| |
| |||||||
Log-Analyse und Auswertung: Windows 7: System und Browser sehr langsam: G-Service als ursache?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
17.01.2014, 00:10
| #1 |
| |  Windows 7: System und Browser sehr langsam: G-Service als ursache? trojaner board Hallo, ich hoffe ihr könnt mir helfen. Vor kurzem sind mir an meinem Laptop einige Störungen aufgefallen (läuft sehr langsam obwohl erst kürzlich formatiert, I-net Seiten laden sehr langsam, starke CPU Auslastung etc). Bei einem Blick auf meine laufenden Prozesse ist mir das Programm G-Service aufgefallen. Da es mir unbekannt war hab ich erstmal drauf losgegoogled: siehe da, seltenere Art von malware/Virus (ohne genaue angaben). Angeraten wurde den Prozess in den Diensten erstmal zu deaktivieren. Das habe ich getan. Danach hab ich mehrmals verschiedenste Virenscanner drüber laufen lassen: avast!antivir, Spyware Terminator, Malwarebytes sowie anti-rootkit von malwarebytes. KEINE FUNDE. Da ich nicht unbedingt nochmal formatieren möchte wende ich mich an euch. System: Windows 7/64bit --> Defogger angewendet --> Farbar Recovery Scan --> GMER alle im Anhang GMER hat eine Fehlermeldung rausgegeben, fund: rootkit Vielen Dank schonmal! |
|
17.01.2014, 08:19
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: System und Browser sehr langsam: G-Service als ursache? Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
17.01.2014, 12:08
| #3 |
| | Windows 7: System und Browser sehr langsam: G-Service als ursache? FRST
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 03
Ran by Amanda (administrator) on ASUS on 16-01-2014 23:39:56
Running from C:\Users\Amanda\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
(COMPANYVERS_NAME) C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Windows\AsScrPro.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
( ) C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Amanda\Downloads\Defogger.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] - C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe [485448 2013-12-25] ( )
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {5bb31dc7-522a-11e3-8e06-5404a626fb5c} - "F:\WD SmartWare.exe" autoplay=true
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [226920 2011-02-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [192616 2011-02-08] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM-x32 - DefaultScope {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKLM-x32 - {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
SearchScopes: HKCU - DefaultScope {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll ()
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default
FF SearchEngineOrder.user_pref("browser.search.order.2", "");: user_pref("browser.search.order.2", "");
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @RadioRage_4j.com/Plugin - C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll (Mindspark)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Amanda\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FireJump - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\firejump@firejump.net [2013-12-04]
FF Extension: ProxTube - Unblock YouTube - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-16]
FF Extension: Heart Button - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ffextension@weheartit.com.xpi [2013-11-20]
FF Extension: Tumblr Savior - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi [2013-11-28]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-28]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2013-12-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-20]
FF HKLM-x32\...\Firefox\Extensions: [dnshelp@dnshelp.com] - C:\Users\Amanda\AppData\Roaming\Helper
FF Extension: Helper - C:\Users\Amanda\AppData\Roaming\Helper [2013-12-04]
FF HKCU\...\Firefox\Extensions: [firejump@firejump.net] - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\firejump@firejump.net
FF Extension: FireJump - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\firejump@firejump.net [2013-12-04]
Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.7_0 [2014-01-16]
CHR Extension: (Google Docs) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 [2014-01-16]
CHR Extension: (YouTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 [2014-01-16]
CHR Extension: (Google Search) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 [2014-01-16]
CHR Extension: (AdBlock) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.18_0 [2014-01-16]
CHR Extension: (avast! Online Security) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2005.45_0 [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2014-01-16]
CHR Extension: (Gmail) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 [2014-01-16]
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\Amanda\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-11-20]
==================== Services (Whitelisted) =================
R2 AddonsHelper; C:\Users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe [896512 2013-12-04] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [920872 2013-12-18] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2013-12-17] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [555304 2013-12-18] ()
