| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Programm "Pokki"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.07.2015, 02:30
| #1 |
 |  Programm "Pokki" Hallo, bei mir hat sich wohl das Programm "Pokki" eingenistet.Laut Internet soll dies kein böser Virus sein,dennoch möchte ich mein System von euch checken lassen. MfG Croatis Code:
ATTFilter # Datenbank : 2015-07-11.1 [Server]
# Betriebssystem : Windows 8.1 (x64)
# Benutzername : 1973pl - PETRA
# Gestarted von : C:\Users\1973pl\Downloads\AdwCleaner_4.208.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\1973pl\AppData\Local\pokki
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper
Schlüssel Gelöscht : HKCU\Software\Classes\MIME\Database\Content Type\application/x-pokkidownloadhelper
Schlüssel Gelöscht : HKCU\Software\Classes\AppID\npPokkiDownloadHelper.dll
Schlüssel Gelöscht : HKCU\Software\Classes\Pokki.PokkiDownloadHelper
Schlüssel Gelöscht : HKCU\Software\Classes\Pokki.PokkiDownloadHelper.1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{22848257-6A2D-4D2A-8D56-C886D25B8B58}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{22848257-6A2D-4D2A-8D56-C886D25B8B58}
Schlüssel Gelöscht : HKCU\Software\Pokki
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PokkiDownloadHelper
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Mozilla Firefox v39.0 (x86 de)
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [892 Bytes] - [08/04/2015 09:13:06]
AdwCleaner[R10].txt - [1670 Bytes] - [06/05/2015 23:53:41]
AdwCleaner[R11].txt - [1728 Bytes] - [07/05/2015 03:17:23]
AdwCleaner[R12].txt - [1788 Bytes] - [13/05/2015 03:55:08]
AdwCleaner[R13].txt - [1851 Bytes] - [14/05/2015 16:15:57]
AdwCleaner[R14].txt - [1914 Bytes] - [16/05/2015 22:38:31]
AdwCleaner[R15].txt - [2019 Bytes] - [30/05/2015 02:05:05]
AdwCleaner[R16].txt - [2079 Bytes] - [30/05/2015 02:07:48]
AdwCleaner[R17].txt - [2139 Bytes] - [07/06/2015 23:23:40]
AdwCleaner[R18].txt - [2199 Bytes] - [12/06/2015 00:18:32]
AdwCleaner[R19].txt - [2259 Bytes] - [19/06/2015 00:34:36]
AdwCleaner[R1].txt - [954 Bytes] - [13/04/2015 02:49:46]
AdwCleaner[R20].txt - [2319 Bytes] - [21/06/2015 07:29:34]
AdwCleaner[R21].txt - [2379 Bytes] - [23/06/2015 16:57:48]
AdwCleaner[R22].txt - [2439 Bytes] - [24/06/2015 14:34:38]
AdwCleaner[R23].txt - [2499 Bytes] - [24/06/2015 14:51:57]
AdwCleaner[R24].txt - [2559 Bytes] - [27/06/2015 09:44:16]
AdwCleaner[R25].txt - [2619 Bytes] - [28/06/2015 15:17:07]
AdwCleaner[R26].txt - [2679 Bytes] - [29/06/2015 12:49:22]
AdwCleaner[R27].txt - [2739 Bytes] - [29/06/2015 18:51:18]
AdwCleaner[R28].txt - [2799 Bytes] - [30/06/2015 02:40:44]
AdwCleaner[R29].txt - [3196 Bytes] - [06/07/2015 02:22:28]
AdwCleaner[R2].txt - [1012 Bytes] - [14/04/2015 01:15:03]
AdwCleaner[R30].txt - [2928 Bytes] - [06/07/2015 02:34:06]
AdwCleaner[R31].txt - [3878 Bytes] - [13/07/2015 02:46:03]
AdwCleaner[R32].txt - [3938 Bytes] - [13/07/2015 02:55:00]
AdwCleaner[R3].txt - [1071 Bytes] - [14/04/2015 06:00:49]
AdwCleaner[R4].txt - [1087 Bytes] - [14/04/2015 21:09:35]
AdwCleaner[R5].txt - [1146 Bytes] - [16/04/2015 05:38:43]
AdwCleaner[R6].txt - [1265 Bytes] - [22/04/2015 22:22:36]
AdwCleaner[R7].txt - [1433 Bytes] - [04/05/2015 23:44:15]
AdwCleaner[R8].txt - [1492 Bytes] - [04/05/2015 23:58:59]
AdwCleaner[R9].txt - [1610 Bytes] - [05/05/2015 00:04:23]
AdwCleaner[S0].txt - [1131 Bytes] - [14/04/2015 06:01:19]
AdwCleaner[S1].txt - [1206 Bytes] - [16/04/2015 05:39:26]
AdwCleaner[S2].txt - [1551 Bytes] - [04/05/2015 23:59:46]
AdwCleaner[S3].txt - [3252 Bytes] - [06/07/2015 02:27:47]
AdwCleaner[S4].txt - [3809 Bytes] - [13/07/2015 03:13:26]
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [3868 Bytes] ##########
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:12-07-2015
Ran by 1973pl (administrator) on PETRA on 13-07-2015 03:25:31
Running from C:\Users\1973pl\Desktop
Loaded Profiles: UpdatusUser & 1973pl (Available Profiles: UpdatusUser & 1973pl)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Akamai Technologies, Inc.) C:\Users\1973pl\AppData\Local\Akamai\netsession_win.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\TMTV5Monitor.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Akamai Technologies, Inc.) C:\Users\1973pl\AppData\Local\Akamai\netsession_win.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe
HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-05] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-1766157453-2088857509-2423560725-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-11-21] (Microsoft Corporation)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3632112 2015-07-05] (Electronic Arts)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [28785792 2015-06-02] (Skype Technologies S.A.)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Akamai NetSession Interface] => C:\Users\1973pl\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk [2012-11-21]
ShortcutTarget: TMMonitor.lnk -> C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\TMTV5Monitor.exe (ArcSoft, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1766157453-2088857509-2423560725-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-24] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-24] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{9A34807A-9833-43AC-A876-5346935872C5}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D93110B3-007B-4A4A-8BAC-33DF59D2732D}: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_203.dll [2015-07-08] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_203.dll [2015-07-08] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-24] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-02-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Extension: Avira Browser Safety - C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default\Extensions\abs@avira.com [2015-07-02]
FF Extension: Adblock Plus - C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-13]
Chrome:
=======
CHR Profile: C:\Users\1973pl\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] () [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-07-05] (Electronic Arts)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-04-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-04-10] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-30] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-11-21] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [44296 2015-03-30] (LogMeIn Inc.)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-11-14] (ITE )
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-13] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-04-10] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-11-21] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-13 03:25 - 2015-07-13 03:26 - 00016984 _____ C:\Users\1973pl\Desktop\FRST.txt
2015-07-13 03:25 - 2015-07-13 03:25 - 00000000 ____D C:\Users\1973pl\Desktop\FRST-OlderVersion
2015-07-13 02:51 - 2015-07-13 03:02 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2015-07-13 02:51 - 2015-07-13 02:51 - 00000000 ____D C:\Users\1973pl\AppData\Local\Bluestacks
2015-07-13 02:44 - 2015-07-13 02:44 - 02248704 _____ C:\Users\1973pl\Downloads\AdwCleaner_4.208.exe
2015-07-10 20:10 - 2015-07-12 22:11 - 00003922 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{C738C1A3-886C-4436-98D0-E63BBECD72AA}
2015-07-08 23:50 - 2015-07-08 23:50 - 00000000 ____D C:\Users\1973pl\AppData\Local\HackRUN
2015-07-08 23:28 - 2015-07-08 23:28 - 00000811 _____ C:\Users\1973pl\Desktop\World of Warships.lnk
2015-07-08 23:28 - 2015-07-08 23:28 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Warships
2015-07-08 23:28 - 2015-07-08 23:28 - 00000000 ____D C:\Games
2015-07-08 23:27 - 2015-07-08 23:28 - 06949352 _____ (Wargaming.net ) C:\Users\1973pl\Downloads\WoWS_internet_install_eu.exe
2015-07-06 02:24 - 2015-07-06 02:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-06 00:21 - 2015-07-06 00:39 - 439121981 _____ C:\Users\1973pl\Desktop\Hearthstone 1.mp4
2015-07-05 23:11 - 2015-07-05 23:43 - 936866391 _____ C:\Users\1973pl\Desktop\Child of Light4.mp4
2015-07-05 05:24 - 2015-07-05 05:55 - 854570131 _____ C:\Users\1973pl\Desktop\Child of Light 3.mp4
2015-07-05 02:45 - 2015-07-05 03:13 - 663713860 _____ C:\Users\1973pl\Desktop\Child of Light 2.mp4
2015-07-05 01:40 - 2015-07-05 02:10 - 620172748 _____ C:\Users\1973pl\Desktop\Child of Light 1.mp4
2015-07-04 21:57 - 2015-07-04 21:57 - 00000000 ____D C:\Users\1973pl\Documents\FIFA World
2015-06-30 21:34 - 2015-06-30 22:11 - 1062846947 _____ C:\Users\1973pl\Desktop\EU 4 2.mp4
2015-06-30 19:12 - 2015-06-30 19:12 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2015-06-30 02:18 - 2015-07-05 15:11 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\HearthstoneDeckTracker
2015-06-30 02:17 - 2015-06-30 02:17 - 00000000 ____D C:\Users\1973pl\Documents\Hearthstone.Deck.Tracker-v0.10.6
2015-06-30 02:02 - 2015-07-06 00:39 - 00111104 ___SH C:\Users\1973pl\Desktop\Thumbs.db
2015-06-30 01:58 - 2015-06-30 01:58 - 00000098 _____ C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-06-30 01:58 - 2015-06-30 01:58 - 00000000 ____D C:\Users\1973pl\AppData\Local\HearthstoneTracker
2015-06-28 20:36 - 2015-06-28 20:36 - 00001209 _____ C:\Users\Public\Desktop\Play Euro Truck Simulator 2 Multiplayer.lnk
2015-06-27 16:31 - 2015-06-27 16:31 - 00000242 _____ C:\Users\1973pl\Desktop\2.Bundesliga Tipps.txt
2015-06-27 09:39 - 2015-06-28 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Euro Truck Simulator 2 Multiplayer
2015-06-27 09:39 - 2015-06-28 20:36 - 00000000 ____D C:\Program Files (x86)\Euro Truck Simulator 2 Multiplayer
2015-06-27 09:39 - 2015-06-27 09:41 - 00000000 ____D C:\Users\1973pl\Documents\ETS2MP
2015-06-26 16:28 - 2015-06-26 16:28 - 00000214 _____ C:\Users\1973pl\Desktop\1.Bundesliga Tipps.txt
2015-06-25 19:45 - 2015-06-25 19:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-24 14:42 - 2015-06-24 14:44 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\1973pl\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-24 08:03 - 2015-06-24 08:04 - 00000000 ____D C:\Users\1973pl\Documents\Rayman Legends
2015-06-24 07:52 - 2015-06-24 08:03 - 00000000 ____D C:\Users\1973pl\AppData\Local\Ubisoft Game Launcher
2015-06-24 07:52 - 2015-06-24 07:52 - 00001225 _____ C:\Users\1973pl\Desktop\Uplay.lnk
