015, 17:40   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 11.03.2015, 17:44   #3
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Sorry,
hier die Logfiles :

FRST

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Standard (administrator) on TOSHIBA1LQ on 05-03-2015 19:46:41
Running from C:\Users\Standard\Desktop
Loaded Profiles: Standard (Available profiles: Standard & Gast1)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default
FF Homepage: google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll (Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-02-03]
FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\CNTVLive2@www.cntv.cn [2014-07-08]
FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-01]
FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-16]
FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-17] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 ASPI32; No ImagePath
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43064 2014-10-14] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2015-03-05] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-05 19:46 - 2015-03-05 19:47 - 00014187 _____ () C:\Users\Standard\Desktop\FRST.txt
2015-03-05 19:45 - 2015-03-05 19:46 - 00000000 ____D () C:\FRST
2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe
2015-03-05 19:36 - 2015-03-05 19:36 - 02092544 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe
2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk
2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Downloads\JRT.exe
2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll
2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll
2015-03-03 14:01 - 2015-03-03 14:01 - 02126848 _____ () C:\Users\Standard\Desktop\adwcleaner_4.111.exe
2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp
2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump
2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP
2015-02-27 20:36 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls
2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2015-02-12 22:04 - 2015-01-23 04:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-02-12 22:04 - 2015-01-23 03:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-02-11 22:20 - 2015-02-03 23:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-02-11 22:20 - 2015-02-03 23:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-02-11 22:20 - 2015-02-03 23:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-02-11 22:20 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-02-11 22:20 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2015-02-11 22:20 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2015-02-11 22:20 - 2014-12-08 23:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-02-11 22:01 - 2015-02-11 22:01 - 00007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg
2015-02-11 20:14 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-02-11 20:14 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-02-11 20:14 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-02-11 20:14 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-02-11 20:14 - 2015-01-13 22:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-02-11 20:14 - 2015-01-13 22:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-02-11 20:14 - 2015-01-10 09:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-02-11 20:14 - 2015-01-10 09:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-02-11 20:14 - 2015-01-10 08:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-02-11 20:14 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll
2015-02-11 20:14 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll
2015-02-11 20:14 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll
2015-02-11 20:14 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2015-02-11 20:14 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2015-02-11 20:14 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll
2015-02-11 20:14 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-02-11 20:14 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-02-11 20:14 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-02-11 20:14 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-02-11 20:14 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-02-11 20:14 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll
2015-02-11 20:14 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe
2015-02-11 20:14 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe
2015-02-11 20:14 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe
2015-02-11 20:13 - 2015-01-12 03:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-02-11 20:13 - 2015-01-12 02:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-02-11 20:13 - 2015-01-12 02:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-02-11 20:13 - 2015-01-12 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-02-11 20:13 - 2015-01-12 02:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-02-11 20:13 - 2015-01-12 02:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-02-11 20:13 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-02-11 20:13 - 2015-01-12 02:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-02-11 20:13 - 2015-01-12 02:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-02-11 20:13 - 2015-01-12 02:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-02-11 20:13 - 2015-01-12 02:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-02-11 20:13 - 2015-01-12 01:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-02-11 20:13 - 2015-01-12 01:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-02-11 20:13 - 2015-01-12 01:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-02-11 20:13 - 2015-01-12 01:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-02-11 20:13 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-02-11 20:13 - 2015-01-12 01:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-02-11 20:13 - 2015-01-12 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-02-11 20:13 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-02-11 20:13 - 2015-01-12 01:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-02-11 20:13 - 2015-01-12 01:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-02-11 20:13 - 2015-01-12 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-02-11 20:13 - 2015-01-12 01:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-02-11 20:13 - 2015-01-12 01:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-02-11 20:13 - 2015-01-12 01:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-02-11 20:13 - 2015-01-12 01:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-02-11 20:13 - 2015-01-12 01:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-02-11 20:13 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-02-11 20:13 - 2015-01-12 01:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-02-11 20:13 - 2015-01-12 01:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-02-11 20:13 - 2015-01-12 01:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-02-11 20:13 - 2015-01-12 01:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-02-11 20:13 - 2015-01-12 00:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-02-11 20:13 - 2015-01-12 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-02-11 20:13 - 2015-01-10 07:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-02-11 20:13 - 2015-01-10 06:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-02-11 20:11 - 2015-01-10 08:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 19:34 - 2013-10-29 14:53 - 01559257 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-05 19:20 - 2013-08-17 16:59 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893-1633341002-1001
2015-03-05 19:15 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-03-05 19:11 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-05 19:11 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-03-05 19:11 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data
2015-03-05 19:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-05 19:08 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6}
2015-03-05 19:07 - 2013-08-22 14:46 - 00315945 _____ () C:\WINDOWS\setupact.log
2015-03-05 19:05 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP
2015-03-05 19:04 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive
2015-03-05 01:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-03-03 15:01 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-03-03 15:00 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner
2015-03-03 14:48 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard
2015-03-03 13:33 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-24 23:09 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-12 09:24 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-12 09:23 - 2013-09-29 19:04 - 00032246 _____ () C:\WINDOWS\PFRO.log
2015-02-12 00:38 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast1
2015-02-12 00:38 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-02-12 00:37 - 2013-08-19 01:13 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-11 20:49 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-04 23:09 - 2013-08-17 18:18 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-02-03 19:31 - 2014-12-12 11:05 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-02-03 19:31 - 2014-12-12 11:05 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg

Some content of TEMP:
====================
C:\Users\Standard\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-03 21:39

==================== End Of Log ============================
         
--- --- ---


Additions :
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-03-2015 01
Ran by Standard at 2015-03-05 19:47:46
Running from C:\Users\Standard\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29480 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)
Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1402.1 - Microsoft Corporation) Hidden
Update for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

11-02-2015 20:53:45 Windows Update
19-02-2015 22:58:54 Geplanter Prüfpunkt
24-02-2015 23:09:15 Windows Update
04-03-2015 00:04:32 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll
2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:88050731
AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"

==================== Accounts: =============================

Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)
Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)
Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1
Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0xa34
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5

Error: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0xec
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5

Error: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0x12c4
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5

Error: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0x76c
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3
Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5


System errors:
=============
Error: (03/05/2015 07:45:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 4 Mal passiert.

Error: (03/05/2015 07:27:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.

Error: (03/04/2015 00:05:25 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{0a543ba0-7861-11e2-8d38-d60b12dec0bc}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{84DCEC0C-94C3-49C0-B572-5573AA6F1404}

Error: (03/04/2015 00:05:14 AM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "TI31051200A" wurde eine Beschädigung erkannt.

In einer Indexstruktur des Dateisystems wurde eine Beschädigung gefunden. Die Dateireferenznummer ist 0x40000000162f1. Der Name der Datei ist "\Windows\System32\DriverStore\FileRepository". Das Attribut des beschädigten Indexes ist ":$I30:$INDEX_ALLOCATION".

Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (03/03/2015 03:16:24 PM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "C:" wurde eine Beschädigung erkannt.

Die genaue Art der Beschädigung ist unbekannt. Die Dateisystemstrukturen müssen online überprüft werden.

Error: (03/03/2015 03:12:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.

Error: (03/03/2015 03:02:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aa3401d0577ce9733e01C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe275745ee-c370-11e4-bed7-7c050738016e

Error: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aec01d0577a69f6aa56C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exea8e40698-c36d-11e4-bed7-7c050738016e

Error: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a12c401d055c47b2b8440C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeb937cef2-c1b7-11e4-bed7-7c050738016e

Error: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a76c01d055c2f82e9b10C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe3fd774c2-c1b6-11e4-bed7-7c050738016e


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHz
Percentage of memory in use: 23%
Total physical RAM: 8073.22 MB
Available physical RAM: 6151.34 MB
Total Pagefile: 16265.22 MB
Available Pagefile: 14374.57 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:597.87 GB) NTFS
Drive d: (TOSHIBA EXT) (Fixed) (Total:465.76 GB) (Free:422.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: E6615A88)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

CHECKRESULTS
Code:
ATTFilter
mbam-check result log version:     2.1.1.1001
========================================

User Account type:                 Administrator
OS:                                Windows 8.1  64 bit Operating System
Current Version and Build:         6.3.9200.0 
 Malwarebytes Anti-Malware :         
Installed On:                      2014/06/25
Malware Database:                  0000.00.00.00
Rootkit Database:                  0000.00.00.00
Remediation Database:              0000.00.00.00
IP Database:                       0000.00.00.00
Domain Database:                   0000.00.00.00
License:                           Premium
Malware Protection:                4 (The service is running.)
Malicious Website Protection:      1 (The service is not running.)
Chameleon:                         0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon
Log Created:                       2015/03/05 20:03:28
Compatibility Flag Settings:
=================================





Malwarebytes Anti-Malware Shell Extension Block Check:
======================================================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked:

MBAM Startup Entries: 
=====================
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Malwarebytes Anti-Malware Service and Driver Status:
=======================================================

--------------Driver File Info:--------------
C:\WINDOWS\system32\drivers\mbam.sys
File Size:     25816 BYTES	FileVersion: 0.1.13.0	MD5: [f92b0e478c0faa6d6661e6e977247e60]
C:\WINDOWS\system32\drivers\mwac.sys
File Size:     64216 BYTES	FileVersion: 1.0.1.0	MD5: [0664f6335f108f38fe08c3ca747311ee]
C:\WINDOWS\system32\drivers\mbamswissarmy.sys
File Size:    122584 BYTES	FileVersion: 0.1.7.0	MD5: [8a50d5304e6ae48664cf5838ec32f647]
C:\WINDOWS\system32\drivers\mbamchameleon.sys
File Size:     91352 BYTES	FileVersion: 1.0.4.0	MD5: [9d9ed48f841ea37aa5310d54b9e5d3c7]

--------------MBAMProtector:--------------
Type:                   2
State:                  4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0


--------------MBAMService:--------------
Type:                   16
State:                  1 (The service is not running.) (State is stopped)
WIN32_EXIT_CODE:        1067
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0


--------------MBAMScheduler:--------------
Type:                   16
State:                  4 (The service is running.)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0


--------------MBAMChameleon:--------------
Type:                   N/A
State:                  0 <--CAN NOT OPEN SC_HANDLE, SERVICE IS NOT RUNNING FOR: MBAMChameleon
WIN32_EXIT_CODE:        N/A
SERVICE_EXIT_CODE:      N/A
CHECKPOINT:             N/A
WAIT_HINT:              N/A


--------------MBAMWebAccessControl:--------------
Type:                   1
State:                  1 (The service is not running.) (State is stopped)
WIN32_EXIT_CODE:        1077
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0


Required Dependencies:
======================

--------------BFE:--------------
Type:                   32
State:                  4 (The service is running.)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
	DisplayName                   REG_SZ		@%SystemRoot%\system32\bfe.dll,-1001
	ErrorControl                  REG_DWORD		1
	Group                         REG_SZ		NetworkProvider
	ImagePath                     REG_EXPAND_SZ	%systemroot%\system32\svchost.exe -k LocalServiceNoNetwork
	Start                         REG_DWORD		2
	Type                          REG_DWORD		32
	Description                   REG_SZ		@%SystemRoot%\system32\bfe.dll,-1002
	DependOnService               REG_MULTI_SZ	RpcSs
							WfpLwfs

	ObjectName                    REG_SZ		NT AUTHORITY\LocalService
	ServiceSidType                REG_DWORD		3
	RequiredPrivileges            REG_MULTI_SZ	SeAuditPrivilege

	FailureActions                REG_BINARY	Binary Data

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters
	ServiceDllUnloadOnStop        REG_DWORD		1
	ServiceMain                   REG_SZ		BfeServiceMain
	ServiceDll                    REG_EXPAND_SZ	%SystemRoot%\System32\bfe.dll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\BootTime\Filter
	{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY	Binary Data

	{84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY	Binary Data

	{dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY	Binary Data

	{0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY	Binary Data

	{12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY	Binary Data

	{c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY	Binary Data

	{0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY	Binary Data

	{074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY	Binary Data

	{c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY	Binary Data

	{a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY	Binary Data

	{0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY	Binary Data

	{2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY	Binary Data

	{2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY	Binary Data

	{c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY	Binary Data

	{935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY	Binary Data

	{941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY	Binary Data

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Options
	EnablePacketQueue             REG_DWORD		0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Callout
	{22001ee0-8e87-4f75-ba58-248f5918a63a}REG_BINARY	Binary Data

	{79f2a265-b693-4cc9-b480-cbcd87bd4747}REG_BINARY	Binary Data

	{c4b50f21-503e-4d7a-abd4-ed0a823a2453}REG_BINARY	Binary Data

	{91e902db-2cef-4040-b8e2-02fe4fd49c25}REG_BINARY	Binary Data

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Filter
	{3a90a266-1519-4d23-911b-e84cd0f02ab8}REG_BINARY	Binary Data