R2 RadioRage_4jService; C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe [88648 2013-12-25] (COMPANYVERS_NAME)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-20] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-20] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2013-12-17] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527360 2007-09-10] (PixArt Imaging Inc.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-07] (Windows (R) Win 7 DDK provider)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-11-13] (Anchorfree Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-16 23:39 - 2014-01-16 23:40 - 00018870 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:33 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-16 23:32 - 2014-01-16 23:33 - 02076160 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 14:53 - 2014-01-16 19:32 - 00000112 _____ C:\Windows\setupact.log
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:52 - 2014-01-16 14:52 - 00000320 _____ C:\Windows\PFRO.log
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:45 - 2014-01-16 22:56 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 01:45 - 2014-01-16 19:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 01:45 - 2014-01-16 01:51 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:45 - 2014-01-16 01:51 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:45 - 2014-01-16 01:47 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:43 - 2014-01-16 01:44 - 00819144 _____ (Google Inc.) C:\Users\Amanda\Downloads\ChromeSetup.exe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 12:28 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 12:28 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 12:28 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-12 19:29 - 2014-01-12 23:04 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 19:27 - 2014-01-12 21:08 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-12 23:04 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 19:25 - 2014-01-12 19:26 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-12 19:18 - 2014-01-12 19:19 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-08 23:43 - 2014-01-09 00:05 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:14 - 2014-01-08 23:15 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 23:10 - 2014-01-10 03:08 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 22:49 - 2014-01-08 22:50 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:04 - 2014-01-08 22:21 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:26 - 2014-01-07 22:45 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-16 21:45 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\sh4ldr
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-07 15:54 - 2014-01-07 15:57 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:47 - 2014-01-07 15:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Amanda\Downloads\sh-remover.exe
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-04 12:45 - 2013-12-17 22:11 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-12-29 15:32 - 2013-12-29 21:30 - 00000000 ____D C:\Windows\Minidump
2013-12-27 19:03 - 2013-12-28 19:23 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:02 - 2014-01-04 12:44 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-25 02:01 - 2014-01-14 15:32 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-12-25 02:00 - 2014-01-04 12:45 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Hotspot Shield
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Program Files (x86)\RadioRage_4j
2013-12-25 01:35 - 2013-12-25 01:53 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:15 - 2013-12-23 13:49 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2007-09-10 08:50 - 00527360 _____ (PixArt Imaging Inc.) C:\Windows\system32\Drivers\PAC7302.SYS
2013-12-20 20:23 - 2007-09-05 17:01 - 00008704 _____ (PixArt Imaging Inc.) C:\Windows\system32\CoInst_070910.dll
2013-12-20 20:23 - 2007-08-27 11:36 - 00129024 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\SP7302.ax
2013-12-20 20:23 - 2007-03-20 16:44 - 00000566 _____ C:\Windows\SysWOW64\SP7302.ini
2013-12-20 20:23 - 2006-10-12 11:57 - 00014336 _____ (PixArt Imaging Inc.) C:\Windows\SysWOW64\P7302USD.dll
2013-12-20 19:49 - 2014-01-14 23:50 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2013-12-20 19:48 - 2013-12-20 19:49 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 23:05 - 2013-12-18 23:05 - 00027362 _____ C:\Users\Amanda\Documents\cc_20131218_230541.reg
2013-12-18 15:29 - 2013-12-18 15:29 - 00505578 _____ C:\Users\Amanda\Documents\ticket.xps
==================== One Month Modified Files and Folders =======
2014-01-16 23:40 - 2014-01-16 23:39 - 00018870 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:33 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-16 23:33 - 2014-01-16 23:32 - 02076160 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:31 - 2013-11-20 22:03 - 00000000 ____D C:\Users\Amanda
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 23:21 - 2013-11-21 22:30 - 02058326 _____ C:\Windows\WindowsUpdate.log
2014-01-16 22:56 - 2014-01-16 01:45 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 21:45 - 2014-01-07 15:58 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-16 19:41 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-16 19:41 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-16 19:37 - 2014-01-16 01:45 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 19:37 - 2013-11-20 22:03 - 00000000 ___HD C:\ASUS.DAT
2014-01-16 19:32 - 2014-01-16 14:53 - 00000112 _____ C:\Windows\setupact.log
2014-01-16 19:32 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-16 19:30 - 2013-11-20 23:08 - 00000000 ____D C:\Users\Amanda\AppData\Local\Last.fm
2014-01-16 19:30 - 2013-11-20 23:03 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Winamp