2015-06-24 07:52 - 2015-06-24 07:52 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-06-24 07:51 - 2015-06-24 07:51 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2015-06-23 16:57 - 2015-06-23 16:57 - 02244096 _____ C:\Users\1973pl\Downloads\AdwCleaner_4.207.exe
2015-06-21 03:12 - 2015-06-21 03:12 - 00000000 ____D C:\Users\1973pl\Documents\KillHouseGames
2015-06-19 16:41 - 2015-06-19 16:41 - 00000000 ____D C:\Users\1973pl\Documents\Klei
2015-06-17 10:41 - 2015-06-17 10:41 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Shooter
2015-06-15 22:29 - 2015-06-27 14:45 - 00000000 ____D C:\Mathelehrer Simulator 2014
2015-06-15 22:29 - 2015-06-15 22:29 - 00000759 _____ C:\Users\Public\Desktop\Mathelehrer Simulator 2014.lnk
2015-06-15 22:29 - 2015-06-15 22:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mathelehrer Simulator 2014
2015-06-15 22:27 - 2015-06-15 22:28 - 06053004 _____ (PeDePe ) C:\Users\1973pl\Downloads\Mathelehrer_Setup.exe
2015-06-15 20:31 - 2015-06-15 20:31 - 00000000 ____D C:\Users\1973pl\Documents\Telltale Games
2015-06-14 20:40 - 2015-06-14 20:40 - 00466456 _____ (Creative Labs) C:\WINDOWS\system32\wrap_oal.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00444952 _____ (Creative Labs) C:\WINDOWS\SysWOW64\wrap_oal.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\system32\OpenAL32.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\SysWOW64\OpenAL32.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Waveform
2015-06-14 20:40 - 2015-06-14 20:40 - 00000000 ____D C:\Program Files (x86)\OpenAL
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-13 03:25 - 2015-05-05 00:12 - 00000000 ____D C:\FRST
2015-07-13 03:25 - 2015-05-05 00:07 - 02133504 _____ (Farbar) C:\Users\1973pl\Desktop\FRST64.exe
2015-07-13 03:22 - 2015-04-21 15:24 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Skype
2015-07-13 03:21 - 2015-04-10 06:38 - 01708770 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-13 03:20 - 2013-08-18 20:52 - 00000000 ____D C:\Users\1973pl\Documents\Youcam
2015-07-13 03:18 - 2015-04-09 00:16 - 00000000 ____D C:\ProgramData\Origin
2015-07-13 03:18 - 2015-04-08 08:54 - 00000000 ____D C:\Program Files (x86)\Steam
2015-07-13 03:15 - 2013-08-22 16:46 - 00334360 _____ C:\WINDOWS\setupact.log
2015-07-13 03:15 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-07-13 03:13 - 2015-04-08 09:13 - 00000000 ____D C:\AdwCleaner
2015-07-13 03:07 - 2015-04-08 07:31 - 00000000 ____D C:\Users\1973pl\AppData\Local\Battle.net
2015-07-13 03:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-07-13 02:46 - 2014-05-13 14:39 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-07-13 02:33 - 2014-06-14 23:31 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-07-12 12:31 - 2015-04-08 17:30 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\TS3Client
2015-07-12 12:18 - 2015-04-16 15:03 - 00000000 ____D C:\Users\1973pl\AppData\Local\Ori and the Blind Forest
2015-07-10 22:50 - 2015-05-06 15:15 - 00000000 ____D C:\Users\1973pl\Documents\My Games
2015-07-10 19:50 - 2015-04-28 03:16 - 00000000 ____D C:\ProgramData\Riot Games
2015-07-10 06:10 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-07-10 06:05 - 2013-08-18 20:56 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1766157453-2088857509-2423560725-1002
2015-07-08 22:38 - 2014-06-14 23:31 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-07-06 23:24 - 2014-11-21 13:01 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-07-06 23:24 - 2014-11-21 13:01 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-06 18:14 - 2015-04-16 07:14 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\OBS
2015-07-06 12:44 - 2015-06-11 01:09 - 00001140 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-06 04:20 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-07-06 02:49 - 2015-02-26 22:18 - 00001122 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-06 02:49 - 2015-02-26 22:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-06 02:49 - 2015-02-26 22:18 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-06 02:29 - 2014-11-20 20:24 - 00014598 _____ C:\WINDOWS\PFRO.log
2015-07-06 02:29 - 2014-05-13 14:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-06 02:28 - 2015-04-10 06:50 - 00000000 ____D C:\Users\1973pl
2015-07-06 02:28 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-07-06 00:50 - 2015-04-09 01:00 - 00000000 ____D C:\Program Files (x86)\Origin Games
2015-07-05 19:06 - 2015-04-09 00:16 - 00000000 ____D C:\Program Files (x86)\Origin
2015-07-04 21:56 - 2012-11-14 09:25 - 00139780 _____ C:\WINDOWS\DirectX.log
2015-07-03 20:26 - 2015-04-29 02:03 - 00000000 ____D C:\Users\1973pl\Documents\Euro Truck Simulator 2
2015-07-01 04:32 - 2015-04-08 07:36 - 00000000 ____D C:\Program Files (x86)\Heroes of the Storm
2015-06-29 21:59 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-06-29 20:41 - 2015-04-08 07:30 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-06-29 12:40 - 2015-04-09 01:01 - 00000000 ____D C:\Users\1973pl\AppData\Local\Adobe
2015-06-29 12:29 - 2013-08-22 16:44 - 00368792 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-06-29 12:22 - 2014-12-16 13:23 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-06-29 12:22 - 2014-11-21 12:51 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-06-29 12:22 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-06-29 12:22 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-06-29 12:21 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Avira
2015-06-28 17:07 - 2015-04-21 15:24 - 00000000 ____D C:\ProgramData\Skype
2015-06-26 04:22 - 2015-02-22 18:45 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-18 08:42 - 2015-02-26 22:18 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-06-18 08:41 - 2015-02-26 22:18 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-06-18 08:41 - 2014-05-13 14:37 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-06-15 20:39 - 2015-04-23 19:43 - 00000000 ____D C:\Program Files (x86)\Hearthstone
==================== Files in the root of some directories =======
2012-11-14 10:19 - 2012-11-14 10:19 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-06-30 01:58 - 2015-06-30 01:58 - 0000098 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
Some files in TEMP:
====================
C:\Users\1973pl\AppData\Local\Temp\27fff54a706caf16275619fa9b79269c.dll
C:\Users\1973pl\AppData\Local\Temp\avgnt.exe
C:\Users\1973pl\AppData\Local\Temp\Quarantine.exe
C:\Users\1973pl\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-08 09:14
==================== End of log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version:12-07-2015
Ran by 1973pl at 2015-07-13 03:26:39
Running from C:\Users\1973pl\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
1973pl (S-1-5-21-1766157453-2088857509-2423560725-1002 - Administrator - Enabled) => C:\Users\1973pl
Administrator (S-1-5-21-1766157453-2088857509-2423560725-500 - Administrator - Disabled)
Gast (S-1-5-21-1766157453-2088857509-2423560725-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1766157453-2088857509-2423560725-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-1766157453-2088857509-2423560725-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.203 - Adobe Systems Incorporated)
AdVenture Capitalist (HKLM-x32\...\Steam App 346900) (Version: - Hyper Hippo Games)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
Akamai NetSession Interface (HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Akamai) (Version: - Akamai Technologies, Inc)
ArcSoft TV 5.0 (HKLM-x32\...\{94ED52E0-24A0-4AD8-9BFD-0560CA680A80}) (Version: 5.0.8.145 - ArcSoft)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BattleBlock Theater (HKLM-x32\...\Steam App 238460) (Version: - The Behemoth)
Child of Light (HKLM-x32\...\Steam App 256290) (Version: - Ubisoft Montréal)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3124 - CyberLink Corp.)
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
CyberLink PowerDirector (Version: 9.0.0.3815c - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.0913 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
Door Kickers (HKLM-x32\...\Steam App 248610) (Version: - KillHouse Games)
EA SPORTS™ FIFA 15 (HKLM-x32\...\{3D4ADA2B-F028-4307-ADF4-6F9AA44725DA}) (Version: 1.8.0.0 - Electronic Arts)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Euro Truck Simulator 2 (HKLM-x32\...\Steam App 227300) (Version: - SCS Software)
Euro Truck Simulator 2 Multiplayer 0.1.9.2 Alpha (HKLM-x32\...\{A227B892-C548-4490-9C5D-DB341F8194A6}_is1) (Version: 0.1.9.2 Alpha - ETS2MP Team)
Europa Universalis IV (HKLM-x32\...\Steam App 236850) (Version: - Paradox Development Studio)
F1 2013 (HKLM-x32\...\Steam App 223670) (Version: - Codemasters Birmingham)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
FUSSBALL MANAGER 13 (HKLM-x32\...\{80AF0300-866F-400F-A350-D53E3C3E34E0}) (Version: 1.0.4.0 - Electronic Arts)
Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-8F3D-148929CC1385}) (Version: 2.6.1210.0278 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{1593C708-5535-47A4-8C0F-F8D4BE2B4560}) (Version: 15.05.6000.1620 - Intel Corporation)
IT9130 Driver v12.2.3.1 (HKLM-x32\...\IT9130 DriverInstaller_12.2.3.1) (Version: - )
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Mathelehrer Simulator 2014 Version 1.0 (HKLM-x32\...\{3B026C70-8654-4388-AB62-6C7F127370EC}_is1) (Version: 1.0 - PeDePe)
Mediathek (HKLM-x32\...\{EFFED0C0-5299-422E-AFE6-8B8066D18A2A}) (Version: 1.4.0 - Medion)
Medion Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Medion Home Cinema 10 (x32 Version: 10.1924 - CyberLink Corp.) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4727.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NVIDIA Graphics Driver 307.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.17 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version: - )
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Ori and the Blind Forest (HKLM-x32\...\Steam App 261570) (Version: - Moon Studios GmbH)
Origin (HKLM-x32\...\Origin) (Version: 9.5.11.2855 - Electronic Arts, Inc.)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0081 - Pegatron Corporation)
Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Race: The WTCC Game (HKLM-x32\...\Steam App 4230) (Version: - SimBin)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6722 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Rocket League (HKLM-x32\...\Steam App 252950) (Version: - Psyonix) <==== ATTENTION!