	{8b50e2ec-7cF0-4b71-b42e-5b0536f6cab8}REG_BINARY	Binary Data

	{17043d46-fac2-4561-bca1-0c7a05e95f5f}REG_BINARY	Binary Data

	{3180114b-8338-4740-9a16-444134ad62f4}REG_BINARY	Binary Data

	{d870c96c-75ee-46a6-8a02-8e4401a73423}REG_BINARY	Binary Data

	{4137b143-2770-43d4-91a2-55bb0a069830}REG_BINARY	Binary Data

	{b02a4013-b6b5-4859-9168-1e3299e43b24}REG_BINARY	Binary Data

	{4e718c57-c397-4221-9fbb-14fd51701d6a}REG_BINARY	Binary Data

	{567d3836-3f5b-4067-b9c4-952f677010a2}REG_BINARY	Binary Data

	{70694559-714a-4a38-a0cd-51439e06f1d8}REG_BINARY	Binary Data

	{89a89b7c-b5ab-4ed6-bf05-d3059281a5c5}REG_BINARY	Binary Data

	{84750a0c-b836-48e3-ab80-104985c857db}REG_BINARY	Binary Data

	{e72646bc-7d3f-4c5c-a679-b3716f8c6cc8}REG_BINARY	Binary Data

	{b98b75dc-17c0-4e84-bd4e-2080527ca6a6}REG_BINARY	Binary Data

	{56b4fdc4-bb4e-4c42-a9d8-f627ee15ac21}REG_BINARY	Binary Data

	{1ba41ed8-151d-4577-9272-317856bc637c}REG_BINARY	Binary Data

	{9248d57e-f843-4159-807d-3813173e2096}REG_BINARY	Binary Data

	{4658cd86-525d-44ed-98a5-791a7b8655f1}REG_BINARY	Binary Data

	{dc95b53e-01cf-4058-821d-350b3d0d4676}REG_BINARY	Binary Data

	{f444c576-6e60-4ea2-9faa-80d57ed12cd2}REG_BINARY	Binary Data

	{0c41d586-9c19-4e01-9d66-b5b98a97576e}REG_BINARY	Binary Data

	{12c38916-82ac-4737-8f38-b6957ffebad6}REG_BINARY	Binary Data

	{c970a45d-57f9-4e32-a5bd-886a9662641e}REG_BINARY	Binary Data

	{0c3be01b-fe70-4cc4-89dc-c07996b67e6d}REG_BINARY	Binary Data

	{4d9581d2-aef8-4993-84cd-b986ced80d42}REG_BINARY	Binary Data

	{be7cbdf4-b192-4aa5-94f8-1fb5c5ee07bc}REG_BINARY	Binary Data

	{716b48eb-0a35-4a76-92ab-1d987230d288}REG_BINARY	Binary Data

	{1165065e-4996-4338-abaf-4b8556b4d431}REG_BINARY	Binary Data

	{07a24961-a760-4e80-b263-6d275e1b09cb}REG_BINARY	Binary Data

	{5b0cb2e2-ab87-4974-9f1c-2f22a654eeb9}REG_BINARY	Binary Data

	{b6b2ca61-fb98-4422-adc2-e7cf56b3680c}REG_BINARY	Binary Data

	{0aa7fff8-919f-453c-928c-28a12122ba38}REG_BINARY	Binary Data

	{074f7f68-ee10-428a-89d1-ba78f6c327ca}REG_BINARY	Binary Data

	{c016105c-eb34-4519-a5fd-5f4e4ad4d18e}REG_BINARY	Binary Data

	{a47525e2-725b-4888-8af1-ba5a60c04f4d}REG_BINARY	Binary Data

	{0ccc96a3-8c5c-45e2-b80e-7e37b16cc1ad}REG_BINARY	Binary Data

	{91ffecf0-0a9e-4572-95f1-a7111af86967}REG_BINARY	Binary Data

	{64e55933-15a5-495d-a928-ccca43d44875}REG_BINARY	Binary Data

	{13bfd422-6f75-4408-8924-9400ec0cb19c}REG_BINARY	Binary Data

	{cbfb56db-3c85-4543-9bc2-76ea28cdd74e}REG_BINARY	Binary Data

	{2dd96961-5757-434f-b617-34e732517c0e}REG_BINARY	Binary Data

	{375fb39b-08c6-40f2-bdf2-08fa63f970a2}REG_BINARY	Binary Data

	{2db25e6c-f07a-44f4-b6c8-50a330d2790b}REG_BINARY	Binary Data

	{c42f1cd6-3a95-4ae2-a513-793c3ae610c7}REG_BINARY	Binary Data

	{b6fdab6b-dcc6-43e3-99ce-7aeca65063a4}REG_BINARY	Binary Data

	{3697a558-3ed3-49be-a4c1-c1a4448653b4}REG_BINARY	Binary Data

	{935b7f48-0ede-44dd-9bc2-e00bb635cda3}REG_BINARY	Binary Data

	{941dad9d-7b1a-4354-997b-00cf1aa9b35c}REG_BINARY	Binary Data

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\Provider
	{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}REG_BINARY	Binary Data

	{4b153735-1049-4480-aab4-d1b9bdc03710}REG_BINARY	Binary Data

	{1bebc969-61a5-4732-a177-847a0817862a}REG_BINARY	Binary Data

	{839cd73f-1907-49ea-9aa5-0e6be9048087}REG_BINARY	Binary Data

	{aa6a7d87-7f8f-4d2a-be53-fda555cd5fe3}REG_BINARY	Binary Data

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy\Persistent\SubLayer
	{b3cdd441-af90-41ba-a745-7c6008ff2300}REG_BINARY	Binary Data

	{b3cdd441-af90-41ba-a745-7c6008ff2301}REG_BINARY	Binary Data

	{b3cdd441-af90-41ba-a745-7c6008ff2302}REG_BINARY	Binary Data

	{9ba30013-c84e-47e5-ac6e-1e1aed72fa69}REG_BINARY	Binary Data

	{8c36b346-4e0c-4049-8b55-5295ac35567c}REG_BINARY	Binary Data

--------------fltmgr:--------------
Type:                   2
State:                  4 (The service is running.) (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE:        0
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\FltMgr
	AttachWhenLoaded              REG_DWORD		1
	DisplayName                   REG_SZ		@%SystemRoot%\system32\drivers\fltmgr.sys,-10001
	ErrorControl                  REG_DWORD		3
	Group                         REG_SZ		FSFilter Infrastructure
	ImagePath                     REG_EXPAND_SZ	system32\drivers\fltmgr.sys
	Start                         REG_DWORD		0
	Tag                           REG_DWORD		1
	Type                          REG_DWORD		2
	Description                   REG_SZ		@%SystemRoot%\system32\drivers\fltmgr.sys,-10000


C:\WINDOWS\system32\drivers\fltmgr.sys
File Size: 360792    BYTES	FileVersion: 6.3.9600.17090	MD5: [6592d192e2823c043edbc010e7774053]
C:\WINDOWS\SysWOW64\olepro32.dll
File Size: 80384     BYTES	FileVersion: 6.3.9600.16384	MD5: [0fc9b04c7f729498b41a19fa55c33573]


MBAM Registry Settings and License Info:
========================================
--------------Settings:--------------
Advanced: 
    AutomaticQuarantine:                                       true 
    AutostartProtection:                                       true 
    LimitedMode:                                               false 
    StartSilentMode:                                           false 
    StartupDelay:                                              0 
ApplicationState: 
    First-Run-After-Installation:                              false 
General: 
    DaysUntilNotifyExpiration:                                 5 
    Language:                                                   
    RightClickAccess:                                          true 
    SilentErrors:                                              false 
Logging: 
    ExportLog:                                                 true 
Notification: 
ProtectionTray: 
    DisplayMilliseconds:                                       7000 
ScanHistory: 
    Duration_Complete:                                         2000 
    Duration_Driver:                                           0 
    Duration_Filesystem:                                       0 
    Duration_Heuristics:                                       0 
    Duration_Loading:                                          0 
    Duration_MasterBootRecord:                                 0 
    Duration_Memory:                                           40000 
    Duration_PreScan:                                          3000 
    Duration_Registry:                                         12000 
    Duration_Sector:                                           0 
    Duration_Startup:                                          13000 
    ItemCount_Complete:                                        0 
    ItemCount_Driver:                                          0 
    ItemCount_Filesystem:                                      0 
    ItemCount_Heuristics:                                      0 
    ItemCount_Loading:                                         0 
    ItemCount_MasterBootRecord:                                0 
    ItemCount_Memory:                                          2797 
    ItemCount_PreScan:                                         0 
    ItemCount_Registry:                                        637 
    ItemCount_Sector:                                          0 
    ItemCount_Startup:                                         1483 
    LastScanDateEpoch:                                         1425395637168 
    LastScanType:                                              1 (Threat Scan)
Update: 
    LastUpdate:                                                2014-07-17T23:03:49 
    NotifyInstallReady:                                        true 
    NotifyOutdatedDatabase:                                    1 
    ProxyPassword:                                              
    ProxyPort:                                                 0 
    ProxyServer:                                                
    ProxyUsername:                                              
    UseProxy:                                                  false 
    UseProxyAuthentication:                                    false 
--------------Account:--------------
  Account Status:                                              Premium 
  Expiration Time:                                             2034/06/25 19:23:27 
  Activation Time:                                             2014/06/25 19:23:27 
  Trial Used:                                                  false 
--------------Access Policies:--------------

Scheduler Queue:
================

tasks: 
    5e7ebea2-0b33-4128-9099-c88ddfcc5630:                       
      parameters:                                               
        CheckForUpdatesBeforeScanStart:                        false 
        ProcessLaunchedFromScheduler:                          true 
        ScanConfig:                                             
          ExitWhenNoMalwareDetected:                           false 
          FileSystemOption:                                    true 
          RebootSystemWhenMalwareDetected:                     false 
          RemoveMalwareAutomaticallyWhenScanEnds:              false 
          ScanArchives:                                        true 
          ScanHeuristic:                                       true 
          ScanMemoryObjects:                                   true 
          ScanPUM:                                             2 
          ScanPUP:                                             2 
          ScanRegistry:                                        true 
          ScanRootkits:                                        false 
          ScanStartup:                                         true 
          ScanTargets:                                          
          ScanType:                                            1 (Threat Scan)
          Silent:                                              true 
        StartTaskFromSystemAccount:                            false 
        TaskType:                                              0 
      triggers:                                                 
        7aac6cd6-1af0-40c1-9471-28baa867892e:                   
          dateinterval:                                        0:0:0 
          lastscheduled:                                       Thu, 05 Mar 2015 19:04:45.710949 +0000 
          lasttriggered:                                       Thu, 05 Mar 2015 19:04:45.710949 +0000 
          nextscheduled:                                       Thu, 05 Mar 2015 20:04:45.710949 +0000 
          recovery:                                            00:00:00 
          start:                                               Tue, 03 Mar 2015 14:13:56 +0000 
          timeinterval:                                        01:00:00 
          type:                                                3 
          uuid:                                                7aac6cd6-1af0-40c1-9471-28baa867892e 
      type:                                                    scan 
      uuid:                                                    5e7ebea2-0b33-4128-9099-c88ddfcc5630 
    90bc4336-09b0-4a97-ab20-e2165a367be4:                       
      parameters:                                               
        CheckForUpdatesBeforeScanStart:                        true 
        ProcessLaunchedFromScheduler:                          true 
        ScanConfig:                                             
          ExitWhenNoMalwareDetected:                           false 
          ExportLog:                                           true 
          FileSystemOption:                                    true 
          RebootSystemWhenMalwareDetected:                     false 
          RemoveMalwareAutomaticallyWhenScanEnds:              false 
          ScanArchives:                                        true 
          ScanExtra:                                           true 
          ScanHeuristic:                                       true 
          ScanMemoryObjects:                                   true 
          ScanPUM:                                             2 
          ScanPUP:                                             2 
          ScanRegistry:                                        true 
          ScanRootkits:                                        false 
          ScanStartup:                                         true 
          ScanTargets:                                          
          ScanType:                                            1 (Threat Scan)
          Silent:                                              true 
          TerminateExplorerWhenMalwareIsRemoved:               false 
        StartTaskFromSystemAccount:                            false 
        TaskType:                                              0 
      triggers:                                                 
        6d7c30f9-93f5-4612-802d-568411c3e122:                   
          dateinterval:                                        1:0:0 
          lastscheduled:                                       Thu, 05 Mar 2015 00:00:06.219142 +0000 
          lasttriggered:                                       Thu, 05 Mar 2015 00:00:06.219142 +0000 
          nextscheduled:                                       Thu, 05 Mar 2015 23:52:54.219142 +0000 
          recovery:                                            23:00:00 
          start:                                               Thu, 26 Jun 2014 03:05:23 +0100 
          timeinterval:                                        00:00:00 
          type:                                                4 
          uuid:                                                6d7c30f9-93f5-4612-802d-568411c3e122 
      type:                                                    scan 
      uuid:                                                    90bc4336-09b0-4a97-ab20-e2165a367be4 
    fe0e7cc5-1a6c-4e1d-9c52-f879e4ff428c:                       
      parameters:                                               
        NotifyWhenUpdateCompletes:                             true 
        ProcessLaunchedFromScheduler:                          true 
        TaskType:                                              3 
      triggers:                                                 
        96f87719-1e68-4d0b-bc5f-c8bb5f8426d4:                   
          dateinterval:                                        0:0:0 
          lastscheduled:                                       Thu, 05 Mar 2015 19:04:45.710949 +0000 
          lasttriggered:                                       Thu, 05 Mar 2015 19:04:45.710949 +0000 
          nextscheduled:                                       Thu, 05 Mar 2015 20:11:49.710949 +0000 
          recovery:                                            00:00:00 
          start:                                               Wed, 25 Jun 2014 19:56:50.261896 +0100 
          timeinterval:                                        01:00:00 
          type:                                                3 
          uuid:                                                96f87719-1e68-4d0b-bc5f-c8bb5f8426d4 
      type:                                                    update 
      uuid:                                                    fe0e7cc5-1a6c-4e1d-9c52-f879e4ff428c 