2014-01-16 14:54 - 2013-11-21 22:46 - 00001430 _____ C:\Windows\system32\ServiceFilter.ini
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:53 - 2009-07-14 05:45 - 00305344 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 14:52 - 2014-01-16 14:52 - 00000320 _____ C:\Windows\PFRO.log
2014-01-16 03:03 - 2013-11-27 12:44 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 03:03 - 2013-11-20 23:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 03:00 - 2013-11-27 12:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 01:51 - 2014-01-16 01:45 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:51 - 2014-01-16 01:45 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:47 - 2014-01-16 01:45 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:47 - 2011-04-13 03:33 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-16 01:44 - 2014-01-16 01:43 - 00819144 _____ (Google Inc.) C:\Users\Amanda\Downloads\ChromeSetup.exe
2014-01-15 12:56 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\LEBENSLAUF--Bewerbungen
2014-01-15 12:31 - 2013-11-20 22:35 - 00000000 ____D C:\Users\Amanda\AppData\Local\Adobe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 00:18 - 2011-02-19 05:24 - 00708282 _____ C:\Windows\system32\perfh007.dat
2014-01-15 00:18 - 2011-02-19 05:24 - 00151886 _____ C:\Windows\system32\perfc007.dat
2014-01-15 00:18 - 2009-07-14 06:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-15 00:06 - 2013-12-07 22:51 - 00000000 ____D C:\Users\Amanda\Desktop\Luni
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-14 23:56 - 2013-11-25 22:15 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\vlc
2014-01-14 23:50 - 2013-12-20 19:49 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2014-01-14 15:32 - 2013-12-25 02:01 - 00000000 ____D C:\ProgramData\Hotspot Shield
2014-01-13 16:45 - 2013-11-20 22:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-13 15:38 - 2009-07-14 06:08 - 00032572 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-12 23:04 - 2014-01-12 19:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 23:04 - 2014-01-12 19:26 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 21:08 - 2014-01-12 19:27 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-12 19:25 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:19 - 2014-01-12 19:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-10 03:08 - 2014-01-08 23:10 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-09 00:05 - 2014-01-08 23:43 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:15 - 2014-01-08 23:14 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 22:50 - 2014-01-08 22:49 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:21 - 2014-01-08 22:04 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:45 - 2014-01-07 22:26 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 16:05 - 2013-11-21 22:46 - 00002458 _____ C:\Windows\system32\AutoRunFilter.ini
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:57 - 2014-01-07 15:54 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\sh4ldr
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-07 15:47 - 2014-01-07 15:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Amanda\Downloads\sh-remover.exe
2014-01-07 15:45 - 2013-12-04 21:14 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\DesktopIconForAmazon
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-05 20:35 - 2013-11-20 23:42 - 00000000 ____D C:\Program Files\Adobe
2014-01-05 20:35 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-04 12:45 - 2013-12-25 02:00 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2014-01-04 12:44 - 2013-12-25 02:02 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-30 20:27 - 2013-11-22 23:53 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-29 21:30 - 2013-12-29 15:32 - 00000000 ____D C:\Windows\Minidump
2013-12-28 19:23 - 2013-12-27 19:03 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Hotspot Shield
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Program Files (x86)\RadioRage_4j
2013-12-25 01:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Resources
2013-12-25 01:53 - 2013-12-25 01:35 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:49 - 2013-12-23 13:15 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:32 - 2013-11-21 22:48 - 00000000 ____D C:\ProgramData\CyberLink
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-21 12:23 - 2013-11-20 22:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:25 - 2009-07-14 03:34 - 00000536 _____ C:\Windows\win.ini
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2013-11-21 22:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-20 19:49 - 2013-12-20 19:48 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-20 13:47 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-18 23:05 - 2013-12-18 23:05 - 00027362 _____ C:\Users\Amanda\Documents\cc_20131218_230541.reg
2013-12-18 15:29 - 2013-12-18 15:29 - 00505578 _____ C:\Users\Amanda\Documents\ticket.xps
2013-12-17 22:11 - 2014-01-04 12:45 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-10 18:17
==================== End Of Log ============================
|
|
17.01.2014, 12:09
| #4 |
| | Windows 7: System und Browser sehr langsam: G-Service als ursache? Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2014 03
Ran by Amanda at 2014-01-16 23:40:26
Running from C:\Users\Amanda\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
Adobe Flash Player 10 ActiveX (x32 Version: 10.1.85.3 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (x32 Version: 7.0 - Adobe Systems, Inc.)