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.12.12 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Uplay (HKLM-x32\...\Uplay) (Version: 3.0 - Ubisoft)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
World of Warships (HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C814eu}_is1) (Version: - Wargaming.net)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1766157453-2088857509-2423560725-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1766157453-2088857509-2423560725-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\1973pl\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1766157453-2088857509-2423560725-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\1973pl\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1766157453-2088857509-2423560725-1002_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\1973pl\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1766157453-2088857509-2423560725-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\1973pl\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1766157453-2088857509-2423560725-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\1973pl\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
11-07-2015 09:42:10 Geplanter Prüfpunkt
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0555C6F1-A95F-4587-90AE-3FE5DD66A46D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-06-12] (Microsoft Corporation)
Task: {0E22486E-BD76-4AB8-82D9-FF0499C69DC1} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {0E9541CE-5339-41B4-8FF7-087B47655FBC} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {19BA6E03-67A1-4F26-B568-5F1D17A5468E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-08] (Adobe Systems Incorporated)
Task: {292462B6-BB95-4DA3-9BC2-CD4B78915C11} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe
Task: {2C6AB993-69A5-4EE5-B13F-DB6DFDBE4799} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {5E4D3901-C47F-495E-8771-679433B59FF6} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-09-05] (Synaptics Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (Whitelisted) ==============
2013-10-27 09:03 - 2013-10-27 09:03 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2012-11-29 15:32 - 2012-11-29 15:53 - 00805888 _____ () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2015-02-22 18:45 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-11-14 09:45 - 2012-10-19 13:27 - 00386344 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2012-11-29 15:32 - 2012-11-27 17:18 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2012-11-29 15:32 - 2010-01-12 19:36 - 00117256 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2012-11-29 15:32 - 2010-01-12 19:36 - 00121864 _____ () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2012-11-29 15:32 - 2010-12-17 16:04 - 00449032 _____ () C:\Program Files (x86)\PHotkey\ATouch64.exe
2012-11-29 15:32 - 2012-10-23 20:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2012-11-29 15:32 - 2012-08-08 20:10 - 07536128 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2012-11-29 15:32 - 2009-12-18 17:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2012-11-29 15:32 - 2009-12-18 17:41 - 00129544 _____ () C:\Program Files (x86)\PHotkey\GFNEX.dll
2015-04-08 09:15 - 2015-04-16 19:40 - 00776192 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-04-08 09:15 - 2015-04-23 04:16 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-04-08 09:15 - 2015-06-04 20:56 - 02407104 _____ () C:\Program Files (x86)\Steam\video.dll
2015-04-08 09:15 - 2015-04-23 04:16 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-04-08 09:15 - 2015-04-23 04:16 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2015-04-08 09:15 - 2014-12-01 23:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2015-04-08 09:15 - 2014-12-01 23:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2015-04-08 09:15 - 2014-12-01 23:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2015-04-08 09:15 - 2014-12-01 23:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2015-04-08 09:15 - 2014-12-01 23:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2015-04-08 09:15 - 2015-06-04 20:56 - 00703168 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-10-27 09:03 - 2013-10-27 09:03 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 01007104 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00024576 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00216576 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00261120 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00019456 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00337408 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2015-04-09 00:24 - 2015-07-05 19:05 - 00228352 _____ () C:\Program Files (x86)\Origin\mediaservice\wmfengine.dll
2012-11-21 17:23 - 2007-04-19 11:33 - 00035584 _____ () C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\uPiApi.dll
2012-11-21 17:23 - 2012-06-04 17:50 - 00016384 _____ () C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\uTVMUIEngine.dll
2012-11-14 09:43 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 13:34 - 2012-06-08 13:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-04-13 03:58 - 2015-04-13 03:58 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\1706c668394b6917a63634ebd3bedcf2\PSIClient.ni.dll
2015-04-08 09:15 - 2015-05-11 21:01 - 36302728 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2012-11-14 10:20 - 2012-06-25 11:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1001\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\1973pl\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{9E37645A-5722-4890-9407-EBBB6B9435E6}C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm.exe
FirewallRules: [TCP Query User{46E4CD15-A86A-4F91-BD98-5AE7A10AF886}C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm.exe
FirewallRules: [UDP Query User{567D9A45-D004-43F3-A7E9-DAB3DC4CF557}C:\program files (x86)\origin games\fifa 15\fifa15.exe] => (Allow) C:\program files (x86)\origin games\fifa 15\fifa15.exe
FirewallRules: [TCP Query User{D60D48B8-F8BC-4888-9375-30843456BB59}C:\program files (x86)\origin games\fifa 15\fifa15.exe] => (Allow) C:\program files (x86)\origin games\fifa 15\fifa15.exe
FirewallRules: [{EB255023-9A4A-4B05-85BF-6F32C01A46F1}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{0E5A910A-486A-4CE0-9BBB-24FFF61BB8A9}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{65979DF4-9450-4F21-920A-FC0BC1E94536}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{1F49A8E4-6413-477F-8FBC-46496374F8B8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{BA10C849-3F69-4AB4-A27A-C1CD1E1F10FE}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{BD5E3AF6-C59A-4B3D-B430-50DA723987DD}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{10F68AC6-FC10-461F-BB42-3F98CF6AE0F8}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{51BA7F8D-752C-4E22-9E0F-AFA9C61A1638}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [UDP Query User{9B998942-E255-4706-A73F-309EBFD92E9A}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{248383FE-B90F-4894-818C-EA0810CB17FB}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{C1501E65-35C4-4149-A064-A33B565EBD80}C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{F152B99A-E8CE-47DD-B7ED-897BA9BFF9C2}C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [{BFB1C70A-EB64-4121-A8BC-02BB421396B4}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{62D75383-B513-4333-959B-E3410BA5EB80}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{899E3323-CACE-40FE-8496-197B94159DFB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CCC497C6-565C-4D4F-8B21-BC9887A7DF1E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1965A604-AA3B-4D67-8717-8C818E9181AF}] => (Allow) C:\Users\1973pl\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{1A4446BB-76FC-4370-B066-BD9E94BDFB96}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{869E3A75-1936-4059-A462-EABFC6E11A18}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe
FirewallRules: [{94A3041B-663C-468A-ACA3-BB68068B32D7}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{51B1AE16-8E82-48D9-A12B-458A23A66B46}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{2FCFAA31-5F2E-4EE9-97F6-10EDF33A2D2E}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{D58EBA08-D403-45A4-9232-520EEB05E672}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
FirewallRules: [{86039665-D3ED-4584-896E-E347897E04E9}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
FirewallRules: [{E7E9A7D0-1B2B-4085-86DA-F45AB299316B}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{10F51AF5-FA5D-4FC6-92B6-E2DA8AD9AC0A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{C18A70DD-534A-4C32-95DC-96DCBAAB8361}] => (Allow) C:\Program Files\CyberLink\PowerDirector\PDR9.EXE
FirewallRules: [{DD411DF8-5638-4E1B-955B-A143E18D1E75}] => (Allow) LPort=1900
FirewallRules: [{E5927AC1-9F11-402F-8D8D-15DC242D4743}] => (Allow) LPort=2869
FirewallRules: [{C18D1F24-3C12-467C-BC95-1FF7786E3A43}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{BD0A0ED1-5E86-462C-AD72-62E108C517BE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Europa Universalis IV\eu4.exe
FirewallRules: [{D339C2D5-BE7B-4B41-8E58-118F1D6202A3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Europa Universalis IV\eu4.exe
FirewallRules: [{02AC72A9-7158-494F-8306-CBB388E50057}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Ori\ori.exe
FirewallRules: [{3D1F0CD5-177B-4C2C-8AFA-EDBD170E244E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Ori\ori.exe
FirewallRules: [{22D15B22-D774-4493-9DC5-C18114ADA61F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{2BE48F92-6C40-4450-B627-839208C20994}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{993A87DE-BFD2-4E37-952B-6E283AE2132A}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA Manager 13\Manager13.exe
FirewallRules: [{FC63B946-6CE9-4966-B4E7-E1F646998A43}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA Manager 13\Manager13.exe
FirewallRules: [TCP Query User{A3C59CD7-5C75-484A-85D3-02C95B89C3F8}C:\program files (x86)\steam\steamapps\common\tom clancy's ghost recon phantoms - eu\game\pdc-live\ghostreconphantoms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\tom clancy's ghost recon phantoms - eu\game\pdc-live\ghostreconphantoms.exe
FirewallRules: [UDP Query User{C3B4B516-1912-4AC7-B7E2-D656BD82479C}C:\program files (x86)\steam\steamapps\common\tom clancy's ghost recon phantoms - eu\game\pdc-live\ghostreconphantoms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\tom clancy's ghost recon phantoms - eu\game\pdc-live\ghostreconphantoms.exe
FirewallRules: [TCP Query User{7A7E9EEB-F815-4CCE-8368-790D4039A5FD}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{C6AC77C9-8F1F-47E1-94EE-70C5BFBEA043}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{5AB0F920-C63F-481B-BEB1-23B70048376C}C:\users\1973pl\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\1973pl\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{4EA707DE-52F3-46FA-B7A2-87752F9289E6}C:\users\1973pl\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\1973pl\appdata\local\akamai\netsession_win.exe
FirewallRules: [{50ADF052-963A-4E58-BB6B-3FDA68E10296}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{7963A537-B88C-45FF-B51A-09002323822F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{D4DE4AAC-B546-4806-8B4E-9D0B1515F1CD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\f12013\F1_2013.exe
FirewallRules: [{01E503A4-1ADA-4875-B5CF-DEA134F2DD17}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\f12013\F1_2013.exe
FirewallRules: [{3094700C-6DFD-4FF5-92B7-CBD566331002}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BattleBlock Theater\BattleBlockTheater.exe
FirewallRules: [{9541AD0A-1E85-449A-B93D-20D0FF1A45AD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BattleBlock Theater\BattleBlockTheater.exe
FirewallRules: [TCP Query User{8D3B064F-3435-46E1-8A7C-03588A88A5EB}C:\program files (x86)\heroes of the storm\versions\base35360\heroesofthestorm.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base35360\heroesofthestorm.exe
FirewallRules: [UDP Query User{9DE22CA2-CD87-4BC5-A8DE-1B873C530735}C:\program files (x86)\heroes of the storm\versions\base35360\heroesofthestorm.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base35360\heroesofthestorm.exe
FirewallRules: [{70271904-B40C-4EFE-AB62-3A3AF5DFD76C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{FC186C4F-13E7-48E4-ABC0-62E0552A45D6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Age2HD\Launcher.exe
FirewallRules: [{D73BC459-559B-4DB7-A6DA-010BC0CC7F10}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe
FirewallRules: [{343CD1F9-548A-4788-AB24-0BFEB41B7464}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\AdVenture Capitalist\adventure-capitalist.exe
FirewallRules: [{5EADCEEE-4840-411B-BC93-F3441DAB690E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{0A24652A-15E6-46BD-A761-E4E5DBF82048}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{E8E7F4CD-E290-4C57-B6E9-DAF7A9C3C54A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{EB28D9F0-52E5-4B96-AFEE-72FEAFFE1179}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [TCP Query User{92424320-2D15-41F6-B6E6-5EF8E5A842A3}C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm.exe
FirewallRules: [UDP Query User{88C1FCD3-A768-40B7-8A7E-EA2DDA386787}C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm.exe