Pending File Rename Operations: 
================================
If any Malwarebytes Anti-Malware items are listed below, the user must reboot to complete a Malwarebytes Anti-Malware upgrade installation.
Pending File Rename Operations: 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\
	PendingFileRenameOperations	REG_MULTI_SZ	\??\C:\Program Files (x86)\Avira\AntiVir Desktop\aeheur.dll.tmp



MBAMProtector Registry Values:
==============================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector
	Type                          REG_DWORD		2
	Start                         REG_DWORD		3
	ErrorControl                  REG_DWORD		1
	ImagePath                     REG_EXPAND_SZ	\??\C:\WINDOWS\system32\drivers\mbam.sys
	Group                         REG_SZ		FSFilter Anti-Virus
	DependOnService               REG_MULTI_SZ	FltMgr

	WOW64                         REG_DWORD		1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances
	DefaultInstance               REG_SZ		MBAMProtector Instance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Instances\MBAMProtector Instance
	Altitude                      REG_SZ		328800
	Flags                         REG_DWORD		0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMProtector\Parameters
	PassThruFile                  REG_DWORD		0
	ProductPath                   REG_DWORD		0

MBAMService Registry Values:
============================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMService
	Type                          REG_DWORD		16
	Start                         REG_DWORD		2
	ErrorControl                  REG_DWORD		1
	ImagePath                     REG_EXPAND_SZ	"C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe"
	DependOnService               REG_MULTI_SZ	MBAMProtector

	WOW64                         REG_DWORD		1
	ObjectName                    REG_SZ		LocalSystem
	DelayedAutostart              REG_DWORD		0

MBAMScheduler Registry Values:
==============================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MBAMScheduler
	Type                          REG_DWORD		16
	Start                         REG_DWORD		2
	ErrorControl                  REG_DWORD		1
	ImagePath                     REG_EXPAND_SZ	"C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe"
	WOW64                         REG_DWORD		1
	ObjectName                    REG_SZ		LocalSystem

Terminal Services Status for (null) entries in PM logs and GetUserToken errors:
===============================================================================

--------------TERMService:--------------
Type:                   32
State:                  1 (The service is not running.) (State is stopped)
WIN32_EXIT_CODE:        1077
SERVICE_EXIT_CODE:      0
CHECKPOINT:             0
WAIT_HINT:              0


TermService Start is set to: 3 (Manual Startup)

Proxy Status: No proxy is Set

LAN Settings:
=============

only 'Automatically detect settings' is selected

SystemPartition:
================

HKEY_LOCAL_MACHINE\SYSTEM\Setup\
	SystemPartition	REG_SZ		\Device\HarddiskVolume2

Balloon Tips Status:
====================

Enabled

Time Format Settings:
=====================

Should be:
		h:mm:ss tt
		AM 
		PM 
		:

Currently:
REG_SZ		HH:mm:ss
REG_SZ	
REG_SZ	
REG_SZ	

Language and Regional Settings:
===============================

ACP: 	Language is English (United States)
MACCP: 	Language is English (United States)
OEMCP: 850 Please refer to this link for details: Here  

Startup Folders for Error_Expanding_Variables Check:
====================================================

All Users Startup Folder Exists.
Current User's Startup Folder Exists.


Context Menu Entries:
=====================

HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt
	(Default):                    REG_SZ		{57CE581A-0CB6-4266-9CA0-19364C90A0B3}

HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\MBAMShlExt
	(Default):                    REG_SZ		{57CE581A-0CB6-4266-9CA0-19364C90A0B3}

HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt
	(Default):                    REG_SZ		MBAMShlExt Class
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt\CLSID
	(Default):                    REG_SZ		{57CE581A-0CB6-4266-9CA0-19364C90A0B3}
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt\CurVer
	(Default):                    REG_SZ		MBAMExt.MBAMShlExt.1
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1
	(Default):                    REG_SZ		MBAMShlExt Class
HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1\CLSID
	(Default):                    REG_SZ		{57CE581A-0CB6-4266-9CA0-19364C90A0B3}


HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}
	(Default):                    REG_SZ		IMBAMShlExt
HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\ProxyStubClsid32
	(Default):                    REG_SZ		{00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\TypeLib
	(Default):                    REG_SZ		{AFF1A83B-6C83-4342-8E68-1648DE06CB65}
	Version                       REG_SZ		1.0
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}
	(Default):                    REG_SZ		MBAMShlExt Class
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32
	(Default):                    REG_SZ		C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamext.dll
	ThreadingModel                REG_SZ		Apartment
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\ProgID
	(Default):                    REG_SZ		MBAMExt.MBAMShlExt.1
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\TypeLib
	(Default):                    REG_SZ		{AFF1A83B-6C83-4342-8E68-1648DE06CB65}
HKEY_CLASSES_ROOT\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\VersionIndependentProgID
	(Default):                    REG_SZ		MBAMExt.MBAMShlExt

HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0
	(Default):                    REG_SZ		MBAMExt 1.0 Type Library
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0\win32
	(Default):                    REG_SZ		C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamext.dll
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS
	(Default):                    REG_SZ		0
HKEY_CLASSES_ROOT\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\HELPDIR
	(Default):                    REG_SZ		C:\Program Files (x86)\ Malwarebytes Anti-Malware 
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0
	(Default):                    REG_SZ		MBAMExt 1.0 Type Library
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0\win32
	(Default):                    REG_SZ		C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamext.dll
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS
	(Default):                    REG_SZ		0
HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\HELPDIR
	(Default):                    REG_SZ		C:\Program Files (x86)\ Malwarebytes Anti-Malware 


List of MBAM Related Directories:
=================================

C:\Program Files (x86)\ Malwarebytes Anti-Malware \
7z.dll                                  	File Size: 920888    BYTES	FileVersion:  9.20.0.0       MD5: [9f522b2708cab181c0f137abbcd1de2e]
changes.txt                             	File Size: 2261      BYTES	FileVersion:  N/A            MD5: [af70267bdf9a37a96f1a79a5c3720ae6]
license.rtf                             	File Size: 39478     BYTES	FileVersion:  N/A            MD5: [8627b31943a534aad30d154c2b2c1aaf]
master.conf                             	File Size: 1258      BYTES	FileVersion:  N/A            MD5: [9702ca5e82d3756c6d8af34a2ababaea]
mbam.dll                                	File Size: 579896    BYTES	FileVersion:  1.0.7.0        MD5: [d32c2a98859cb22d57a665f15f351e7d]
mbam.exe                                	File Size: 6970168   BYTES	FileVersion:  1.0.0.532      MD5: [4fbc630768570e6ac35c3de8f6ec79f5]
mbamcore.dll                            	File Size: 1680696   BYTES	FileVersion:  1.0.11.0       MD5: [f722fa26739eafcbd8d5f3829b632cd7]
mbamdor.exe                             	File Size: 54072     BYTES	FileVersion:  1.0.1.0        MD5: [4da2f2da54a92850f56c0db712058188]
mbamext.dll                             	File Size: 184632    BYTES	FileVersion:  3.0.4.0        MD5: [945bb364b09f3a8e998dbff02a0a5a58]
mbampt.exe                              	File Size: 39736     BYTES	FileVersion:  1.0.0.0        MD5: [9acd7583584c93ee542c273df8e91dc1]
mbamscheduler.exe                       	File Size: 1809720   BYTES	FileVersion:  3.0.2.0        MD5: [d84aea3f3329d622dfc1297dddf6163b]
mbamservice.exe                         	File Size: 860472    BYTES	FileVersion:  3.0.2.0        MD5: [4f45ed469906494f9bf754e476390dbd]
mbamsrv.dll                             	File Size: 4437816   BYTES	FileVersion:  1.1.0.0        MD5: [9b48e38c35f08fa831b387a0b27c40aa]
mbamtoast.dll                           	File Size: 96568     BYTES	FileVersion:  1.70.0.0       MD5: [cb3f6732c7027a65f56bcb4cc7c481d3]
msvcp100.dll                            	File Size: 421688    BYTES	FileVersion:  10.0.40219.325 MD5: [e4b829081e639e42985853bae754a53d]
msvcr100.dll                            	File Size: 774456    BYTES	FileVersion:  10.0.40219.325 MD5: [80fcedbe920e9cbe30d9d3665bd6efed]
QtCore4.dll                             	File Size: 2732856   BYTES	FileVersion:  4.8.4.0        MD5: [30490eed6a1e20e8259c0b9c58f488fe]
QtGui4.dll                              	File Size: 8575288   BYTES	FileVersion:  4.8.4.0        MD5: [15e21aa7d0c0c994cd565eeb96d13c20]
QtNetwork4.dll                          	File Size: 909112    BYTES	FileVersion:  4.8.4.0        MD5: [d7588d42e29080c32a003bee465160d8]
unins000.dat                            	File Size: 23072     BYTES	FileVersion:  N/A            MD5: [fac020ffb31097943aeef8d7a4552512]
unins000.exe                            	File Size: 720281    BYTES	FileVersion:  51.52.0.0      MD5: [c83db9e4930485eaf971e90043da9e2e]

C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Chameleon

C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Chameleon\Windows
chameleon.chm                           	File Size: 235882    BYTES	FileVersion:  N/A            MD5: [c4190b71f037714aa77aba294434ba5b]
firefox.com                             	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
firefox.exe                             	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
firefox.pif                             	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
firefox.scr                             	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
iexplore.exe                            	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.com                      	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.exe                      	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.pif                      	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-chameleon.scr                      	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
mbam-killer.exe                         	File Size: 1181496   BYTES	FileVersion:  N/A            MD5: [c6927fd8f7e9105b64db5d5a08b53731]
rundll32.exe                            	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
svchost.exe                             	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
windows.exe                             	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]
winlogon.exe                            	File Size: 750392    BYTES	FileVersion:  3.0.4.0        MD5: [09882e8edd1144e6ef1af6d1f98305ee]

C:\Program Files (x86)\ Malwarebytes Anti-Malware \\imageformats
qgif4.dll                               	File Size: 32568     BYTES	FileVersion:  4.8.4.0        MD5: [e59f533c26c8375cd120b4791482217e]