Adobe Photoshop Lightroom 5.2 64-bit (Version: 5.2.1 - Adobe)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (x32 Version: 1.8.17.26026 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.8.17.26026 - Alcor Micro Corp.) Hidden
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
ASUS AI Recovery (x32 Version: 1.0.13 - ASUS)
ASUS FancyStart (x32 Version: 1.1.0 - ASUSTeK Computer Inc.)
ASUS LifeFrame3 (x32 Version: 3.0.21 - ASUS)
ASUS Live Update (x32 Version: 2.5.9 - ASUS)
ASUS Power4Gear Hybrid (Version: 1.1.43 - ASUS)
ASUS SmartLogon (x32 Version: 1.0.0011 - ASUS)
ASUS Virtual Camera (x32 Version: 1.0.21 - asus)
ASUS WebStorage (x32 Version: 3.0.84.161 - eCareme Technologies, Inc.)
AsusScr_K3 Series_ENG_Basic (x32 Version: 1.0.0001 - ASUS)
AsusVibe2.0 (x32 Version: 2.0.4.617 - ASUSTEK)
ATK Package (x32 Version: 1.0.0008 - ASUS)
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Bookworm Deluxe (x32 Version: - Oberon Media Inc.)
CCleaner (Version: 4.07 - Piriform)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
ComicRack v0.9.175 (Version: v0.9.175 - cYo Soft)
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Cooking Dash (x32 Version: - Oberon Media Inc.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.) Hidden
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Fast Boot (Version: 1.0.8 - ASUS)
FireJump (x32 Version: 1.0.2.8 - FireJump.net)
Free YouTube to MP3 Converter version 3.12.17.1127 (x32 Version: 3.12.17.1127 - DVDVideoSoft Ltd.)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Game Park Console (x32 Version: 6.2.1.1 - Oberon Media, Inc.)
G-Filter (HKCU Version: - G-Filter)
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Hotel Dash Suite Success (x32 Version: - Oberon Media Inc.)
Hotspot Shield 3.23 (x32 Version: 3.23 - AnchorFree Inc.)
IC 445C Webcam (x32 Version: 1.0.0.19 - Micro Innovations)
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2291 - Intel Corporation)
Intel(R) Turbo Boost Technology Monitor 2.0 (Version: 2.1.23.0 - Intel)
IrfanView (remove only) (x32 Version: 4.36 - Irfan Skiljan)
iTunes (Version: 11.1.3.8 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Last.fm Scrobbler 2.1.36 (x32 Version: - Last.fm)
Luxor 3 (x32 Version: - Oberon Media Inc.)
Mahjongg dimensions (x32 Version: - Oberon Media Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Neat Image v7.5.0 Demo Standalone (Version: - Neat Image team, ABSoft)
Nuance PDF Reader (x32 Version: 6.00.0041 - Nuance Communications, Inc.)