FirewallRules: [TCP Query User{C0626F6A-C409-4B55-8B1B-F4E9896A7367}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{4AC66860-0B9D-4E4A-A800-25A57235E941}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{AB10B496-EEC6-4B0B-914B-B59AFCABEB4F}C:\users\1973pl\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\1973pl\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{6A0D02FD-E2A9-424A-8EF2-229AE3ECFF18}C:\users\1973pl\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\1973pl\appdata\local\akamai\netsession_win.exe
FirewallRules: [{1F9A7849-05E1-4B06-B397-EE8162321392}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 15\fifasetup\fifaconfig.exe
FirewallRules: [{F2D0582F-B586-40EB-98DE-CD693C57D1C5}] => (Allow) C:\Program Files (x86)\Origin Games\FIFA 15\fifasetup\fifaconfig.exe
FirewallRules: [{FEBAFC8D-9FF9-4FE6-BB18-85E09768976B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{A323F914-0671-4347-86D1-D6AC4CC44594}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{1E7AB1F8-F8D4-4AA2-8FF4-9BF40E8DA73A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{AB6B6306-016F-45CA-9220-2176F8D97FE2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{92662F06-480A-4EDD-9225-AE696DF94E21}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{0F7986C9-3272-47AC-9922-76A63D48A655}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{11752C38-6D3C-4E6D-B0F2-D6D0CD960F9E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{C2E05714-0A8E-4D2F-A928-74EDC200B19D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{102CB429-BDFF-4212-B8A3-EA552374D362}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DoorKickers\DoorKickers.exe
FirewallRules: [{7DA7945E-6A19-46BE-965C-89CB8418BEAF}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\DoorKickers\DoorKickers.exe
FirewallRules: [{B2B1909C-7DDF-4F8A-AB58-DA68E80B0C4B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Child of Light\ChildofLight.exe
FirewallRules: [{57054927-C080-4898-8BA7-9D3D9AC81EBD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Child of Light\ChildofLight.exe
FirewallRules: [TCP Query User{D4E2E831-E73B-411D-8DB4-93ABE7CDDD74}C:\program files (x86)\origin games\fifa world\fifaworld.exe] => (Allow) C:\program files (x86)\origin games\fifa world\fifaworld.exe
FirewallRules: [UDP Query User{17A074D7-FCAA-41E6-A03C-C63CB71AF6E1}C:\program files (x86)\origin games\fifa world\fifaworld.exe] => (Allow) C:\program files (x86)\origin games\fifa world\fifaworld.exe
FirewallRules: [{808E54F2-92A1-4593-B7D5-2333BE8EA33C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Child of Light\ChildofLight.exe
FirewallRules: [{0A01DEEB-A87D-4029-B61D-1362806787B1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Child of Light\ChildofLight.exe
FirewallRules: [TCP Query User{BFE7B03A-F5D9-416A-A907-5EC51B9E57F1}C:\games\world_of_warships\wowslauncher.exe] => (Allow) C:\games\world_of_warships\wowslauncher.exe
FirewallRules: [UDP Query User{B28FDFB6-C249-4B97-B449-403B3B162193}C:\games\world_of_warships\wowslauncher.exe] => (Allow) C:\games\world_of_warships\wowslauncher.exe
FirewallRules: [{09C98A9E-2A60-414B-801F-4E845960F1FB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{D7CA39BD-CD69-41FF-B30A-880417DBC776}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/13/2015 03:17:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.5.5.0, Zeitstempel: 0x5060e311
Name des fehlerhaften Moduls: fastprox.dll, Version: 6.3.9600.17415, Zeitstempel: 0x545040a9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000027063
ID des fehlerhaften Prozesses: 0xb20
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3
Vollständiger Name des fehlerhaften Pakets: ZeroConfigService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ZeroConfigService.exe5
Error: (07/09/2015 04:24:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: worldofwarships.exe, Version: 0.4.0.39698, Zeitstempel: 0x55987eb0
Name des fehlerhaften Moduls: MSVCR110.dll, Version: 11.0.51106.1, Zeitstempel: 0x5098858e
Ausnahmecode: 0xc0000409
Fehleroffset: 0x000a326c
ID des fehlerhaften Prozesses: 0x1638
Startzeit der fehlerhaften Anwendung: 0xworldofwarships.exe0
Pfad der fehlerhaften Anwendung: worldofwarships.exe1
Pfad des fehlerhaften Moduls: worldofwarships.exe2
Berichtskennung: worldofwarships.exe3
Vollständiger Name des fehlerhaften Pakets: worldofwarships.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: worldofwarships.exe5
Error: (07/08/2015 10:08:01 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen werden:
Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten
Speichertreibern, oder der Datenträger fehlt.
Das Programm FUSSBALL MANAGER 13 wurde wegen dieses Fehlers geschlossen.
Programm: FUSSBALL MANAGER 13
Datei:
Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1. Öffnen Sie die Datei erneut.
Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.
2.
Wenn Sie weiterhin nicht auf die Datei zugreifen können und
- diese sich im Netzwerk befindet,
dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann.
- diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.
3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht.
5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.
Zusätzliche Daten
Fehlerwert: 00000000
Datenträgertyp: 0
Error: (07/08/2015 10:08:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Manager13.exe, Version: 1.0.4.0, Zeitstempel: 0x026d3040
Name des fehlerhaften Moduls: Manager13.exe, Version: 1.0.4.0, Zeitstempel: 0x026d3040
Ausnahmecode: 0xc000001d
Fehleroffset: 0x014f5fb0
ID des fehlerhaften Prozesses: 0x2440
Startzeit der fehlerhaften Anwendung: 0xManager13.exe0
Pfad der fehlerhaften Anwendung: Manager13.exe1
Pfad des fehlerhaften Moduls: Manager13.exe2
Berichtskennung: Manager13.exe3
Vollständiger Name des fehlerhaften Pakets: Manager13.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Manager13.exe5
Error: (07/06/2015 04:43:33 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/04/2015 07:34:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: touchup.exe, Version: 4.2.0.0, Zeitstempel: 0x53ff9f1d
Name des fehlerhaften Moduls: Wpc.dll_unloaded, Version: 6.3.9600.17415, Zeitstempel: 0x54503e7c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000775a0
ID des fehlerhaften Prozesses: 0x2a74
Startzeit der fehlerhaften Anwendung: 0xtouchup.exe0
Pfad der fehlerhaften Anwendung: touchup.exe1
Pfad des fehlerhaften Moduls: touchup.exe2
Berichtskennung: touchup.exe3
Vollständiger Name des fehlerhaften Pakets: touchup.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: touchup.exe5
Error: (07/04/2015 07:34:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: touchup.exe, Version: 4.2.0.0, Zeitstempel: 0x53ff9f1d
Name des fehlerhaften Moduls: Wpc.dll_unloaded, Version: 6.3.9600.17415, Zeitstempel: 0x54503e7c
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x000775a0
ID des fehlerhaften Prozesses: 0x2a74
Startzeit der fehlerhaften Anwendung: 0xtouchup.exe0
Pfad der fehlerhaften Anwendung: touchup.exe1
Pfad des fehlerhaften Moduls: touchup.exe2
Berichtskennung: touchup.exe3
Vollständiger Name des fehlerhaften Pakets: touchup.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: touchup.exe5
Error: (07/01/2015 02:12:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: eu4.exe, Version: 1.0.0.0, Zeitstempel: 0x55827896
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000e5624
ID des fehlerhaften Prozesses: 0x1204
Startzeit der fehlerhaften Anwendung: 0xeu4.exe0
Pfad der fehlerhaften Anwendung: eu4.exe1
Pfad des fehlerhaften Moduls: eu4.exe2
Berichtskennung: eu4.exe3
Vollständiger Name des fehlerhaften Pakets: eu4.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: eu4.exe5
Error: (07/01/2015 12:01:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: eu4.exe, Version: 1.0.0.0, Zeitstempel: 0x55827896
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000e5624
ID des fehlerhaften Prozesses: 0x2310
Startzeit der fehlerhaften Anwendung: 0xeu4.exe0
Pfad der fehlerhaften Anwendung: eu4.exe1
Pfad des fehlerhaften Moduls: eu4.exe2
Berichtskennung: eu4.exe3
Vollständiger Name des fehlerhaften Pakets: eu4.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: eu4.exe5
Error: (06/30/2015 01:16:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Hearthstone Deck Tracker.exe, Version: 0.1.0.0, Zeitstempel: 0x5577c676
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54504ade
Ausnahmecode: 0xe0434352
Fehleroffset: 0x00014598
ID des fehlerhaften Prozesses: 0xb14
Startzeit der fehlerhaften Anwendung: 0xHearthstone Deck Tracker.exe0
Pfad der fehlerhaften Anwendung: Hearthstone Deck Tracker.exe1
Pfad des fehlerhaften Moduls: Hearthstone Deck Tracker.exe2
Berichtskennung: Hearthstone Deck Tracker.exe3
Vollständiger Name des fehlerhaften Pakets: Hearthstone Deck Tracker.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Hearthstone Deck Tracker.exe5
System errors:
=============
Error: (07/13/2015 03:17:47 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/13/2015 03:16:46 AM) (Source: bowser) (EventID: 8016) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "O2BOX" zum Namen "PETRA" auf Transport "NetBT_Tcpip_{9A34807A-9833-43AC-A876-5346935872C5}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
Error: (07/13/2015 03:14:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel® Centrino® Wireless Bluetooth® + High Speed Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (07/13/2015 03:14:09 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
Error: (07/13/2015 03:14:08 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
Error: (07/13/2015 03:14:02 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
Error: (07/13/2015 03:13:57 AM) (Source: DCOM) (EventID: 10010) (User: petra)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (07/13/2015 03:13:52 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (07/13/2015 03:13:28 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Bluetooth OBEX Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/13/2015 03:13:28 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Microsoft Office-Klick-und-Los-Dienst" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office:
=========================
Error: (07/13/2015 03:17:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe15.5.5.05060e311fastprox.dll6.3.9600.17415545040a9c00000050000000000027063b2001d0bd098c6c1838C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\WINDOWS\system32\wbem\fastprox.dlle02c7fe2-28fc-11e5-bec0-6036dd1bb9c0
Error: (07/09/2015 04:24:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: worldofwarships.exe0.4.0.3969855987eb0MSVCR110.dll11.0.51106.15098858ec0000409000a326c163801d0ba52f4ef9013C:\Games\World_of_Warships\worldofwarships.exeC:\Games\World_of_Warships\MSVCR110.dll3c5e6066-2646-11e5-bebf-6036dd1bb9c0
Error: (07/08/2015 10:08:01 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: FUSSBALL MANAGER 13000000000
Error: (07/08/2015 10:08:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Manager13.exe1.0.4.0026d3040Manager13.exe1.0.4.0026d3040c000001d014f5fb0244001d0b9b9c2509851C:\Program Files (x86)\Origin Games\FIFA Manager 13\Manager13.exeC:\Program Files (x86)\Origin Games\FIFA Manager 13\Manager13.exe086f47a9-25ad-11e5-bebf-6036dd1bb9c0
Error: (07/06/2015 04:43:33 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8
Error: (07/04/2015 07:34:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: touchup.exe4.2.0.053ff9f1dWpc.dll_unloaded6.3.9600.1741554503e7cc0000005000775a02a7401d0b67f3a9122deC:\PROGRA~2\ORIGIN~1\FIFAWO~1\__INST~1\touchup.exeWpc.dllf8638b12-2272-11e5-bebe-6036dd1bb9c0
Error: (07/04/2015 07:34:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: touchup.exe4.2.0.053ff9f1dWpc.dll_unloaded6.3.9600.1741554503e7cc00001a5000775a02a7401d0b67f3a9122deC:\PROGRA~2\ORIGIN~1\FIFAWO~1\__INST~1\touchup.exeWpc.dllf5df0a91-2272-11e5-bebe-6036dd1bb9c0
Error: (07/01/2015 02:12:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: eu4.exe1.0.0.055827896ntdll.dll6.3.9600.17736550f42c2c0000374000e5624120401d0b380430ef16fC:\Program Files (x86)\Steam\steamapps\common\Europa Universalis IV\eu4.exeC:\WINDOWS\SYSTEM32\ntdll.dlld2896fc3-1f85-11e5-bebe-6036dd1bb9c0
Error: (07/01/2015 12:01:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: eu4.exe1.0.0.055827896ntdll.dll6.3.9600.17736550f42c2c0000374000e5624231001d0b3774adf7abdC:\Program Files (x86)\Steam\steamapps\common\Europa Universalis IV\eu4.exeC:\WINDOWS\SYSTEM32\ntdll.dll7d6f7c7e-1f73-11e5-bebe-6036dd1bb9c0
Error: (06/30/2015 01:16:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Hearthstone Deck Tracker.exe0.1.0.05577c676KERNELBASE.dll6.3.9600.1741554504adee043435200014598b1401d0b326428cf8edC:\Users\1973pl\Desktop\Hearthstone Deck Tracker.exeC:\WINDOWS\SYSTEM32\KERNELBASE.dll804d7fd5-1f19-11e5-bebe-6036dd1bb9c0
CodeIntegrity Errors:
===================================
Date: 2015-04-10 07:17:35.821
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\ProgramData\Microsoft\Windows Defender\Definition Updates\{04C46EBC-B7CE-454D-8615-5FC1CE0B25E9}\mpengine.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-04-10 07:17:29.258
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\ProgramData\Microsoft\Windows Defender\Definition Updates\{A7A86FCE-9180-45AE-9C6A-39F0C2694610}\mpengine.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-3110M CPU @ 2.40GHz
Percentage of memory in use: 30%
Total physical RAM: 8072.9 MB
Available physical RAM: 5624.41 MB
Total Virtual: 9352.9 MB
Available Virtual: 6800.33 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:869.36 GB) (Free:707 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:40.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 462A80D0)
Partition: GPT Partition Type.