C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Languages
lang_bg.qm                              	File Size: 144048    BYTES	FileVersion:  N/A            MD5: [9ccb79999432d56b9843a3e2b2c90325]
lang_bs.qm                              	File Size: 145523    BYTES	FileVersion:  N/A            MD5: [6ab7a6274d4f9f7553c944f5c66201ba]
lang_ca.qm                              	File Size: 132254    BYTES	FileVersion:  N/A            MD5: [68a83ec63b6e7bc5dbdd412bcc49c6ce]
lang_cs.qm                              	File Size: 141243    BYTES	FileVersion:  N/A            MD5: [6b8acee7f461fa69b83d2c45c3725427]
lang_da.qm                              	File Size: 130101    BYTES	FileVersion:  N/A            MD5: [8539796784746218b229419e99ab308d]
lang_de.qm                              	File Size: 149462    BYTES	FileVersion:  N/A            MD5: [fcd3bc376ad219396e8c7d3c87cd8864]
lang_el.qm                              	File Size: 149912    BYTES	FileVersion:  N/A            MD5: [74f13f95f63fe96c08e571598df052d6]
lang_en.qm                              	File Size: 115961    BYTES	FileVersion:  N/A            MD5: [8c9da1c0ce06b89f8d323bf948bfba4e]
lang_es.qm                              	File Size: 130487    BYTES	FileVersion:  N/A            MD5: [33e1c6d40b841cc2e783ec8d8102e66f]
lang_et.qm                              	File Size: 138126    BYTES	FileVersion:  N/A            MD5: [aa215b5f37a72a69854c9163ac543b51]
lang_fi.qm                              	File Size: 144256    BYTES	FileVersion:  N/A            MD5: [18912c339939c3a6629004ec900f4fe4]
lang_fr.qm                              	File Size: 149253    BYTES	FileVersion:  N/A            MD5: [ec2bf2f431c4273f151b8c8a7b84c387]
lang_he.qm                              	File Size: 116101    BYTES	FileVersion:  N/A            MD5: [9e692744e77051c6ce14df32f9b71920]
lang_hr.qm                              	File Size: 139841    BYTES	FileVersion:  N/A            MD5: [3e3737fe86eb595c5f6817eebf731aa7]
lang_hu.qm                              	File Size: 145621    BYTES	FileVersion:  N/A            MD5: [52d3d7fcf8c8db071ef0573a1357c2fd]
lang_id.qm                              	File Size: 143102    BYTES	FileVersion:  N/A            MD5: [80473d2c73d2f54f2b23c9316f2d0ceb]
lang_it.qm                              	File Size: 146851    BYTES	FileVersion:  N/A            MD5: [7e7aea7d0b433d7e912ed9f0887684a7]
lang_ja.qm                              	File Size: 121282    BYTES	FileVersion:  N/A            MD5: [19ac79b7a5e05d665e417c2dd75afc94]
lang_ko.qm                              	File Size: 118033    BYTES	FileVersion:  N/A            MD5: [de213178c14490bf452ea45278d3442d]
lang_nl.qm                              	File Size: 146325    BYTES	FileVersion:  N/A            MD5: [5aec6f6bdc5e6c28744e6ef374709eeb]
lang_no.qm                              	File Size: 142918    BYTES	FileVersion:  N/A            MD5: [4388c08217618af2e24173af6f5d3f97]
lang_pl.qm                              	File Size: 145434    BYTES	FileVersion:  N/A            MD5: [699700c889447d1f9b607c04f07fff67]
lang_pt_BR.qm                           	File Size: 131739    BYTES	FileVersion:  N/A            MD5: [a3430222223d59da8ec6ea1edae5ee2f]
lang_pt_PT.qm                           	File Size: 149128    BYTES	FileVersion:  N/A            MD5: [afdf1907af4c95f9af510d5fc1bb9067]
lang_ro.qm                              	File Size: 121166    BYTES	FileVersion:  N/A            MD5: [1672a2b3a9807a1497fe43824c0026c0]
lang_ru.qm                              	File Size: 122186    BYTES	FileVersion:  N/A            MD5: [d4dd1eea2b0f52aba2fca4d159c387f7]
lang_sk.qm                              	File Size: 119827    BYTES	FileVersion:  N/A            MD5: [8b200d162e8028843e41aa1a927cfd84]
lang_sl.qm                              	File Size: 143191    BYTES	FileVersion:  N/A            MD5: [1760a6aa6990b2f0c4c71ec04b25ac9c]
lang_sr.qm                              	File Size: 143261    BYTES	FileVersion:  N/A            MD5: [377d15c0da0249f4a7a58978b6307d81]
lang_sv.qm                              	File Size: 142525    BYTES	FileVersion:  N/A            MD5: [2587ead21967296fefdd0ee0684fe8b4]
lang_tr.qm                              	File Size: 142194    BYTES	FileVersion:  N/A            MD5: [880fcbe97ec6f13ec094f7371b5b295f]
lang_vi.qm                              	File Size: 126874    BYTES	FileVersion:  N/A            MD5: [c61281786b5bfec68afc742a19f6abd9]
lang_zh_tr.qm                           	File Size: 110870    BYTES	FileVersion:  N/A            MD5: [f223d83580b1ee35edea13293cb2c80d]

C:\Program Files (x86)\ Malwarebytes Anti-Malware \\Plugins
fixdamage.exe                           	File Size: 821560    BYTES	FileVersion:  1.1.0.1010     MD5: [3a4dcd021d9f3a5305a22e5e309da305]

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware 
actions.ref                             	File Size: 314       BYTES	FileVersion:  N/A            MD5: [b26a36c0696e299fdfebe180c09c2737]
domains.ref                             	File Size: 38        BYTES	FileVersion:  N/A            MD5: [8c30b536b67543eb68e68b9640d4d498]
exclusions.dat                          	File Size: 140       BYTES	FileVersion:  N/A            MD5: [724d5aeeb7e57420d425044679ee5209]
ips.ref                                 	File Size: 33        BYTES	FileVersion:  N/A            MD5: [8a1c580788ea8de3f32862c2c1cf373c]
rules.ref                               	File Size: 8863610   BYTES	FileVersion:  N/A            MD5: [9d389c002ea17dd045da4895ddec27e0]
S-1-5-18-0-ntuser.dat                   	File Size: 704512    BYTES	FileVersion:  N/A            MD5: [6b5a548b3dfd3c0cabef14b49b51b1bd]
S-1-5-18-0-ntuser.dat.LOG1              	File Size: 57344     BYTES	FileVersion:  N/A            MD5: [17df360f3e11285083f09d36011be5e3]
S-1-5-18-0-ntuser.dat.LOG2              	File Size: 143360    BYTES	FileVersion:  N/A            MD5: [33a008b39aa31fcdd90f964e8db3cf01]
S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [6816fb565f2eaaa62f26c6ec8cda8ffa]
S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [a1dac2b305a9d35bad4c5d886e2d4f81]
S-1-5-18-0-ntuser.dat{5ddb03bb-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-1-ntuser.dat                   	File Size: 704512    BYTES	FileVersion:  N/A            MD5: [dc49f2f183e3be3d2d4ff1e5218c4088]
S-1-5-18-1-ntuser.dat.LOG1              	File Size: 188416    BYTES	FileVersion:  N/A            MD5: [bfddbaa227db76c6c289f94bb9ea7d07]
S-1-5-18-1-ntuser.dat.LOG2              	File Size: 8192      BYTES	FileVersion:  N/A            MD5: [8a293a2f1884cc0fb6834778ba015784]
S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [9a802aa7c09a84796a35e00685b38f00]
S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [040282b950b3ab2e6b81a7e0cb4d2c4c]
S-1-5-18-1-ntuser.dat{5ddb0fae-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-2-ntuser.dat                   	File Size: 700416    BYTES	FileVersion:  N/A            MD5: [b8fd93873e3865df577bd1bb8672a810]
S-1-5-18-2-ntuser.dat.LOG1              	File Size: 200704    BYTES	FileVersion:  N/A            MD5: [8f12924d39789720d6f58f11c9cfd6d1]
S-1-5-18-2-ntuser.dat.LOG2              	File Size: 8192      BYTES	FileVersion:  N/A            MD5: [c61160b6331c15a6c1f2f0bd8c616f5e]
S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [5fb0fbf8cf89a143fe48c5d4eb2646f8]
S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [4ff1b9e4316eb27a844c1c57a79e3ad1]
S-1-5-18-2-ntuser.dat{5ddb130e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-3-ntuser.dat                   	File Size: 712704    BYTES	FileVersion:  N/A            MD5: [3464492656b64b88ca6d84746c06cc97]
S-1-5-18-3-ntuser.dat.LOG1              	File Size: 86016     BYTES	FileVersion:  N/A            MD5: [b25cbd6f5f1ea5ff24db1e6a405fe0c7]
S-1-5-18-3-ntuser.dat.LOG2              	File Size: 110592    BYTES	FileVersion:  N/A            MD5: [3d0d55eb386a7e92f27c85f6bf8e509b]
S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [35f9d299a6569d9699d7d5c42fdae8b6]
S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [f367c43fcfbe4027108300860c3d6402]
S-1-5-18-3-ntuser.dat{5ddb1bec-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-18-4-ntuser.dat                   	File Size: 712704    BYTES	FileVersion:  N/A            MD5: [693505122959e46a3ef6ca7a37ac5a29]
S-1-5-18-4-ntuser.dat.LOG1              	File Size: 192512    BYTES	FileVersion:  N/A            MD5: [829765f1af24b9188e1af6e90f3c9ace]
S-1-5-18-4-ntuser.dat.LOG2              	File Size: 0         BYTES	FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [55045203021b326be7a3b540bd176612]
S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [0dcb7cacac4379ecf42e1e11a7e4cc69]
S-1-5-18-4-ntuser.dat{5ddb1f86-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-0-ntuser.dat                   	File Size: 212992    BYTES	FileVersion:  N/A            MD5: [d6fba4138ff9fdeb197162b8c53fce80]
S-1-5-19-0-ntuser.dat.LOG1              	File Size: 40960     BYTES	FileVersion:  N/A            MD5: [693879c7f81b823b5fd4478b653acabd]
S-1-5-19-0-ntuser.dat.LOG2              	File Size: 147456    BYTES	FileVersion:  N/A            MD5: [ea691b7e114538b59fea5404eacc52cb]
S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [c74d8888757cdec6746e33125b523700]
S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [de89f5907934d3d64235d70cb728df3c]
S-1-5-19-0-ntuser.dat{5ddb03c1-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-1-ntuser.dat                   	File Size: 212992    BYTES	FileVersion:  N/A            MD5: [0c954c292b80656ed027ee52dece738e]
S-1-5-19-1-ntuser.dat.LOG1              	File Size: 176128    BYTES	FileVersion:  N/A            MD5: [f173fb29966b9783a7bf1ea64a16851d]
S-1-5-19-1-ntuser.dat.LOG2              	File Size: 8192      BYTES	FileVersion:  N/A            MD5: [4eeb87f219a266db2e0c7f4b566d25bf]
S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [917673819023ee076376302bb87b598b]
S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [36f848c02d37e91c64e2148fe60184d4]
S-1-5-19-1-ntuser.dat{5ddb0fb4-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-2-ntuser.dat                   	File Size: 212992    BYTES	FileVersion:  N/A            MD5: [a70fbd74ae178cc6a57ca8a066936591]
S-1-5-19-2-ntuser.dat.LOG1              	File Size: 176128    BYTES	FileVersion:  N/A            MD5: [0f1b17a3d340653987ba6eb3ca299d82]
S-1-5-19-2-ntuser.dat.LOG2              	File Size: 8192      BYTES	FileVersion:  N/A            MD5: [b3020c2527bc3bbc3cf89905cd43cf99]
S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [f5c72a7130b0f558a5f93c0d1d81c5c4]
S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [3eb7a869dcc93cd5425e5b40de8edc02]
S-1-5-19-2-ntuser.dat{5ddb131c-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-3-ntuser.dat                   	File Size: 212992    BYTES	FileVersion:  N/A            MD5: [4ecce3622ebd5abf3a0a469ed2938a89]
S-1-5-19-3-ntuser.dat.LOG1              	File Size: 61440     BYTES	FileVersion:  N/A            MD5: [d73a49af316e4d6914f379d83628d743]
S-1-5-19-3-ntuser.dat.LOG2              	File Size: 118784    BYTES	FileVersion:  N/A            MD5: [0929a50906ea17f3711c8d3a5dcd8afa]
S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [b499b912185317472c4337bbd38e33f7]
S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [cdaffa84768ab0dce3518da0daa914d0]
S-1-5-19-3-ntuser.dat{5ddb1bf2-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-19-4-ntuser.dat                   	File Size: 212992    BYTES	FileVersion:  N/A            MD5: [4d8615cf98078169ee9ac868735e3d70]
S-1-5-19-4-ntuser.dat.LOG1              	File Size: 180224    BYTES	FileVersion:  N/A            MD5: [9c986f305ad1a3aeb93bae21bfebc093]
S-1-5-19-4-ntuser.dat.LOG2              	File Size: 0         BYTES	FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [c1742f9a374dd21e977e2fadd46e0857]
S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [a3736b15fe4ab7eaaee4e4d17bb7bdf3]
S-1-5-19-4-ntuser.dat{5ddb1f8e-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-0-ntuser.dat                   	File Size: 155648    BYTES	FileVersion:  N/A            MD5: [37b515e2b33f7c426df7d60886a3e1bb]
S-1-5-20-0-ntuser.dat.LOG1              	File Size: 36864     BYTES	FileVersion:  N/A            MD5: [8262eeb34e5574000c517f69873f5f18]
S-1-5-20-0-ntuser.dat.LOG2              	File Size: 135168    BYTES	FileVersion:  N/A            MD5: [41f208fae388ad47d0d906c6bff8f8a9]
S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [df2b10fb871b43805ef865decfb65a3a]
S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [388767cd11750a20bacb7f286034b0ec]
S-1-5-20-0-ntuser.dat{5ddb03c7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-1-ntuser.dat                   	File Size: 155648    BYTES	FileVersion:  N/A            MD5: [cee596e968eb3635b0e6cb4feecb2cc1]
S-1-5-20-1-ntuser.dat.LOG1              	File Size: 159744    BYTES	FileVersion:  N/A            MD5: [e35f52c3f51f72cae4a5ae2b5f1645a3]
S-1-5-20-1-ntuser.dat.LOG2              	File Size: 8192      BYTES	FileVersion:  N/A            MD5: [754d89ad01a0816c775f39e67e307170]
S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [fe6c9c8982df9dabffc4a651d49675b2]
S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [809a0090dc7a077d4e9fa9cfbf6587b6]
S-1-5-20-1-ntuser.dat{5ddb0fba-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-2-ntuser.dat                   	File Size: 155648    BYTES	FileVersion:  N/A            MD5: [f6609b88ab6fb82c595a81d1c7eb5abf]
S-1-5-20-2-ntuser.dat.LOG1              	File Size: 159744    BYTES	FileVersion:  N/A            MD5: [0b9ebfeb9018492f871e90e47ca9708d]
S-1-5-20-2-ntuser.dat.LOG2              	File Size: 8192      BYTES	FileVersion:  N/A            MD5: [2b96e77dad94e2fd05267b4e59227dfe]
S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [069295c78b53051b7b2fbafc6e009a8c]
S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [9251a87c755dd08f9cf34f1fc41321b9]
S-1-5-20-2-ntuser.dat{5ddb1339-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-3-ntuser.dat                   	File Size: 155648    BYTES	FileVersion:  N/A            MD5: [82dae0b7f5134b0e34247ed64bc45748]
S-1-5-20-3-ntuser.dat.LOG1              	File Size: 53248     BYTES	FileVersion:  N/A            MD5: [11cac051b53cbdf73363e10415186eaf]
S-1-5-20-3-ntuser.dat.LOG2              	File Size: 106496    BYTES	FileVersion:  N/A            MD5: [f3928cb9d5c607cf95f342ce48b0b34e]
S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [0bc13804a4a0264c9e957bac31de33b7]
S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [5246dd537049fee8b997a33fd54c1147]
S-1-5-20-3-ntuser.dat{5ddb1bf8-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-20-4-ntuser.dat                   	File Size: 155648    BYTES	FileVersion:  N/A            MD5: [f791ad2fbf9ed206ad764fece74901ff]
S-1-5-20-4-ntuser.dat.LOG1              	File Size: 159744    BYTES	FileVersion:  N/A            MD5: [7abcd573c17b1958c4703b29189ada25]
S-1-5-20-4-ntuser.dat.LOG2              	File Size: 0         BYTES	FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [afb6a248b897db712fd870dd974f8002]
S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [c15f2fb49eaa094288ceeebc09a2d093]
S-1-5-20-4-ntuser.dat{5ddb1f99-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat	File Size: 1470464   BYTES	FileVersion:  N/A            MD5: [cac242444602a56a61d3fd2493f16dac]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat.LOG1	File Size: 94208     BYTES	FileVersion:  N/A            MD5: [044580c8b2c5bbc144158df6f75fa70d]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat.LOG2	File Size: 569344    BYTES	FileVersion:  N/A            MD5: [7281d5c1eebc1fac15e593850dce4589]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [98d931e4d1f33fda69f6bd8e23925b7f]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [e9897af43c5b038e280125234e83e662]
S-1-5-21-3542363699-1958347893-1633341002-1001-0-ntuser.dat{5ddb03cd-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat	File Size: 1474560   BYTES	FileVersion:  N/A            MD5: [8024b722285aaf3fa0094aff5c59e718]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat.LOG1	File Size: 634880    BYTES	FileVersion:  N/A            MD5: [12991ffddde2d8c861a2ef93f69aa72f]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat.LOG2	File Size: 16384     BYTES	FileVersion:  N/A            MD5: [26b6a0842eecb4f9d72dfe251cf7f615]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [fba12a1a28f34d43f13de017033d08f2]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [e814135258c24add4119aabb1db0bafe]
S-1-5-21-3542363699-1958347893-1633341002-1001-1-ntuser.dat{5ddb0fc0-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat	File Size: 1478656   BYTES	FileVersion:  N/A            MD5: [5184759010cc9a5299c4e5b881864b37]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat.LOG1	File Size: 618496    BYTES	FileVersion:  N/A            MD5: [eb1ea80e80ac81799adb3619c17ab3d1]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat.LOG2	File Size: 8192      BYTES	FileVersion:  N/A            MD5: [78c4fa70f03a23518e2e91d0466587ef]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [4bdb135aa24c26b13ea4f6052799e1b4]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [3797bbde08845bcedbda757e7fd1af16]
S-1-5-21-3542363699-1958347893-1633341002-1001-2-ntuser.dat{5ddb134f-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat	File Size: 1482752   BYTES	FileVersion:  N/A            MD5: [4b4bc2246e2c5cc1009e36df5cd08b81]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat.LOG1	File Size: 225280    BYTES	FileVersion:  N/A            MD5: [26a024ac1268ac8ae931e46b27dcbf35]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat.LOG2	File Size: 417792    BYTES	FileVersion:  N/A            MD5: [5e5ac93b13a971dbc5377ca342cbe759]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [84800fdf96a01e2b6ad91a33b1ac1035]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [bde9d199371386ae7b8acc400d24ddc4]
S-1-5-21-3542363699-1958347893-1633341002-1001-3-ntuser.dat{5ddb1c0b-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat	File Size: 1486848   BYTES	FileVersion:  N/A            MD5: [4c14a1d143f6ee22c782a4b34be9fc0b]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat.LOG1	File Size: 671744    BYTES	FileVersion:  N/A            MD5: [fd2f134b1f086613378020e943a1ec14]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat.LOG2	File Size: 0         BYTES	FileVersion:  N/A            MD5: [d41d8cd98f00b204e9800998ecf8427e]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TM.blf	File Size: 65536     BYTES	FileVersion:  N/A            MD5: [f1d06ffa7126d9c6a7104459a19f437b]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000001.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [7b4a055edccc0410a78566b71cd345b4]
S-1-5-21-3542363699-1958347893-1633341002-1001-4-ntuser.dat{5ddb1fa7-0869-11e4-beb5-7c050738016e}.TMContainer00000000000000000002.regtrans-ms	File Size: 524288    BYTES	FileVersion:  N/A            MD5: [59071590099d21dd439896592338bf95]
swissarmy.ref                           	File Size: 21903     BYTES	FileVersion:  N/A            MD5: [68cc3f4cebf0705040feee779c643c8e]