==================== End of log ============================
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 13.07.2015 Suchlaufzeit: 02:46 Protokolldatei: h.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.07.12.04 Rootkit-Datenbank: v2015.07.10.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: 1973pl Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 398893 Abgelaufene Zeit: 23 Min., 31 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) |
|
13.07.2015, 06:37
| #2 |
| /// the machine /// TB-Ausbilder    | Programm "Pokki" hi,
__________________Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
13.07.2015, 07:31
| #3 |
| | Programm "Pokki" Hallo schrauber,
__________________bist du dir ganz sicher,dass Rocket League runter muss?Dies ist ein Spiel auf Steam und sollte eigentlich nicht gefährlich sein.Pokki kam auf mein Rechner als ich mir "Pixta" (Insagram für den PC) runterladen wollte.Hätte ich vielleicht hinzuschreiben sollen,Sorry.Ich habe dennoch mal die RocketLeageu exe bei Virustotal prüfen lassen. MfG Croatis https://www.virustotal.com/de/file/edc8b05445de37855156b93f03b3f8856a3a4523fae23537965924bb665815c6/analysis/1436768450/ Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.4.6 (07.12.2015:2)
OS: Windows 8.1 x64
Ran by 1973pl on 13.07.2015 at 8:25:33,66
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Chrome
[C:\Users\1973pl\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\1973pl\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\1973pl\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\1973pl\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.07.2015 at 8:28:41,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:12-07-2015
Ran by 1973pl (administrator) on PETRA on 13-07-2015 08:29:56
Running from C:\Users\1973pl\Desktop
Loaded Profiles: 1973pl (Available Profiles: UpdatusUser & 1973pl)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.5952\Battle.net.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.4150\Agent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe
HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-05] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3632112 2015-07-05] (Electronic Arts)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [28785792 2015-06-02] (Skype Technologies S.A.)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Akamai NetSession Interface] => C:\Users\1973pl\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk [2012-11-21]
ShortcutTarget: TMMonitor.lnk -> C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\TMTV5Monitor.exe (ArcSoft, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-24] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-24] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{9A34807A-9833-43AC-A876-5346935872C5}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D93110B3-007B-4A4A-8BAC-33DF59D2732D}: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_203.dll [2015-07-08] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_203.dll [2015-07-08] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-24] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-02-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Extension: Avira Browser Safety - C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default\Extensions\abs@avira.com [2015-07-02]
FF Extension: Adblock Plus - C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-13]
Chrome:
=======
CHR Profile: C:\Users\1973pl\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
S2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] () [File not signed]
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-07-05] (Electronic Arts)
S2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-04-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-04-10] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-30] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-11-21] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [44296 2015-03-30] (LogMeIn Inc.)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-11-14] (ITE )
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-04-10] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-11-21] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-13 08:28 - 2015-07-13 08:28 - 00001053 _____ C:\Users\1973pl\Desktop\JRT.txt
2015-07-13 08:25 - 2015-07-13 08:25 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-PETRA-Windows-8.1-(64-bit).dat
2015-07-13 08:25 - 2015-07-13 08:25 - 00000000 ____D C:\RegBackup
2015-07-13 08:22 - 2015-07-13 08:22 - 03034492 _____ (Malwarebytes Corporation) C:\Users\1973pl\Downloads\JRT.exe
2015-07-13 03:28 - 2015-07-13 03:28 - 00001193 _____ C:\Users\1973pl\Desktop\h.txt
2015-07-13 03:26 - 2015-07-13 03:27 - 00052709 _____ C:\Users\1973pl\Desktop\Addition.txt
2015-07-13 03:25 - 2015-07-13 08:29 - 00013619 _____ C:\Users\1973pl\Desktop\FRST.txt
2015-07-13 03:25 - 2015-07-13 03:25 - 00000000 ____D C:\Users\1973pl\Desktop\FRST-OlderVersion
2015-07-13 02:51 - 2015-07-13 03:02 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2015-07-13 02:51 - 2015-07-13 02:51 - 00000000 ____D C:\Users\1973pl\AppData\Local\Bluestacks
2015-07-13 02:44 - 2015-07-13 02:44 - 02248704 _____ C:\Users\1973pl\Downloads\AdwCleaner_4.208.exe
2015-07-10 20:10 - 2015-07-13 04:43 - 00003922 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{C738C1A3-886C-4436-98D0-E63BBECD72AA}
2015-07-08 23:50 - 2015-07-08 23:50 - 00000000 ____D C:\Users\1973pl\AppData\Local\HackRUN
2015-07-08 23:28 - 2015-07-08 23:28 - 00000811 _____ C:\Users\1973pl\Desktop\World of Warships.lnk
2015-07-08 23:28 - 2015-07-08 23:28 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Warships
2015-07-08 23:28 - 2015-07-08 23:28 - 00000000 ____D C:\Games
2015-07-08 23:27 - 2015-07-08 23:28 - 06949352 _____ (Wargaming.net ) C:\Users\1973pl\Downloads\WoWS_internet_install_eu.exe
2015-07-06 02:24 - 2015-07-06 02:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-06 00:21 - 2015-07-06 00:39 - 439121981 _____ C:\Users\1973pl\Desktop\Hearthstone 1.mp4
2015-07-05 23:11 - 2015-07-05 23:43 - 936866391 _____ C:\Users\1973pl\Desktop\Child of Light4.mp4
2015-07-05 05:24 - 2015-07-05 05:55 - 854570131 _____ C:\Users\1973pl\Desktop\Child of Light 3.mp4
2015-07-05 02:45 - 2015-07-05 03:13 - 663713860 _____ C:\Users\1973pl\Desktop\Child of Light 2.mp4
2015-07-05 01:40 - 2015-07-05 02:10 - 620172748 _____ C:\Users\1973pl\Desktop\Child of Light 1.mp4
2015-07-04 21:57 - 2015-07-04 21:57 - 00000000 ____D C:\Users\1973pl\Documents\FIFA World
2015-06-30 21:34 - 2015-06-30 22:11 - 1062846947 _____ C:\Users\1973pl\Desktop\EU 4 2.mp4
2015-06-30 19:12 - 2015-06-30 19:12 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2015-06-30 02:18 - 2015-07-05 15:11 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\HearthstoneDeckTracker
2015-06-30 02:17 - 2015-06-30 02:17 - 00000000 ____D C:\Users\1973pl\Documents\Hearthstone.Deck.Tracker-v0.10.6
2015-06-30 02:02 - 2015-07-06 00:39 - 00111104 ___SH C:\Users\1973pl\Desktop\Thumbs.db
2015-06-30 01:58 - 2015-06-30 01:58 - 00000098 _____ C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-06-30 01:58 - 2015-06-30 01:58 - 00000000 ____D C:\Users\1973pl\AppData\Local\HearthstoneTracker
2015-06-28 20:36 - 2015-06-28 20:36 - 00001209 _____ C:\Users\Public\Desktop\Play Euro Truck Simulator 2 Multiplayer.lnk
2015-06-27 16:31 - 2015-06-27 16:31 - 00000242 _____ C:\Users\1973pl\Desktop\2.Bundesliga Tipps.txt
2015-06-27 09:39 - 2015-06-28 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Euro Truck Simulator 2 Multiplayer
2015-06-27 09:39 - 2015-06-28 20:36 - 00000000 ____D C:\Program Files (x86)\Euro Truck Simulator 2 Multiplayer
2015-06-27 09:39 - 2015-06-27 09:41 - 00000000 ____D C:\Users\1973pl\Documents\ETS2MP
2015-06-26 16:28 - 2015-06-26 16:28 - 00000214 _____ C:\Users\1973pl\Desktop\1.Bundesliga Tipps.txt
2015-06-25 19:45 - 2015-06-25 19:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-24 14:42 - 2015-06-24 14:44 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\1973pl\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-24 08:03 - 2015-06-24 08:04 - 00000000 ____D C:\Users\1973pl\Documents\Rayman Legends
2015-06-24 07:52 - 2015-06-24 08:03 - 00000000 ____D C:\Users\1973pl\AppData\Local\Ubisoft Game Launcher
2015-06-24 07:52 - 2015-06-24 07:52 - 00001225 _____ C:\Users\1973pl\Desktop\Uplay.lnk
2015-06-24 07:52 - 2015-06-24 07:52 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-06-24 07:51 - 2015-06-24 07:51 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2015-06-23 16:57 - 2015-06-23 16:57 - 02244096 _____ C:\Users\1973pl\Downloads\AdwCleaner_4.207.exe
2015-06-21 03:12 - 2015-06-21 03:12 - 00000000 ____D C:\Users\1973pl\Documents\KillHouseGames
2015-06-19 16:41 - 2015-06-19 16:41 - 00000000 ____D C:\Users\1973pl\Documents\Klei
2015-06-17 10:41 - 2015-06-17 10:41 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Shooter
2015-06-15 22:29 - 2015-06-27 14:45 - 00000000 ____D C:\Mathelehrer Simulator 2014
2015-06-15 22:29 - 2015-06-15 22:29 - 00000759 _____ C:\Users\Public\Desktop\Mathelehrer Simulator 2014.lnk
2015-06-15 22:29 - 2015-06-15 22:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mathelehrer Simulator 2014
2015-06-15 22:27 - 2015-06-15 22:28 - 06053004 _____ (PeDePe ) C:\Users\1973pl\Downloads\Mathelehrer_Setup.exe
2015-06-15 20:31 - 2015-06-15 20:31 - 00000000 ____D C:\Users\1973pl\Documents\Telltale Games
2015-06-14 20:40 - 2015-06-14 20:40 - 00466456 _____ (Creative Labs) C:\WINDOWS\system32\wrap_oal.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00444952 _____ (Creative Labs) C:\WINDOWS\SysWOW64\wrap_oal.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00122904 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\system32\OpenAL32.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00109080 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\WINDOWS\SysWOW64\OpenAL32.dll
2015-06-14 20:40 - 2015-06-14 20:40 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Waveform
2015-06-14 20:40 - 2015-06-14 20:40 - 00000000 ____D C:\Program Files (x86)\OpenAL
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-13 08:29 - 2015-05-05 00:12 - 00000000 ____D C:\FRST
2015-07-13 08:26 - 2015-04-08 07:31 - 00000000 ____D C:\Users\1973pl\AppData\Local\Battle.net
2015-07-13 08:21 - 2015-04-10 06:38 - 01795581 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-13 08:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-07-13 07:33 - 2014-06-14 23:31 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-07-13 03:27 - 2014-05-13 14:39 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-07-13 03:25 - 2015-05-05 00:07 - 02133504 _____ (Farbar) C:\Users\1973pl\Desktop\FRST64.exe
2015-07-13 03:22 - 2015-04-21 15:24 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Skype
2015-07-13 03:20 - 2013-08-18 20:52 - 00000000 ____D C:\Users\1973pl\Documents\Youcam
2015-07-13 03:18 - 2015-04-09 00:16 - 00000000 ____D C:\ProgramData\Origin
2015-07-13 03:18 - 2015-04-08 08:54 - 00000000 ____D C:\Program Files (x86)\Steam
2015-07-13 03:15 - 2013-08-22 16:46 - 00334360 _____ C:\WINDOWS\setupact.log
2015-07-13 03:15 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-07-13 03:13 - 2015-04-08 09:13 - 00000000 ____D C:\AdwCleaner
2015-07-12 12:31 - 2015-04-08 17:30 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\TS3Client
2015-07-12 12:18 - 2015-04-16 15:03 - 00000000 ____D C:\Users\1973pl\AppData\Local\Ori and the Blind Forest
2015-07-10 22:50 - 2015-05-06 15:15 - 00000000 ____D C:\Users\1973pl\Documents\My Games
2015-07-10 19:50 - 2015-04-28 03:16 - 00000000 ____D C:\ProgramData\Riot Games
2015-07-10 06:10 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-07-10 06:05 - 2013-08-18 20:56 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1766157453-2088857509-2423560725-1002
2015-07-08 22:38 - 2014-06-14 23:31 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-07-06 23:24 - 2014-11-21 13:01 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-07-06 23:24 - 2014-11-21 13:01 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-06 18:14 - 2015-04-16 07:14 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\OBS
2015-07-06 12:44 - 2015-06-11 01:09 - 00001140 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-06 04:20 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-07-06 02:49 - 2015-02-26 22:18 - 00001122 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-06 02:49 - 2015-02-26 22:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-06 02:49 - 2015-02-26 22:18 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-06 02:29 - 2014-11-20 20:24 - 00014598 _____ C:\WINDOWS\PFRO.log
2015-07-06 02:29 - 2014-05-13 14:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-06 02:28 - 2015-04-10 06:50 - 00000000 ____D C:\Users\1973pl
2015-07-06 02:28 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-07-06 00:50 - 2015-04-09 01:00 - 00000000 ____D C:\Program Files (x86)\Origin Games
2015-07-05 19:06 - 2015-04-09 00:16 - 00000000 ____D C:\Program Files (x86)\Origin
2015-07-04 21:56 - 2012-11-14 09:25 - 00139780 _____ C:\WINDOWS\DirectX.log
2015-07-03 20:26 - 2015-04-29 02:03 - 00000000 ____D C:\Users\1973pl\Documents\Euro Truck Simulator 2
2015-07-01 04:32 - 2015-04-08 07:36 - 00000000 ____D C:\Program Files (x86)\Heroes of the Storm
2015-06-29 21:59 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-06-29 20:41 - 2015-04-08 07:30 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-06-29 12:40 - 2015-04-09 01:01 - 00000000 ____D C:\Users\1973pl\AppData\Local\Adobe
2015-06-29 12:29 - 2013-08-22 16:44 - 00368792 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-06-29 12:22 - 2014-12-16 13:23 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-06-29 12:22 - 2014-11-21 12:51 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-06-29 12:22 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-06-29 12:22 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-06-29 12:21 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Avira
2015-06-28 17:07 - 2015-04-21 15:24 - 00000000 ____D C:\ProgramData\Skype
2015-06-26 04:22 - 2015-02-22 18:45 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-18 08:42 - 2015-02-26 22:18 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-06-18 08:41 - 2015-02-26 22:18 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-06-18 08:41 - 2014-05-13 14:37 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-06-15 20:39 - 2015-04-23 19:43 - 00000000 ____D C:\Program Files (x86)\Hearthstone
==================== Files in the root of some directories =======
2012-11-14 10:19 - 2012-11-14 10:19 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-06-30 01:58 - 2015-06-30 01:58 - 0000098 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
Some files in TEMP:
====================
C:\Users\1973pl\AppData\Local\Temp\27fff54a706caf16275619fa9b79269c.dll
C:\Users\1973pl\AppData\Local\Temp\avgnt.exe
C:\Users\1973pl\AppData\Local\Temp\Quarantine.exe
C:\Users\1973pl\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-13 04:10
==================== End of log =========================
|
|
13.07.2015, 16:55
| #4 |
| /// the machine /// TB-Ausbilder | Programm "Pokki" Ist als Adware-Schleuder geflaggt, daher die Auflistung  ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.07.2015, 09:21
| #5 |
| | Programm "Pokki"Code:
ATTFilter Results of screen317's Security Check version 1.004
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus
Windows Defender
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 51
Java version 32-bit out of Date!
Adobe Flash Player 18.0.0.209
Mozilla Firefox (39.0)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
Code:
ATTFilter # compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 6599641 66820877 0 0
# scanned=268559
# found=3
# cleaned=3
# scan_time=8719
sh=16EA32333E70AC8C516FA3867B521AE714EFAFB2 ft=1 fh=c71c0011c84760bd vn="Win32/Somoto.O evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Minibar\Minibar.dll.vir"
sh=246DDBC3A2C223A6B9072637D93DC2A2832D097A ft=1 fh=c71c0011b04f613a vn="Win32/Toolbar.Babylon.Y evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\ProgramData\DSearchLink\DSearchLink.exe.vir"
sh=76039D5A64EF897B1AA388EED70452774019DB59 ft=1 fh=890f56b03e669e11 vn="Win32/Somoto.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\1973pl\AppData\Local\FilesFrog Update Checker\update_checker.exe.vir"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=4f2c52111ecf2340a3e44773c4d94c7e
# end=init
# utc_time=2015-07-17 10:49:45
# local_time=2015-07-18 12:49:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
Update Init
Update Download
Update Finalize
Updated modules version: 24860
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=4f2c52111ecf2340a3e44773c4d94c7e
# end=updated
# utc_time=2015-07-17 11:00:45
# local_time=2015-07-18 01:00:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.2.9200 NT
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=4f2c52111ecf2340a3e44773c4d94c7e
# engine=24860
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-18 01:16:16
# local_time=2015-07-18 03:16:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 7457881 10055642 0 0
# scanned=421736
# found=0
# cleaned=0
# scan_time=8130
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:12-07-2015
Ran by 1973pl (administrator) on PETRA on 18-07-2015 10:08:46
Running from C:\Users\1973pl\Desktop
Loaded Profiles: UpdatusUser & 1973pl (Available Profiles: UpdatusUser & 1973pl)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
() C:\Program Files (x86)\PHotkey\Atouch64.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Akamai Technologies, Inc.) C:\Users\1973pl\AppData\Local\Akamai\netsession_win.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\TMTV5Monitor.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Akamai Technologies, Inc.) C:\Users\1973pl\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.4150\Agent.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.5952\Battle.net.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_209.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_209.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe
HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-05] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258576 2012-07-30] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-1766157453-2088857509-2423560725-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-11-21] (Microsoft Corporation)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3632112 2015-07-05] (Electronic Arts)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53282944 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\...\Run: [Akamai NetSession Interface] => C:\Users\1973pl\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk [2012-11-21]
ShortcutTarget: TMMonitor.lnk -> C:\Program Files (x86)\ArcSoft\ArcSoft TV 5.0\TMTV5Monitor.exe (ArcSoft, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1766157453-2088857509-2423560725-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1766157453-2088857509-2423560725-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-07-15] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-15] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{9A34807A-9833-43AC-A876-5346935872C5}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D93110B3-007B-4A4A-8BAC-33DF59D2732D}: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-15] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-15] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-15] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-15] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-02-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Extension: Avira Browser Safety - C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default\Extensions\abs@avira.com [2015-07-02]
FF Extension: Adblock Plus - C:\Users\1973pl\AppData\Roaming\Mozilla\Firefox\Profiles\xsi7weyq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-13]
Chrome:
=======
CHR Profile: C:\Users\1973pl\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [805888 2012-11-29] () [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-09-24] ()
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-07-05] (Electronic Arts)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2012-10-19] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-04-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-04-10] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [1153840 2012-09-24] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-30] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-11-21] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1337216 2012-10-01] (Motorola Solutions, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [44296 2015-03-30] (LogMeIn Inc.)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2012-11-14] (ITE )
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-04-10] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-11-21] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-18 10:08 - 2015-07-18 10:08 - 00017447 _____ C:\Users\1973pl\Desktop\FRST.txt
2015-07-18 10:04 - 2015-07-18 10:04 - 00852662 _____ C:\Users\1973pl\Downloads\SecurityCheck.exe
2015-07-18 00:46 - 2015-07-18 00:48 - 02870984 _____ (ESET) C:\Users\1973pl\Downloads\esetsmartinstaller_deu.exe
2015-07-15 05:56 - 2015-07-15 05:56 - 00563296 _____ (Oracle Corporation) C:\Users\1973pl\Downloads\jre-8u51-windows-i586-iftw.exe
2015-07-14 20:28 - 2015-07-09 21:51 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-07-14 20:28 - 2015-07-09 20:40 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