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Configuration
build.conf                              	File Size: 194       BYTES	FileVersion:  N/A            MD5: [01dd2fbf24bfb8fc2536095eb00acb5b]
database.conf                           	File Size: 4         BYTES	FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
gatekeeper.conf                         	File Size: 4         BYTES	FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
license.conf                            	File Size: 573       BYTES	FileVersion:  N/A            MD5: [6533c5568b403e8733a23fa8e231d210]
manifest.conf                           	File Size: 2133      BYTES	FileVersion:  N/A            MD5: [5ec7491212d5b62725246dcbc0fca59e]
marketing.conf                          	File Size: 1434      BYTES	FileVersion:  N/A            MD5: [19533c40d9c9778b2ab423dbcf063d80]
net.conf                                	File Size: 333       BYTES	FileVersion:  N/A            MD5: [b576a0e7c7c483ebed18a884d7c8945e]
notifications.conf                      	File Size: 4         BYTES	FileVersion:  N/A            MD5: [2261e7eca4cd0615a97263c0ad5045c2]
scheduler.conf                          	File Size: 3560      BYTES	FileVersion:  N/A            MD5: [db3ba362555a1f6544572e7abe4105c5]
settings.conf                           	File Size: 1975      BYTES	FileVersion:  N/A            MD5: [dff1ce75f5c62dddfefc2af5eeefcea1]
statistics.conf                         	File Size: 597       BYTES	FileVersion:  N/A            MD5: [fa51cb4303462862730bfec3e07d250b]

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Logs
mbam-log-2014-07-02 (05-37-23).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [f0860c31a50545886f522dc0065e6b36]
mbam-log-2014-07-04 (10-08-48).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [b01af37b8d8b2ff93409c28809c77bae]
mbam-log-2014-07-06 (17-20-06).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [198bc1155af42a83248762304264e550]
mbam-log-2014-07-08 (18-15-12).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [cf59bc88413237e63aefcd0d57d26c99]
mbam-log-2014-07-10 (14-55-11).xml      	File Size: 2482      BYTES	FileVersion:  N/A            MD5: [ce08bcd85e4f45f52fc824f221914d2e]
mbam-log-2014-07-11 (14-45-56).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [03f03869fdb7036e103a3581abf117c9]
mbam-log-2014-07-14 (11-11-06).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [7b61e8032c7139f315c13d80958a6737]
mbam-log-2014-07-15 (11-59-08).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [190fbf0e33fbeaf94b9128c088c65269]
mbam-log-2014-07-16 (11-07-15).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [c4f23f5a929fa9c1310ffea6d471b301]
mbam-log-2014-07-17 (18-49-53).xml      	File Size: 2480      BYTES	FileVersion:  N/A            MD5: [a7cf455ddeec6445faf7ead514141aa4]
mbam-log-2015-03-03 (14-19-26).xml      	File Size: 2474      BYTES	FileVersion:  N/A            MD5: [7c08691c88836b275fa976ea45051a41]
mbam-log-2015-03-03 (15-13-56).xml      	File Size: 2474      BYTES	FileVersion:  N/A            MD5: [57bb5756a737d08a59a0c1ef4965c425]
protection-log-2014-06-25.xml           	File Size: 4755      BYTES	FileVersion:  N/A            MD5: [6a6ba3f9191502e108e7083c716d576f]
protection-log-2014-06-27.xml           	File Size: 2112      BYTES	FileVersion:  N/A            MD5: [67f885f5ec15ab5fef8ec1d38fd5050e]
protection-log-2014-06-28.xml           	File Size: 3281      BYTES	FileVersion:  N/A            MD5: [d11b95d9b66f1fe99010514ca6a276ce]
protection-log-2014-07-02.xml           	File Size: 9862      BYTES	FileVersion:  N/A            MD5: [16ba74d628a6f900dea0f9c4c91002a6]
protection-log-2014-07-03.xml           	File Size: 8223      BYTES	FileVersion:  N/A            MD5: [1b2a7e95598399d50673bfac6fb143a6]
protection-log-2014-07-04.xml           	File Size: 21529     BYTES	FileVersion:  N/A            MD5: [1066272ee8b08219bf01430a2be5aa7d]
protection-log-2014-07-05.xml           	File Size: 2110      BYTES	FileVersion:  N/A            MD5: [565177150da82da687ced8f491e704c9]
protection-log-2014-07-06.xml           	File Size: 2109      BYTES	FileVersion:  N/A            MD5: [48c5db4acb7f1f6595e0fcae30154bd8]
protection-log-2014-07-07.xml           	File Size: 14415     BYTES	FileVersion:  N/A            MD5: [c352467d2ee0e1fd713135edd2d07047]
protection-log-2014-07-08.xml           	File Size: 14838     BYTES	FileVersion:  N/A            MD5: [4960bc0f3a0f7e0bd1b7f33b1859778b]
protection-log-2014-07-09.xml           	File Size: 10452     BYTES	FileVersion:  N/A            MD5: [f376d745fb29107a63b1d3a63c3f79e4]
protection-log-2014-07-10.xml           	File Size: 3588      BYTES	FileVersion:  N/A            MD5: [bfa6d1a28f268b72dd6d7dc8744bbe6c]
protection-log-2014-07-11.xml           	File Size: 6217      BYTES	FileVersion:  N/A            MD5: [1adba58d5d46661ee5babe519cfee22c]
protection-log-2014-07-13.xml           	File Size: 8270      BYTES	FileVersion:  N/A            MD5: [f2a1713de43ebf36c24044621cad8dcd]
protection-log-2014-07-14.xml           	File Size: 10323     BYTES	FileVersion:  N/A            MD5: [f8807c44cbabd77440a8d60355860e96]
protection-log-2014-07-15.xml           	File Size: 4474      BYTES	FileVersion:  N/A            MD5: [1f43a87b631162a3d382588781b4dd3b]
protection-log-2014-07-16.xml           	File Size: 10326     BYTES	FileVersion:  N/A            MD5: [37ecfe715087e046d6be81a1a645cf07]
protection-log-2014-07-17.xml           	File Size: 2111      BYTES	FileVersion:  N/A            MD5: [4c4cbd7cddc112cc2eb52924fe7b6b88]
protection-log-2014-07-18.xml           	File Size: 2112      BYTES	FileVersion:  N/A            MD5: [47e69f65115acc7b31dd13487f6ec74a]

C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \Quarantine

Malware Exclusions:
===================
Web Exclusions:
================
Quarantined Items:
===================
Unable to access quarantine information: Error code 20002===============================================================
END OF FILE
         
Gruß
bD
__________________

Alt 12.03.2015, 09:21   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Revo Uninstaller - Download - Filepony
damit deinstallieren, Reste entfernen lassen.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 12.03.2015, 12:49   #5
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Revo haben wir installiert. Das hat aber nichts von Tencent gefunden, weder QQChat noch was anderes. Daher ging das angeforderte "damit deinstallieren, Reste entfernen lassen." so nicht.

Anbei zwei Bilder, was Renove findet, eben nichts von Tencent, dass kam nur bei AMWB hoch.

Wie jetzt weiter vorgehen ? Mit ADW und JRT ? Oder doch noch was mit Revo ?

Danke
bD

Angehängte Grafiken
Dateityp: jpg UK_Revo1.jpg (133,0 KB, 250x aufgerufen)
Dateityp: jpg UK_Revo2.jpg (53,5 KB, 159x aufgerufen)

Alt 12.03.2015, 21:10   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Ja, einfach weiter im Text mit Adw und Co
__________________
--> Tencent nicht deinstallierbar + AMWB Server nicht erreichbar

Alt 12.03.2015, 23:44   #7
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Hi, anbei die Dateien.

Ich muss vorausschicken, dass ich morgen am Freitag wegen eines Kundenbesuchs erst spät abends wieder online bin, werde mich aber spät abends und vor allem am Wochenende weiter drum kümmern.