2015-07-14 20:28 - 2015-07-09 18:03 - 03701760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-07-14 20:28 - 2015-07-09 17:54 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-07-14 20:28 - 2015-07-09 17:53 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-07-14 20:28 - 2015-07-09 17:50 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-07-14 20:28 - 2015-07-09 17:50 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-07-14 20:28 - 2015-07-09 17:48 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-07-14 20:28 - 2015-07-09 17:46 - 02229248 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-07-14 20:28 - 2015-07-09 17:38 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-07-14 20:28 - 2015-07-09 17:37 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-07-14 20:28 - 2015-07-09 17:35 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-07-14 20:28 - 2015-07-09 17:34 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-07-14 20:28 - 2015-06-27 05:08 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2015-07-14 20:28 - 2015-06-27 05:08 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-07-14 20:28 - 2015-06-27 04:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2015-07-14 20:27 - 2015-07-03 15:52 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-07-14 20:27 - 2015-07-03 15:52 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-07-14 20:27 - 2015-07-03 15:50 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-07-14 20:27 - 2015-07-03 15:50 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-07-14 20:27 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-07-14 20:27 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-07-14 20:27 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-07-14 20:27 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-07-14 20:27 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-07-14 20:27 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-07-14 20:27 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-07-14 20:27 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-07-14 20:27 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-07-14 20:27 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-07-14 20:27 - 2015-06-30 00:43 - 00026288 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-07-14 20:27 - 2015-06-29 17:07 - 01145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-07-14 20:27 - 2015-06-29 17:07 - 01084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-07-14 20:27 - 2015-06-29 17:07 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-07-14 20:27 - 2015-06-29 17:07 - 00433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-07-14 20:27 - 2015-06-29 17:07 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-07-14 20:27 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2015-07-14 20:27 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-07-14 20:27 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2015-07-14 20:27 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2015-07-14 20:27 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2015-07-14 20:27 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2015-07-14 20:27 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2015-07-14 20:27 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb10.sys
2015-07-14 20:27 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-07-14 20:27 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-07-14 20:27 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-07-14 20:27 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-07-14 20:27 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-07-14 20:27 - 2015-06-27 01:21 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-07-14 20:27 - 2015-06-27 01:21 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-07-14 20:27 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-07-14 20:27 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2015-07-14 20:27 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2015-07-14 20:27 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2015-07-14 20:27 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2015-07-14 20:27 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-07-14 20:27 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-07-14 20:27 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-07-14 20:27 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-07-14 20:27 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-07-14 20:27 - 2015-05-11 20:17 - 01201664 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2015-07-14 20:27 - 2015-05-07 19:50 - 22292672 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-07-14 20:27 - 2015-05-07 19:00 - 03109376 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2015-07-14 20:27 - 2015-05-07 18:53 - 19734960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-07-14 20:27 - 2015-05-07 18:12 - 02706432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2015-07-14 20:27 - 2015-05-07 17:21 - 00522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\GeofenceMonitorService.dll
2015-07-14 20:27 - 2015-05-07 17:05 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GeofenceMonitorService.dll
2015-07-14 20:27 - 2015-05-03 17:09 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-14 20:27 - 2015-05-03 16:58 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-07-14 20:27 - 2015-05-03 16:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2015-07-14 20:27 - 2015-05-03 16:49 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2015-07-14 20:27 - 2015-05-03 02:39 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-07-14 20:27 - 2015-04-30 01:22 - 00130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2015-07-14 20:27 - 2015-04-25 04:25 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usb8023.sys
2015-07-14 20:27 - 2014-11-04 21:25 - 00059712 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdclass.sys
2015-07-14 20:27 - 2014-11-04 21:25 - 00051008 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouclass.sys
2015-07-14 20:27 - 2014-11-04 08:55 - 00026112 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sermouse.sys
2015-07-14 20:27 - 2014-11-04 08:54 - 00108544 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\i8042prt.sys
2015-07-14 20:27 - 2014-11-04 08:54 - 00032256 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\kbdhid.sys
2015-07-14 20:27 - 2014-11-04 08:54 - 00030208 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mouhid.sys
2015-07-14 20:26 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-07-14 20:26 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-07-14 20:26 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-07-14 20:26 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-07-14 20:26 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2015-07-14 20:26 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2015-07-14 20:26 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-07-14 20:26 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-07-14 20:26 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-07-14 20:26 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-07-14 20:26 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-07-14 20:26 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-07-14 20:26 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-07-14 20:26 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-07-14 20:26 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-07-14 20:26 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-07-14 20:26 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-07-14 20:26 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-07-14 20:26 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-07-14 20:26 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-07-14 20:26 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2015-07-14 20:26 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2015-07-14 20:26 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-07-14 20:26 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-07-14 20:26 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-07-14 20:26 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-07-14 20:26 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-07-14 20:26 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-07-14 20:26 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-07-14 20:26 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-07-14 20:26 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-07-14 20:26 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-07-14 20:26 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-07-14 20:26 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-07-14 20:26 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-07-14 20:26 - 2015-05-12 15:19 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2015-07-14 20:26 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\SysWOW64\locale.nls
2015-07-14 20:26 - 2015-04-28 15:13 - 00513480 _____ C:\WINDOWS\system32\locale.nls
2015-07-14 20:25 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2015-07-14 20:25 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2015-07-14 20:25 - 2015-05-11 18:34 - 00332800 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcpl.dll
2015-07-14 20:25 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\apphelp.dll
2015-07-14 20:25 - 2015-05-03 17:07 - 07784448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2015-07-14 20:25 - 2015-05-03 16:57 - 05264384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2015-07-14 20:25 - 2015-05-02 01:33 - 00410739 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-07-14 20:24 - 2015-04-23 17:47 - 03084288 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-07-14 20:24 - 2015-04-23 17:16 - 02471424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-07-13 10:19 - 2015-07-13 10:19 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2015-07-13 08:28 - 2015-07-13 08:28 - 00001053 _____ C:\Users\1973pl\Desktop\JRT.txt
2015-07-13 08:25 - 2015-07-13 08:25 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-PETRA-Windows-8.1-(64-bit).dat
2015-07-13 08:25 - 2015-07-13 08:25 - 00000000 ____D C:\RegBackup
2015-07-13 08:22 - 2015-07-13 08:22 - 03034492 _____ (Malwarebytes Corporation) C:\Users\1973pl\Downloads\JRT.exe
2015-07-13 03:25 - 2015-07-13 03:25 - 00000000 ____D C:\Users\1973pl\Desktop\FRST-OlderVersion
2015-07-13 02:51 - 2015-07-13 03:02 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2015-07-13 02:51 - 2015-07-13 02:51 - 00000000 ____D C:\Users\1973pl\AppData\Local\Bluestacks
2015-07-13 02:44 - 2015-07-13 02:44 - 02248704 _____ C:\Users\1973pl\Downloads\AdwCleaner_4.208.exe
2015-07-10 20:10 - 2015-07-18 04:25 - 00003922 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{C738C1A3-886C-4436-98D0-E63BBECD72AA}
2015-07-08 23:50 - 2015-07-08 23:50 - 00000000 ____D C:\Users\1973pl\AppData\Local\HackRUN
2015-07-08 23:28 - 2015-07-08 23:28 - 00000811 _____ C:\Users\1973pl\Desktop\World of Warships.lnk
2015-07-08 23:28 - 2015-07-08 23:28 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Warships
2015-07-08 23:28 - 2015-07-08 23:28 - 00000000 ____D C:\Games
2015-07-08 23:27 - 2015-07-08 23:28 - 06949352 _____ (Wargaming.net ) C:\Users\1973pl\Downloads\WoWS_internet_install_eu.exe
2015-07-06 02:24 - 2015-07-06 02:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-06 00:21 - 2015-07-06 00:39 - 439121981 _____ C:\Users\1973pl\Desktop\Hearthstone 1.mp4
2015-07-05 23:11 - 2015-07-05 23:43 - 936866391 _____ C:\Users\1973pl\Desktop\Child of Light4.mp4
2015-07-05 05:24 - 2015-07-05 05:55 - 854570131 _____ C:\Users\1973pl\Desktop\Child of Light 3.mp4
2015-07-05 02:45 - 2015-07-05 03:13 - 663713860 _____ C:\Users\1973pl\Desktop\Child of Light 2.mp4
2015-07-05 01:40 - 2015-07-05 02:10 - 620172748 _____ C:\Users\1973pl\Desktop\Child of Light 1.mp4
2015-07-04 21:57 - 2015-07-04 21:57 - 00000000 ____D C:\Users\1973pl\Documents\FIFA World
2015-06-30 21:34 - 2015-06-30 22:11 - 1062846947 _____ C:\Users\1973pl\Desktop\EU 4 2.mp4
2015-06-30 19:12 - 2015-06-30 19:12 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2015-06-30 02:18 - 2015-07-05 15:11 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\HearthstoneDeckTracker
2015-06-30 02:17 - 2015-06-30 02:17 - 00000000 ____D C:\Users\1973pl\Documents\Hearthstone.Deck.Tracker-v0.10.6
2015-06-30 02:02 - 2015-07-06 00:39 - 00111104 ___SH C:\Users\1973pl\Desktop\Thumbs.db
2015-06-30 01:58 - 2015-06-30 01:58 - 00000098 _____ C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2015-06-30 01:58 - 2015-06-30 01:58 - 00000000 ____D C:\Users\1973pl\AppData\Local\HearthstoneTracker
2015-06-28 20:36 - 2015-06-28 20:36 - 00001209 _____ C:\Users\Public\Desktop\Play Euro Truck Simulator 2 Multiplayer.lnk
2015-06-27 16:31 - 2015-06-27 16:31 - 00000242 _____ C:\Users\1973pl\Desktop\2.Bundesliga Tipps.txt
2015-06-27 09:39 - 2015-06-28 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Euro Truck Simulator 2 Multiplayer
2015-06-27 09:39 - 2015-06-28 20:36 - 00000000 ____D C:\Program Files (x86)\Euro Truck Simulator 2 Multiplayer
2015-06-27 09:39 - 2015-06-27 09:41 - 00000000 ____D C:\Users\1973pl\Documents\ETS2MP
2015-06-26 16:28 - 2015-06-26 16:28 - 00000214 _____ C:\Users\1973pl\Desktop\1.Bundesliga Tipps.txt
2015-06-25 19:45 - 2015-06-25 19:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-24 14:42 - 2015-06-24 14:44 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\1973pl\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-24 08:03 - 2015-06-24 08:04 - 00000000 ____D C:\Users\1973pl\Documents\Rayman Legends
2015-06-24 07:52 - 2015-06-24 08:03 - 00000000 ____D C:\Users\1973pl\AppData\Local\Ubisoft Game Launcher
2015-06-24 07:52 - 2015-06-24 07:52 - 00001225 _____ C:\Users\1973pl\Desktop\Uplay.lnk
2015-06-24 07:52 - 2015-06-24 07:52 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-06-24 07:51 - 2015-06-24 07:51 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2015-06-23 16:57 - 2015-06-23 16:57 - 02244096 _____ C:\Users\1973pl\Downloads\AdwCleaner_4.207.exe
2015-06-21 03:12 - 2015-06-21 03:12 - 00000000 ____D C:\Users\1973pl\Documents\KillHouseGames
2015-06-19 16:41 - 2015-06-19 16:41 - 00000000 ____D C:\Users\1973pl\Documents\Klei
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-18 10:09 - 2015-04-08 07:31 - 00000000 ____D C:\Users\1973pl\AppData\Local\Battle.net
2015-07-18 10:08 - 2015-05-05 00:12 - 00000000 ____D C:\FRST
2015-07-18 10:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-07-18 09:47 - 2015-04-10 06:38 - 01653476 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-18 09:33 - 2014-06-14 23:31 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-07-18 04:05 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-07-17 22:09 - 2015-04-29 02:03 - 00000000 ____D C:\Users\1973pl\Documents\Euro Truck Simulator 2
2015-07-17 22:09 - 2015-04-08 17:30 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\TS3Client
2015-07-17 22:09 - 2015-04-08 08:54 - 00000000 ____D C:\Program Files (x86)\Steam
2015-07-17 09:58 - 2015-04-21 15:24 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\Skype
2015-07-17 09:57 - 2015-04-21 15:24 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-17 09:57 - 2015-04-21 15:24 - 00000000 ____D C:\ProgramData\Skype
2015-07-17 09:57 - 2013-08-18 20:52 - 00000000 ____D C:\Users\1973pl\Documents\Youcam
2015-07-17 09:55 - 2015-04-09 00:16 - 00000000 ____D C:\ProgramData\Origin
2015-07-17 09:53 - 2013-08-22 16:46 - 00334437 _____ C:\WINDOWS\setupact.log
2015-07-17 09:53 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-07-17 09:53 - 2013-08-22 16:44 - 00368792 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-07-17 09:51 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-07-17 09:49 - 2015-04-10 07:21 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-07-17 09:49 - 2015-04-10 07:21 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-07-17 09:49 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-07-17 09:49 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\WinStore
2015-07-17 00:12 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-07-16 21:40 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-07-15 09:04 - 2013-08-18 20:56 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1766157453-2088857509-2423560725-1002
2015-07-15 05:59 - 2015-05-24 22:55 - 00000000 ____D C:\ProgramData\Oracle
2015-07-15 05:59 - 2015-05-24 22:55 - 00000000 ____D C:\Program Files (x86)\Java
2015-07-15 05:58 - 2015-05-24 22:56 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-07-15 05:34 - 2014-06-14 23:31 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-07-15 04:21 - 2014-12-16 13:23 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-07-15 04:21 - 2014-11-21 12:51 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-07-15 04:20 - 2013-09-16 11:43 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-07-13 23:10 - 2014-11-21 13:01 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2014-11-21 13:01 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-13 11:25 - 2015-04-08 09:13 - 00000000 ____D C:\AdwCleaner
2015-07-13 10:19 - 2015-04-10 06:38 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-07-13 03:27 - 2014-05-13 14:39 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-07-13 03:25 - 2015-05-05 00:07 - 02133504 _____ (Farbar) C:\Users\1973pl\Desktop\FRST64.exe
2015-07-12 12:18 - 2015-04-16 15:03 - 00000000 ____D C:\Users\1973pl\AppData\Local\Ori and the Blind Forest
2015-07-10 22:50 - 2015-05-06 15:15 - 00000000 ____D C:\Users\1973pl\Documents\My Games
2015-07-10 19:50 - 2015-04-28 03:16 - 00000000 ____D C:\ProgramData\Riot Games
2015-07-06 18:14 - 2015-04-16 07:14 - 00000000 ____D C:\Users\1973pl\AppData\Roaming\OBS
2015-07-06 12:44 - 2015-06-11 01:09 - 00001140 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-06 12:44 - 2014-05-13 14:31 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-06 02:49 - 2015-02-26 22:18 - 00001122 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-06 02:49 - 2015-02-26 22:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-06 02:49 - 2015-02-26 22:18 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-06 02:29 - 2014-11-20 20:24 - 00014598 _____ C:\WINDOWS\PFRO.log
2015-07-06 02:29 - 2014-05-13 14:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-06 02:28 - 2015-04-10 06:50 - 00000000 ____D C:\Users\1973pl
2015-07-06 00:50 - 2015-04-09 01:00 - 00000000 ____D C:\Program Files (x86)\Origin Games
2015-07-05 19:06 - 2015-04-09 00:16 - 00000000 ____D C:\Program Files (x86)\Origin
2015-07-04 21:56 - 2012-11-14 09:25 - 00139780 _____ C:\WINDOWS\DirectX.log
2015-07-03 08:43 - 2012-11-14 08:51 - 130333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-07-01 04:32 - 2015-04-08 07:36 - 00000000 ____D C:\Program Files (x86)\Heroes of the Storm
2015-06-29 20:41 - 2015-04-08 07:30 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-06-29 12:40 - 2015-04-09 01:01 - 00000000 ____D C:\Users\1973pl\AppData\Local\Adobe
2015-06-29 12:22 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-06-29 12:21 - 2014-05-13 14:31 - 00000000 ____D C:\ProgramData\Avira
2015-06-27 14:45 - 2015-06-15 22:29 - 00000000 ____D C:\Mathelehrer Simulator 2014
2015-06-26 04:22 - 2015-02-22 18:45 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-18 08:42 - 2015-02-26 22:18 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-06-18 08:41 - 2015-02-26 22:18 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-06-18 08:41 - 2014-05-13 14:37 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
==================== Files in the root of some directories =======
2012-11-14 10:19 - 2012-11-14 10:19 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-06-30 01:58 - 2015-06-30 01:58 - 0000098 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
Some files in TEMP:
====================
C:\Users\1973pl\AppData\Local\Temp\27fff54a706caf16275619fa9b79269c.dll
C:\Users\1973pl\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-18 00:54
==================== End of log ============================
MfG Croatis Code:
ATTFilter # AdwCleaner v4.208 - Bericht erstellt 18/07/2015 um 10:12:01
# Aktualisiert 09/07/2015 von Xplode
# Datenbank : 2015-07-15.1 [Server]
# Betriebssystem : Windows 8.1 (x64)
# Benutzername : 1973pl - PETRA
# Gestarted von : C:\Users\1973pl\Downloads\AdwCleaner_4.208.exe
# Option : Suchlauf
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Daten Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Mozilla Firefox v39.0 (x86 de)
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [892 Bytes] - [08/04/2015 09:13:06]
AdwCleaner[R10].txt - [1670 Bytes] - [06/05/2015 23:53:41]
AdwCleaner[R11].txt - [1728 Bytes] - [07/05/2015 03:17:23]
AdwCleaner[R12].txt - [1788 Bytes] - [13/05/2015 03:55:08]
AdwCleaner[R13].txt - [1851 Bytes] - [14/05/2015 16:15:57]
AdwCleaner[R14].txt - [1914 Bytes] - [16/05/2015 22:38:31]
AdwCleaner[R15].txt - [2019 Bytes] - [30/05/2015 02:05:05]
AdwCleaner[R16].txt - [2079 Bytes] - [30/05/2015 02:07:48]
AdwCleaner[R17].txt - [2139 Bytes] - [07/06/2015 23:23:40]
AdwCleaner[R18].txt - [2199 Bytes] - [12/06/2015 00:18:32]
AdwCleaner[R19].txt - [2259 Bytes] - [19/06/2015 00:34:36]
AdwCleaner[R1].txt - [954 Bytes] - [13/04/2015 02:49:46]
AdwCleaner[R20].txt - [2319 Bytes] - [21/06/2015 07:29:34]
AdwCleaner[R21].txt - [2379 Bytes] - [23/06/2015 16:57:48]
AdwCleaner[R22].txt - [2439 Bytes] - [24/06/2015 14:34:38]
AdwCleaner[R23].txt - [2499 Bytes] - [24/06/2015 14:51:57]
AdwCleaner[R24].txt - [2559 Bytes] - [27/06/2015 09:44:16]
AdwCleaner[R25].txt - [2619 Bytes] - [28/06/2015 15:17:07]
AdwCleaner[R26].txt - [2679 Bytes] - [29/06/2015 12:49:22]
AdwCleaner[R27].txt - [2739 Bytes] - [29/06/2015 18:51:18]
AdwCleaner[R28].txt - [2799 Bytes] - [30/06/2015 02:40:44]
AdwCleaner[R29].txt - [3196 Bytes] - [06/07/2015 02:22:28]
AdwCleaner[R2].txt - [1012 Bytes] - [14/04/2015 01:15:03]
AdwCleaner[R30].txt - [2928 Bytes] - [06/07/2015 02:34:06]
AdwCleaner[R31].txt - [3878 Bytes] - [13/07/2015 02:46:03]
AdwCleaner[R32].txt - [3938 Bytes] - [13/07/2015 02:55:00]
AdwCleaner[R33].txt - [3167 Bytes] - [13/07/2015 11:24:30]
AdwCleaner[R34].txt - [2379 Bytes] - [18/07/2015 10:12:01]
AdwCleaner[R3].txt - [1071 Bytes] - [14/04/2015 06:00:49]
AdwCleaner[R4].txt - [1087 Bytes] - [14/04/2015 21:09:35]
AdwCleaner[R5].txt - [1146 Bytes] - [16/04/2015 05:38:43]
AdwCleaner[R6].txt - [1265 Bytes] - [22/04/2015 22:22:36]
AdwCleaner[R7].txt - [1433 Bytes] - [04/05/2015 23:44:15]
AdwCleaner[R8].txt - [1492 Bytes] - [04/05/2015 23:58:59]
AdwCleaner[R9].txt - [1610 Bytes] - [05/05/2015 00:04:23]
AdwCleaner[S0].txt - [1131 Bytes] - [14/04/2015 06:01:19]
AdwCleaner[S1].txt - [1206 Bytes] - [16/04/2015 05:39:26]
AdwCleaner[S2].txt - [1551 Bytes] - [04/05/2015 23:59:46]
AdwCleaner[S3].txt - [3252 Bytes] - [06/07/2015 02:27:47]
AdwCleaner[S4].txt - [3948 Bytes] - [13/07/2015 03:13:26]
########## EOF - C:\AdwCleaner\AdwCleaner[R34].txt - [3147 Bytes] ##########
|
|
18.07.2015, 13:38
| #6 |
| /// the machine /// TB-Ausbilder | Programm "Pokki" Ja, ist ne Fehlerkennung an der Stelle. Sieht man ja im FRST log, dass kein Proxy mehr da ist
__________________ --> Programm "Pokki" |
|
29.07.2015, 02:13
| #7 |
| | Programm "Pokki" Okay,gut.Keine weiteren Probleme. Vielen Dank! Grüße Croatis |
|
29.07.2015, 09:12
| #8 |
| /// the machine /// TB-Ausbilder | Programm "Pokki" Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren .
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung:Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Programm "Pokki" |
| akamai, antivir, antivirus, avira, browser, computer, device driver, euro, festplatte, firefox, firefox 39.0, flash player, google, internet, internet explorer, office 365, onedrive, problem, programm, realtek, registry, scan, server, software, svchost.exe, system, usb, virus, windows |
dann auf 
und dann auf 
. 
+ R Taste und schreibe Combofix /Uninstall in das 