ADW :
AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v4.112 - Bericht erstellt 12/03/2015 um 21:57:25
# Aktualisiert 09/03/2015 von Xplode
# Datenbank : 2015-03-05.1 [Server]
# Betriebssystem : Windows 8.1  (x64)
# Benutzername : Standard - TOSHIBA1LQ
# Gestarted von : C:\Users\Standard\Desktop\adwcleaner_4.112.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v36.0.1 (x86 de)


*************************

AdwCleaner[R0].txt - [1673 Bytes] - [05/11/2014 14:04:09]
AdwCleaner[R1].txt - [1240 Bytes] - [10/01/2015 12:33:40]
AdwCleaner[R2].txt - [1305 Bytes] - [03/03/2015 14:02:05]
AdwCleaner[R3].txt - [1007 Bytes] - [03/03/2015 14:58:35]
AdwCleaner[R4].txt - [1128 Bytes] - [12/03/2015 21:55:43]
AdwCleaner[S0].txt - [1366 Bytes] - [03/03/2015 14:07:17]
AdwCleaner[S1].txt - [1068 Bytes] - [03/03/2015 15:00:42]
AdwCleaner[S2].txt - [1051 Bytes] - [12/03/2015 21:57:25]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1110  Bytes] ##########
         
--- --- ---

[/CODE]

JRT

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 8.1 x64
Ran by Standard on 12.03.2015 at 22:14:07,93
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.03.2015 at 22:18:15,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
und FRST

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Standard (administrator) on TOSHIBA1LQ on 12-03-2015 22:21:11
Running from C:\Users\Standard\Desktop
Loaded Profiles: Standard & Gast1 (Available profiles: Standard & Gast1)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3542363699-1958347893-1633341002-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3542363699-1958347893-1633341002-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-03-03] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-03-03] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default
FF Homepage: google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] ()
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll [2014-12-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-03-03] (Oracle Corporation)
FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [2013-04-25] (Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [2013-04-08] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-05-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-03-10]
FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\CNTVLive2@www.cntv.cn [2014-07-08]
FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-01]
FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-16]
FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [992560 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 ASPI32; No ImagePath
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation                           )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-12 22:20 - 2015-03-12 22:20 - 00000000 ____D () C:\Users\Standard\Desktop\FRST-OlderVersion
2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT1.txt
2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT.txt
2015-03-12 22:10 - 2015-03-12 22:10 - 00000994 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-03-12 22:00 - 2015-03-12 22:00 - 00001190 _____ () C:\Users\Standard\Desktop\AdwCleaner[S2].txt
2015-03-12 11:41 - 2015-03-12 11:41 - 02171392 _____ () C:\Users\Standard\Desktop\adwcleaner_4.112.exe
2015-03-12 11:27 - 2015-03-12 11:27 - 00001295 _____ () C:\Users\Standard\Desktop\Revo Uninstaller.lnk
2015-03-12 11:27 - 2015-03-12 11:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-12 11:26 - 2015-03-12 11:26 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Standard\Desktop\revosetup95.exe
2015-03-10 23:16 - 2015-02-06 23:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-03-10 23:16 - 2015-02-03 23:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2015-03-10 23:16 - 2015-02-03 23:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2015-03-10 23:16 - 2015-02-03 23:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2015-03-10 23:16 - 2015-02-02 23:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
2015-03-10 23:16 - 2015-02-02 23:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
2015-03-10 23:16 - 2015-01-27 03:44 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
2015-03-10 23:16 - 2015-01-24 01:51 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe
2015-03-10 23:16 - 2015-01-23 07:17 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2015-03-10 23:16 - 2015-01-23 05:02 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2015-03-10 23:15 - 2015-02-05 20:24 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-03-10 23:15 - 2015-01-30 23:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-03-10 23:15 - 2015-01-30 23:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-03-10 23:15 - 2015-01-29 01:58 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll
2015-03-10 23:15 - 2015-01-29 01:29 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll
2015-03-10 23:14 - 2015-02-07 23:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2015-03-10 23:14 - 2015-02-07 23:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2015-03-10 23:14 - 2015-02-06 01:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-03-10 23:14 - 2015-02-06 01:08 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-03-10 23:14 - 2015-02-03 00:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2015-03-10 23:14 - 2015-02-03 00:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2015-03-10 23:14 - 2015-01-30 03:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
2015-03-10 23:14 - 2015-01-30 02:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll
2015-03-10 23:14 - 2015-01-30 02:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll
2015-03-10 23:14 - 2015-01-30 02:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll
2015-03-10 23:14 - 2015-01-30 01:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll
2015-03-10 23:14 - 2015-01-30 01:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll
2015-03-10 23:14 - 2015-01-30 01:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll
2015-03-10 23:14 - 2015-01-30 01:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll
2015-03-10 23:14 - 2015-01-30 01:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll
2015-03-10 23:14 - 2015-01-30 01:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll
2015-03-10 23:14 - 2015-01-30 01:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll
2015-03-10 23:14 - 2015-01-30 01:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll
2015-03-10 23:14 - 2015-01-30 01:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll
2015-03-10 23:14 - 2015-01-30 01:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll
2015-03-10 23:14 - 2015-01-29 01:11 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 23:14 - 2015-01-29 01:04 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-03-10 23:14 - 2015-01-29 01:04 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2015-03-10 23:14 - 2015-01-29 01:00 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 23:14 - 2015-01-29 00:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-03-10 23:14 - 2015-01-29 00:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2015-03-10 23:14 - 2015-01-29 00:50 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2015-03-10 23:14 - 2015-01-29 00:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-03-10 23:14 - 2015-01-28 02:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll
2015-03-10 23:14 - 2015-01-28 01:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll
2015-03-10 23:14 - 2015-01-27 23:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2015-03-10 23:14 - 2015-01-27 23:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2015-03-10 23:14 - 2014-12-11 05:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe
2015-03-10 23:14 - 2014-10-29 02:43 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe
2015-03-10 23:14 - 2014-10-29 02:34 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2015-03-10 23:14 - 2014-10-29 02:34 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
2015-03-10 23:14 - 2014-10-29 02:34 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2015-03-10 23:14 - 2014-10-29 02:04 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll
2015-03-10 23:14 - 2014-10-29 01:58 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe
2015-03-10 23:14 - 2014-10-29 01:52 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll
2015-03-10 23:14 - 2014-10-29 01:51 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-03-10 23:14 - 2014-10-29 01:45 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2015-03-10 23:14 - 2014-10-29 01:28 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll
2015-03-10 23:14 - 2014-10-29 01:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll
2015-03-10 23:14 - 2014-10-29 01:20 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-03-10 23:14 - 2014-10-29 01:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll
2015-03-10 23:14 - 2014-10-29 01:15 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2015-03-10 23:14 - 2014-10-29 01:13 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-03-10 23:14 - 2014-10-29 00:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll
2015-03-10 23:14 - 2014-10-29 00:55 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-03-10 23:14 - 2014-10-29 00:55 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2015-03-10 23:14 - 2014-10-29 00:44 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2015-03-10 23:14 - 2014-10-29 00:41 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2015-03-10 23:14 - 2014-10-29 00:35 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2015-03-10 20:17 - 2015-03-06 02:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-03-10 20:17 - 2015-03-06 02:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-03-10 20:17 - 2015-02-25 23:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-03-10 20:17 - 2015-02-20 03:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-03-10 20:17 - 2015-02-20 02:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-03-10 20:17 - 2015-02-20 02:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-03-10 20:17 - 2015-02-20 02:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-03-10 20:17 - 2015-01-28 15:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-03-10 20:17 - 2015-01-28 15:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-03-10 20:17 - 2015-01-28 15:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-03-10 20:17 - 2014-10-29 02:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2015-03-10 20:17 - 2014-10-29 02:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2015-03-10 20:17 - 2014-10-29 02:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2015-03-10 20:17 - 2014-10-29 02:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2015-03-10 20:17 - 2014-10-29 02:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2015-03-10 20:17 - 2014-10-29 02:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2015-03-10 20:16 - 2015-01-30 23:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2015-03-10 20:16 - 2015-01-27 04:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2015-03-10 20:16 - 2015-01-27 02:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2015-03-10 20:16 - 2014-10-29 03:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys
2015-03-10 20:16 - 2014-10-29 02:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll
2015-03-10 20:14 - 2015-02-21 01:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-03-10 20:14 - 2015-02-21 00:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-03-10 20:14 - 2015-02-21 00:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-03-10 20:14 - 2015-02-21 00:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-03-10 20:14 - 2015-02-21 00:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-03-10 20:14 - 2015-02-20 23:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-03-10 20:14 - 2015-02-20 23:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-03-10 20:14 - 2015-02-20 02:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-03-10 20:14 - 2015-02-20 02:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-03-10 20:14 - 2015-02-20 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-03-10 20:14 - 2015-02-20 02:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-03-10 20:14 - 2015-02-20 02:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2015-03-10 20:14 - 2015-02-20 02:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-03-10 20:14 - 2015-02-20 02:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-03-10 20:14 - 2015-02-20 02:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-03-10 20:14 - 2015-02-20 02:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-03-10 20:14 - 2015-02-20 02:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-03-10 20:14 - 2015-02-20 02:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-03-10 20:14 - 2015-02-20 01:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-03-10 20:14 - 2015-02-20 01:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-03-10 20:14 - 2015-02-20 01:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-03-10 20:14 - 2015-02-20 01:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-03-10 20:14 - 2015-02-20 01:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-03-10 20:14 - 2015-02-20 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-03-10 20:14 - 2015-02-20 01:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-03-10 20:14 - 2015-02-20 01:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-03-10 20:14 - 2015-02-20 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-03-10 20:14 - 2015-02-20 01:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-03-10 20:14 - 2015-02-20 01:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-03-10 20:14 - 2015-02-20 01:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-03-10 20:14 - 2015-02-20 01:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-03-10 20:14 - 2015-02-20 01:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-03-10 20:14 - 2015-02-20 01:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-03-10 20:14 - 2015-02-20 01:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-03-10 20:14 - 2015-02-20 01:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-03-10 20:14 - 2015-02-20 00:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-03-10 20:14 - 2015-02-20 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-03-10 20:13 - 2015-01-29 18:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-03-10 20:13 - 2015-01-29 18:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-03-10 20:12 - 2015-02-12 17:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-03-10 20:12 - 2015-02-12 17:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-03-10 20:11 - 2015-01-28 01:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2015-03-10 20:11 - 2015-01-28 01:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2015-03-10 20:11 - 2015-01-21 05:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-03-10 20:11 - 2015-01-21 05:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-03-07 23:05 - 2015-03-07 23:05 - 00000000 ____D () C:\Users\Standard\Desktop\attachments
2015-03-07 23:03 - 2015-03-07 23:04 - 10040114 _____ () C:\Users\Standard\Desktop\attachments.zip
2015-03-06 20:22 - 2015-03-06 20:22 - 00001422 _____ () C:\Users\Standard\Desktop\NN CV English.txt
2015-03-05 20:03 - 2015-03-06 01:20 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-05 20:03 - 2015-03-05 20:03 - 01682416 _____ (Malwarebytes Corporation) C:\Users\Standard\Desktop\mbam-check-2.1.1.1001.exe
2015-03-05 20:03 - 2015-03-05 20:03 - 00068241 _____ () C:\Users\Standard\Desktop\CheckResults.txt
2015-03-05 19:47 - 2015-03-05 19:48 - 00020460 _____ () C:\Users\Standard\Desktop\Addition.txt
2015-03-05 19:46 - 2015-03-12 22:21 - 00014752 _____ () C:\Users\Standard\Desktop\FRST.txt
2015-03-05 19:45 - 2015-03-12 22:21 - 00000000 ____D () C:\FRST
2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe
2015-03-05 19:37 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 19:36 - 2015-03-12 22:20 - 02095616 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe
2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk
2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Desktop\JRT.exe
2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll
2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll
2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp
2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump
2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls
2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2015-02-11 22:20 - 2015-02-03 23:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-02-11 22:20 - 2015-02-03 23:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-02-11 22:20 - 2015-02-03 23:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-02-11 22:20 - 2015-02-02 23:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-02-11 22:20 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-02-11 22:20 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2015-02-11 22:20 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2015-02-11 22:01 - 2015-02-11 22:01 - 00007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg
2015-02-11 20:14 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-02-11 20:14 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-02-11 20:14 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-02-11 20:14 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-02-11 20:14 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll
2015-02-11 20:14 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll
2015-02-11 20:14 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll
2015-02-11 20:14 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2015-02-11 20:14 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2015-02-11 20:14 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll
2015-02-11 20:14 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-02-11 20:14 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-02-11 20:14 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-02-11 20:14 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-02-11 20:14 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-02-11 20:14 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll
2015-02-11 20:14 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe
2015-02-11 20:14 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe
2015-02-11 20:14 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe
2015-02-11 20:13 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-02-11 20:13 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-02-11 20:13 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-02-11 20:13 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-12 22:11 - 2013-10-29 14:53 - 01974330 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-12 22:10 - 2014-07-21 19:04 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-03-12 22:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-12 22:04 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-12 22:04 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-03-12 22:04 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-03-12 22:02 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-03-12 21:59 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive
2015-03-12 21:59 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP
2015-03-12 21:58 - 2013-08-22 14:46 - 00316715 _____ () C:\WINDOWS\setupact.log
2015-03-12 21:58 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-03-12 21:57 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner
2015-03-12 21:57 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-03-12 21:42 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6}
2015-03-12 16:05 - 2013-08-17 16:59 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893-1633341002-1001
2015-03-12 11:25 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-03-12 00:59 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-03-11 21:58 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\WinStore
2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-03-11 00:34 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-03-11 00:31 - 2013-08-19 01:13 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-03-10 11:32 - 2013-08-19 20:27 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-03-10 11:32 - 2013-08-19 20:27 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-03-10 11:32 - 2013-08-19 20:27 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2015-03-06 20:06 - 2013-09-29 19:04 - 00032604 _____ () C:\WINDOWS\PFRO.log
2015-03-06 20:06 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-05 21:31 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-03-05 20:00 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast1
2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data
2015-03-04 21:24 - 2014-12-12 11:05 - 00792032 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-03-04 21:24 - 2014-12-12 11:05 - 00178144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard
2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel

==================== Files in the root of some directories =======

2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg

Some content of TEMP:
====================
C:\Users\Standard\AppData\Local\Temp\avgnt.exe
C:\Users\Standard\AppData\Local\Temp\Quarantine.exe
C:\Users\Standard\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-11 23:30

==================== End Of Log ============================
         
--- --- ---


und falls notwendig noch ADDITIONS :

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Standard at 2015-03-12 22:22:16
Running from C:\Users\Standard\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.39052 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)
Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1405.1 - Microsoft Corporation) Hidden
Update for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

19-02-2015 22:58:54 Geplanter Prüfpunkt
24-02-2015 23:09:15 Windows Update
04-03-2015 00:04:32 Geplanter Prüfpunkt
11-03-2015 00:22:30 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {91748338-A418-4ABA-8A56-C469B59B0290} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-11] (Microsoft Corporation)
Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll
2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:88050731
AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper -> 
HKU\S-1-5-21-3542363699-1958347893-1633341002-1002\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"

==================== Accounts: =============================

Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)
Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)
Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1
Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHz
Percentage of memory in use: 18%
Total physical RAM: 8073.22 MB
Available physical RAM: 6547.39 MB
Total Pagefile: 16265.22 MB
Available Pagefile: 14682.09 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:593.43 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         
Bei den FF-Plugins taucht das "QQ" und "Tencent-Zeug" auf.

Danke und bis morgen abend
bD

Alt 13.03.2015, 12:37   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [2013-04-25] (Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [2013-04-08] (Tencent Technology (Shenzhen) Company Limited)
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 14.03.2015, 19:43   #9
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Hi,
so haben alles laufen lassen.

FIXLOG.txt
Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Standard at 2015-03-14 10:08:27 Run:1
Running from C:\Users\Standard\Desktop
Loaded Profiles: Standard (Available profiles: Standard & Gast1)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No File
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No File
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No File
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [2013-04-25] (Tencent)
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [2013-04-08] (Tencent Technology (Shenzhen) Company Limited)
Emptytemp:
         
*****************

"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/npqscall" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QQPhotoDrawEx" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QzoneMusic" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@tencent.com/npQQMailWebKit,version=1.0.0.1" => Key deleted successfully.
C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll => Moved successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@tencent.com/nptxftnWebKit,version=1.0.0.1" => Key deleted successfully.
C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll => Moved successfully.
EmptyTemp: => Removed 1.3 GB temporary data.


The system needed a reboot. 

==== End of Fixlog 10:10:19 ====
         

ESET log:
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=659babde60926f42b46280e5db20f69d
# engine=22905
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-14 02:12:37
# local_time=2015-03-14 02:12:37 (+0000, Westeuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 304657 51223650 0 0
# scanned=226062
# found=0
# cleaned=0
# scan_time=5626
         

CHECKUP.txt
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.97  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop      
Windows Defender   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Secunia PSI (3.0.0.9016)   
 Java 8 Update 31  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Flash Player 	16.0.0.305  
 Adobe Reader XI  
 Mozilla Firefox (36.0.1) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         
und FRST

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Standard (administrator) on TOSHIBA1LQ on 14-03-2015 18:16:49
Running from C:\Users\Standard\Desktop
Loaded Profiles: Standard (Available profiles: Standard & Gast1)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-03-03] 

(Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-03-03] 

(Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default
FF Homepage: google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] ()
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-01-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT

\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT

\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll [2014-12-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-03-03] (Oracle Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered

\0\NP_wtapp.dll [2012-05-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-03-10]
FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions

\CNTVLive2@www.cntv.cn [2014-07-08]
FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} 

[2014-01-01]
FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65-

2a3cc1668adc} [2014-02-16]
FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-

2b9879e08c5d}.xpi [2013-10-09]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [992560 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel 

Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 ASPI32; No ImagePath
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-10] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation                           )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-14 18:14 - 2015-03-14 18:14 - 00000925 _____ () C:\Users\Standard\Desktop\checkup.txt
2015-03-14 10:29 - 2015-03-14 10:29 - 00852604 _____ () C:\Users\Standard\Desktop\SecurityCheck.exe
2015-03-14 10:25 - 2015-03-14 10:26 - 00001374 _____ () C:\Users\Standard\Desktop\anleitung.txt
2015-03-14 10:21 - 2015-03-14 10:21 - 02347384 _____ (ESET) C:\Users\Standard\Desktop\esetsmartinstaller_deu.exe
2015-03-12 22:23 - 2015-03-12 22:23 - 00043625 _____ () C:\Users\Standard\Desktop\FRST2.txt
2015-03-12 22:22 - 2015-03-12 22:22 - 00014104 _____ () C:\Users\Standard\Desktop\Addition2.txt
2015-03-12 22:20 - 2015-03-12 22:20 - 00000000 ____D () C:\Users\Standard\Desktop\FRST-OlderVersion
2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT1.txt
2015-03-12 22:18 - 2015-03-12 22:18 - 00000617 _____ () C:\Users\Standard\Desktop\JRT.txt
2015-03-12 22:10 - 2015-03-12 22:10 - 00000994 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-03-12 22:00 - 2015-03-12 22:00 - 00001190 _____ () C:\Users\Standard\Desktop\AdwCleaner[S2].txt
2015-03-12 11:41 - 2015-03-12 11:41 - 02171392 _____ () C:\Users\Standard\Desktop\adwcleaner_4.112.exe
2015-03-12 11:27 - 2015-03-12 11:27 - 00001295 _____ () C:\Users\Standard\Desktop\Revo Uninstaller.lnk
2015-03-12 11:27 - 2015-03-12 11:27 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-12 11:26 - 2015-03-12 11:26 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Standard\Desktop\revosetup95.exe
2015-03-10 23:16 - 2015-02-06 23:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-03-10 23:16 - 2015-02-03 23:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2015-03-10 23:16 - 2015-02-03 23:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2015-03-10 23:16 - 2015-02-03 23:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2015-03-10 23:16 - 2015-02-02 23:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
2015-03-10 23:16 - 2015-02-02 23:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
2015-03-10 23:16 - 2015-01-27 03:44 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
2015-03-10 23:16 - 2015-01-24 01:51 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe
2015-03-10 23:16 - 2015-01-23 07:17 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2015-03-10 23:16 - 2015-01-23 05:02 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2015-03-10 23:15 - 2015-02-05 20:24 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-03-10 23:15 - 2015-01-30 23:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-03-10 23:15 - 2015-01-30 23:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-03-10 23:15 - 2015-01-29 01:58 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll
2015-03-10 23:15 - 2015-01-29 01:29 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll
2015-03-10 23:14 - 2015-02-07 23:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2015-03-10 23:14 - 2015-02-07 23:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2015-03-10 23:14 - 2015-02-06 01:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-03-10 23:14 - 2015-02-06 01:08 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-03-10 23:14 - 2015-02-03 00:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2015-03-10 23:14 - 2015-02-03 00:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2015-03-10 23:14 - 2015-01-30 03:01 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
2015-03-10 23:14 - 2015-01-30 02:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll
2015-03-10 23:14 - 2015-01-30 02:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll
2015-03-10 23:14 - 2015-01-30 02:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll
2015-03-10 23:14 - 2015-01-30 01:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll
2015-03-10 23:14 - 2015-01-30 01:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll
2015-03-10 23:14 - 2015-01-30 01:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll
2015-03-10 23:14 - 2015-01-30 01:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll
2015-03-10 23:14 - 2015-01-30 01:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll
2015-03-10 23:14 - 2015-01-30 01:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll
2015-03-10 23:14 - 2015-01-30 01:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll
2015-03-10 23:14 - 2015-01-30 01:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll
2015-03-10 23:14 - 2015-01-30 01:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll
2015-03-10 23:14 - 2015-01-30 01:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll
2015-03-10 23:14 - 2015-01-29 01:11 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 23:14 - 2015-01-29 01:04 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-03-10 23:14 - 2015-01-29 01:04 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2015-03-10 23:14 - 2015-01-29 01:00 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 23:14 - 2015-01-29 00:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-03-10 23:14 - 2015-01-29 00:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2015-03-10 23:14 - 2015-01-29 00:50 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2015-03-10 23:14 - 2015-01-29 00:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-03-10 23:14 - 2015-01-28 02:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll
2015-03-10 23:14 - 2015-01-28 01:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll
2015-03-10 23:14 - 2015-01-27 23:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2015-03-10 23:14 - 2015-01-27 23:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2015-03-10 23:14 - 2014-12-11 05:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe
2015-03-10 23:14 - 2014-10-29 02:43 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe
2015-03-10 23:14 - 2014-10-29 02:34 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2015-03-10 23:14 - 2014-10-29 02:34 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
2015-03-10 23:14 - 2014-10-29 02:34 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2015-03-10 23:14 - 2014-10-29 02:04 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll
2015-03-10 23:14 - 2014-10-29 01:58 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe
2015-03-10 23:14 - 2014-10-29 01:52 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll
2015-03-10 23:14 - 2014-10-29 01:51 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-03-10 23:14 - 2014-10-29 01:45 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2015-03-10 23:14 - 2014-10-29 01:28 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll
2015-03-10 23:14 - 2014-10-29 01:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll
2015-03-10 23:14 - 2014-10-29 01:20 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-03-10 23:14 - 2014-10-29 01:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll
2015-03-10 23:14 - 2014-10-29 01:15 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2015-03-10 23:14 - 2014-10-29 01:13 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-03-10 23:14 - 2014-10-29 00:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll
2015-03-10 23:14 - 2014-10-29 00:55 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-03-10 23:14 - 2014-10-29 00:55 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2015-03-10 23:14 - 2014-10-29 00:44 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2015-03-10 23:14 - 2014-10-29 00:41 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2015-03-10 23:14 - 2014-10-29 00:35 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2015-03-10 20:17 - 2015-03-06 02:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-03-10 20:17 - 2015-03-06 02:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-03-10 20:17 - 2015-02-25 23:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-03-10 20:17 - 2015-02-20 03:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-03-10 20:17 - 2015-02-20 02:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-03-10 20:17 - 2015-02-20 02:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-03-10 20:17 - 2015-02-20 02:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-03-10 20:17 - 2015-01-28 15:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-03-10 20:17 - 2015-01-28 15:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-03-10 20:17 - 2015-01-28 15:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-03-10 20:17 - 2014-10-29 02:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2015-03-10 20:17 - 2014-10-29 02:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2015-03-10 20:17 - 2014-10-29 02:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2015-03-10 20:17 - 2014-10-29 02:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2015-03-10 20:17 - 2014-10-29 02:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2015-03-10 20:17 - 2014-10-29 02:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2015-03-10 20:16 - 2015-01-30 23:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2015-03-10 20:16 - 2015-01-27 04:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2015-03-10 20:16 - 2015-01-27 02:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2015-03-10 20:16 - 2014-10-29 03:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys
2015-03-10 20:16 - 2014-10-29 02:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll
2015-03-10 20:14 - 2015-02-21 01:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-03-10 20:14 - 2015-02-21 00:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-03-10 20:14 - 2015-02-21 00:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-03-10 20:14 - 2015-02-21 00:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-03-10 20:14 - 2015-02-21 00:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-03-10 20:14 - 2015-02-20 23:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-03-10 20:14 - 2015-02-20 23:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-03-10 20:14 - 2015-02-20 02:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-03-10 20:14 - 2015-02-20 02:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-03-10 20:14 - 2015-02-20 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-03-10 20:14 - 2015-02-20 02:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-03-10 20:14 - 2015-02-20 02:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2015-03-10 20:14 - 2015-02-20 02:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-03-10 20:14 - 2015-02-20 02:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-03-10 20:14 - 2015-02-20 02:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-03-10 20:14 - 2015-02-20 02:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-03-10 20:14 - 2015-02-20 02:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-03-10 20:14 - 2015-02-20 02:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-03-10 20:14 - 2015-02-20 01:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-03-10 20:14 - 2015-02-20 01:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-03-10 20:14 - 2015-02-20 01:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-03-10 20:14 - 2015-02-20 01:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-03-10 20:14 - 2015-02-20 01:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-03-10 20:14 - 2015-02-20 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-03-10 20:14 - 2015-02-20 01:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-03-10 20:14 - 2015-02-20 01:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-03-10 20:14 - 2015-02-20 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-03-10 20:14 - 2015-02-20 01:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-03-10 20:14 - 2015-02-20 01:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-03-10 20:14 - 2015-02-20 01:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-03-10 20:14 - 2015-02-20 01:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-03-10 20:14 - 2015-02-20 01:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-03-10 20:14 - 2015-02-20 01:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-03-10 20:14 - 2015-02-20 01:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-03-10 20:14 - 2015-02-20 01:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-03-10 20:14 - 2015-02-20 00:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-03-10 20:14 - 2015-02-20 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-03-10 20:13 - 2015-01-29 18:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-03-10 20:13 - 2015-01-29 18:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-03-10 20:12 - 2015-02-12 17:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-03-10 20:12 - 2015-02-12 17:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-03-10 20:11 - 2015-01-28 01:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2015-03-10 20:11 - 2015-01-28 01:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2015-03-10 20:11 - 2015-01-21 05:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-03-10 20:11 - 2015-01-21 05:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-03-07 23:05 - 2015-03-07 23:05 - 00000000 ____D () C:\Users\Standard\Desktop\attachments
2015-03-07 23:03 - 2015-03-07 23:04 - 10040114 _____ () C:\Users\Standard\Desktop\attachments.zip
2015-03-06 20:22 - 2015-03-06 20:22 - 00001422 _____ () C:\Users\Standard\Desktop\NN CV English.txt
2015-03-05 20:03 - 2015-03-06 01:20 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-05 20:03 - 2015-03-05 20:03 - 01682416 _____ (Malwarebytes Corporation) C:\Users\Standard\Desktop\mbam-check-2.1.1.1001.exe
2015-03-05 20:03 - 2015-03-05 20:03 - 00068241 _____ () C:\Users\Standard\Desktop\CheckResults.txt
2015-03-05 19:47 - 2015-03-12 22:22 - 00014104 _____ () C:\Users\Standard\Desktop\Addition.txt
2015-03-05 19:46 - 2015-03-14 18:17 - 00013871 _____ () C:\Users\Standard\Desktop\FRST.txt
2015-03-05 19:45 - 2015-03-14 18:16 - 00000000 ____D () C:\FRST
2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe
2015-03-05 19:37 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-05 19:36 - 2015-03-12 22:20 - 02095616 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe
2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk
2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Desktop\JRT.exe
2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll
2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll
2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp
2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump
2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls
2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-14 18:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-14 18:01 - 2013-08-22 14:46 - 00317331 _____ () C:\WINDOWS\setupact.log
2015-03-14 18:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-03-14 17:11 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6}
2015-03-14 17:09 - 2013-10-29 14:53 - 01166877 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-14 12:57 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-03-14 12:51 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-03-14 10:16 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP
2015-03-14 10:15 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive
2015-03-14 10:14 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-03-14 10:14 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-03-14 10:08 - 2013-08-17 20:22 - 00000000 ____D () C:\Program Files (x86)\QQMailPlugin
2015-03-14 10:00 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-14 10:00 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-03-14 10:00 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-03-14 09:54 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-03-12 22:10 - 2014-07-21 19:04 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-03-12 21:57 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner
2015-03-12 16:05 - 2013-08-17 16:59 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893-

1633341002-1001
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-11 02:35 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\WinStore
2015-03-11 02:34 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-03-11 00:34 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-03-11 00:31 - 2013-08-19 01:13 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-03-10 11:32 - 2013-08-19 20:27 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2015-03-10 11:32 - 2013-08-19 20:27 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2015-03-10 11:32 - 2013-08-19 20:27 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avnetflt.sys
2015-03-06 20:06 - 2013-09-29 19:04 - 00032604 _____ () C:\WINDOWS\PFRO.log
2015-03-06 20:06 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-05 21:31 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-05 21:31 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-03-05 20:00 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast1
2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data
2015-03-04 21:24 - 2014-12-12 11:05 - 00792032 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-03-04 21:24 - 2014-12-12 11:05 - 00178144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard
2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel

==================== Files in the root of some directories =======

2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg

Some content of TEMP:
====================
C:\Users\Standard\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-14 14:13

==================== End Of Log ============================
         
--- --- ---

--- --- ---

[/CODE]


und ADDITIONS

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Standard at 2015-03-14 18:17:58
Running from C:\Users\Standard\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.39052 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)
Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1405.1 - Microsoft Corporation) Hidden
Update for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

14-03-2015 12:35:10 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {3F228536-083D-42DD-8CEA-4D06331D4891} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-11] (Microsoft Corporation)
Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll
2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:88050731
AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"

==================== Accounts: =============================

Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)
Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)
Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1
Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/14/2015 06:07:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 02:16:58 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 02:16:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 02:14:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 00:33:47 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 00:33:45 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 10:22:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 10:22:34 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 10:22:09 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Error: (03/14/2015 10:21:54 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.


System errors:
=============
Error: (03/14/2015 10:15:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/14/2015 10:14:16 AM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (03/14/2015 09:55:41 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (03/14/2015 09:53:43 AM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORITÄT)
Description: 1069fdPHostNicht verfügbar{D3DCB472-7261-43CE-924B-0704BD730D5F}

Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Autom. Setup von Geräten, die mit dem Netzwerk verbunden sind" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "NcdAutoSetup" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%50

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Funktionssuchanbieter-Host" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "fdPHost" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%50

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "TCP/IP-NetBIOS-Hilfsdienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (03/14/2015 09:53:43 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "lmhosts" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%50

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).


Microsoft Office Sessions:
=========================
Error: (03/14/2015 06:07:42 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/14/2015 02:16:58 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/14/2015 02:16:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestc:\users\standard\desktop\esetsmartinstaller_deu.exe

Error: (03/14/2015 02:14:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (03/14/2015 00:33:47 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe

Error: (03/14/2015 00:33:45 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe

Error: (03/14/2015 10:22:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe

Error: (03/14/2015 10:22:34 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe

Error: (03/14/2015 10:22:09 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe

Error: (03/14/2015 10:21:54 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Standard\Desktop\esetsmartinstaller_deu.exe


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHz
Percentage of memory in use: 27%
Total physical RAM: 8073.22 MB
Available physical RAM: 5848.27 MB
Total Pagefile: 16265.22 MB
Available Pagefile: 13653.82 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB

==================== Drives ================================

Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:596.32 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         
.


Probleme ? Ja.

a) Da ist noch ein Ordner : C:\Program Files (x86)\QQMailPlugin. Einfach löschen ?

b) der zweite Punkt : die Verbindung zum MBAM Server geht partout nicht.

c) Ein Scan mit Avira brauchte über 15 Stunden und blieb bei 87 % hängen. Steht das in Zusammenhang mit dem letztlich erfolgtem Bluescreen ? Müssen wir uns um die Platte kümmern ?

Was können wir da noch tun ?

Danke
bD

Alt 15.03.2015, 07:58   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



MBAM und Avira neu installieren. Den Ordner einfach löschen.

Windows Bluescreen Absturz analysieren und beheben - so geht's - Anleitungen
Poste mal bitte einen Bericht von Bluescreenview.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 15.03.2015, 22:46   #11
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Ordner C:\Program Files (x86)\QQMailPlugin ist jetzt gelöscht.

AntiMalwareBytes deinstalliert, wieder installiert, Updateserver wieder kontaktierbar (!), Scan durchgeführt, hat ca. 30 min gebraucht, keine Funde. Danke dafür.

Avira aber läuft nun seit Stunden, hängt (scheinbar) wieder bei 70 %, genauer gesagt : geht nur sehr langsam voran. Wir haben das jetzt abgebrochen. Können wir da noch etwas machen ?

Anbei der Log vom BlueScreenViewer :
Code:
ATTFilter
==================================================
Dump File         : 030315-29093-01.dmp
Crash Time        : 03.03.2015 13:19:20
Bug Check String  : KERNEL_DATA_INPAGE_ERROR
Bug Check Code    : 0x0000007a
Parameter 1       : 00000000`00000004
Parameter 2       : 00000000`00000000
Parameter 3       : ffffe001`c45b5c60
Parameter 4       : ffffd000`35b61000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+1509a0
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+1509a0
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\WINDOWS\Minidump\030315-29093-01.dmp
Processors Count  : 4
Major Version     : 15
Minor Version     : 9600
Dump File Size    : 285.784
Dump File Time    : 03.03.2015 13:34:16
==================================================
         
Danke
bD

Alt 16.03.2015, 11:38   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Der Bluescreen ist irgend ein Treiberproblem. Bitte mal alle Treiber beim hersteller neu laden und drüber ziehen.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 16.03.2015, 23:26   #13
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



Hi,

wegen der Meldung im checkup.txt haben wir Java neue Version eingespielt.

Dann haben wir Avira gestartet, und siehe da, diesmal lief es durch.

Dann haben wir von der Toshiba-seite die Treiebr für unsere Maschine geladen und installiert.

So weit sieht jetzt alles wieder in Ordnung aus. Ein grosses Dankeschön von uns !

Müssen wir noch etwas machen ? Desktop bereinigen oder anderes ?

Danke
bD

Alt 17.03.2015, 12:35   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar




Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.


Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 17.03.2015, 15:16   #15
buenoDad
 
Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Standard

Tencent nicht deinstallierbar + AMWB Server nicht erreichbar



'Gestern abend haben wir noch Windows-Systemupdate versucht, was mit der Fehlermeldung "Code: 8024402C" endete. Wohl so etwas wie eine Blockade der Internetverbindung.

Heute morgen dann mit Delfix alles aufgeräumt, 1 wichitges Update "Net Framework" eingespielt, Windows Update suchen lassen und da ging auch die Windows-Updatefunktion wieder (sprich : keine Fehlermeldung).

Also, wir hoffen, daß "Code: 8024402C" nicht wieder kommt.

Danke für alle Hilfe
bD

Antwort

Themen zu Tencent nicht deinstallierbar + AMWB Server nicht erreichbar
bluescreen, dauert, deinstalliert, deutsche, deutschen, dinge, erreichbar, forum, gen, hänge, hängen, infiziert, keine verbindung, kurzem, länger, programme, programmen, rechner, rückmeldung, server, tencent, update, verbindung, wenig, win, würde



Ähnliche Themen: Tencent nicht deinstallierbar + AMWB Server nicht erreichbar


  1. Windows7: PDFs in Inbox kaputt, Amazon Downloader nicht deinstallierbar
    Log-Analyse und Auswertung - 28.10.2015 (15)
  2. Datei nicht deinstallierbar
    Log-Analyse und Auswertung - 23.04.2015 (15)
  3. LowPricesApp nicht deinstallierbar u. evtl. andere unerwünschte Gäste auf Laptop
    Log-Analyse und Auswertung - 23.02.2015 (19)
  4. windows 7, search protect nicht deinstallierbar, browser installiert automatisch add ons und öffnet andere websites
    Log-Analyse und Auswertung - 06.11.2014 (11)
  5. Search Protect Client Connect Ltd auf Windows 8.1, nicht deinstallierbar
    Log-Analyse und Auswertung - 25.09.2014 (4)
  6. Search Protect in Taskleiste und nicht deinstallierbar
    Plagegeister aller Art und deren Bekämpfung - 25.08.2014 (17)
  7. Windows 8.1: Snap.do nicht deinstallierbar
    Plagegeister aller Art und deren Bekämpfung - 07.04.2014 (13)
  8. snap.do nicht deinstallierbar windows vista
    Plagegeister aller Art und deren Bekämpfung - 04.03.2014 (23)
  9. Win 7 Home Premium 64 Bit: LyriXeeker-1 nicht deinstallierbar
    Log-Analyse und Auswertung - 27.09.2013 (15)
  10. Windows 7: LyricsGet-1 und LyriXeeker-1 nicht deinstallierbar
    Log-Analyse und Auswertung - 19.09.2013 (10)
  11. Yontoo 2.051 nicht deinstallierbar !
    Log-Analyse und Auswertung - 29.07.2013 (17)
  12. Nach Bluescreen Desktop fast leer und SQL Server nicht erreichbar
    Plagegeister aller Art und deren Bekämpfung - 26.07.2013 (15)
  13. GVU BKA etc. Trojaner - abgesicherter Modus nicht erreichbar, booten von CD nicht möglich
    Plagegeister aller Art und deren Bekämpfung - 24.06.2013 (27)
  14. Chatzum nicht deinstallierbar
    Log-Analyse und Auswertung - 23.04.2013 (12)
  15. Wohl Virus Gen:Variant.Kazy.9072, einige Webseiten nicht erreichbar, MBM nicht aktualisierbar
    Log-Analyse und Auswertung - 27.01.2011 (9)
  16. buttons lassen sich nicht öffnen download funktioniert nicht server nicht gefunden
    Log-Analyse und Auswertung - 14.11.2008 (1)
  17. Emails lassen sich nicht mehr abrufen / Google nicht erreichbar
    Plagegeister aller Art und deren Bekämpfung - 15.12.2004 (11)

Zum Thema Tencent nicht deinstallierbar + AMWB Server nicht erreichbar - Hallo, ich würde gerne noch einmal um Hilfe bitten. Wir haben einen Rechner mit deutschen Win 8.1 und AMWB Pro in England, der von Tencent Programmen "infiziert" ist, die wir - Tencent nicht deinstallierbar + AMWB Server nicht erreichbar...
Archiv
Du betrachtest: Tencent nicht deinstallierbar + AMWB Server nicht erreichbar auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.