NVIDIA Control Panel 266.86 (Version: 266.86 - NVIDIA Corporation) Hidden
NVIDIA Graphics Driver 266.86 (Version: 266.86 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.0.18 (Version: 1.0.18 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.0.18 - NVIDIA Corporation) Hidden
Plants vs Zombies (x32 Version: - Oberon Media Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Ralink RT2860 Wireless LAN Card (x32 Version: 1.5.9.0 - Ralink)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6324 - Realtek Semiconductor Corp.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
SpyHunter (Version: 4.16.5.4290 - Enigma Software Group USA, LLC)
Spyware Terminator 2012 (x32 Version: 3.0.0.82 - Crawler.com)
Synaptics Pointing Device Driver (Version: 15.2.16.1 - Synaptics Incorporated)
syncables desktop SE (x32 Version: 5.5.746.11492 - syncables)
Unity Web Player (HKCU Version: - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (x32 Version: - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version: - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (x32 Version: - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (x32 Version: - Microsoft)
VLC media player 2.1.1 (x32 Version: 2.1.1 - VideoLAN)
WD SmartWare (Version: 1.2.0.8 - Western Digital)
Winamp (x32 Version: 5.66 - Nullsoft, Inc)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (x32 Version: 2.31.1 - ASUS)
Wireless Console 3 (x32 Version: 3.0.19 - ASUS)
World of Goo (x32 Version: - Oberon Media Inc.)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (x32 Version: 15.4.5722.2 - Microsoft Corporation)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (x32 Version: 15.4.5722.2 - Microsoft Corporation)
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة (x32 Version: 15.4.5722.2 - Microsoft Corporation)
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (x32 Version: 15.4.5722.2 - Microsoft Corporation)
==================== Restore Points =========================
08-01-2014 20:49:12 Removed Apple Application Support
08-01-2014 21:25:58 Installed iTunes
08-01-2014 22:08:41 Windows Update
09-01-2014 02:00:10 Windows Update
10-01-2014 02:00:13 Windows Update
14-01-2014 12:27:37 Windows Update
16-01-2014 02:00:18 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {1856DB4E-A6C0-4398-BCF6-3A5CA75640D3} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)
Task: {30E77911-BD4F-41AD-94B1-5B78E3179CD9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3AB838F1-C3A4-47A1-9DA9-5D8495C6283E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {63A2F692-FCEC-4FD4-8B0E-0D81B0E02E06} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-12-02] (ASUS)
Task: {8F6433FD-5615-4157-BDFA-4991FD3F5854} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2010-11-15] (ASUS)
Task: {AF06E188-982B-4716-B3B9-AB1DEA939DE7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {B635173B-6D24-402F-8212-304B170EBDC6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-11-20] (AVAST Software)
Task: {BD456F48-DD99-43ED-9583-58EC92B9C766} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16] (Google Inc.)
Task: {D1DB345F-E058-48D0-9481-A161E27709D4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16] (Google Inc.)
Task: {E2409936-C589-4BCF-8D52-3736A0196F7B} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-07-15 01:11 - 2010-07-15 01:11 - 00031360 _____ () C:\Program Files\P4G\DevMng.dll
2011-05-31 04:23 - 2011-01-27 01:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-16 14:54 - 2014-01-16 12:10 - 02155008 _____ () C:\Program Files\AVAST Software\Avast\defs\14011600\algo.dll
2014-01-16 23:33 - 2014-01-16 19:12 - 02155008 _____ () C:\Program Files\AVAST Software\Avast\defs\14011601\algo.dll
2013-12-18 19:11 - 2013-12-18 19:11 - 00908584 _____ () C:\Program Files (x86)\Hotspot Shield\bin\af_proxy.dll
2013-12-18 19:15 - 2013-12-18 19:15 - 00506664 _____ () C:\Program Files (x86)\Hotspot Shield\bin\HssRep.dll
2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2013-11-20 22:22 - 2013-11-20 22:22 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-01-16 01:47 - 2014-01-11 11:28 - 00715544 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libglesv2.dll
2014-01-16 01:47 - 2014-01-11 11:28 - 00100120 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libegl.dll
2014-01-16 01:47 - 2014-01-11 11:29 - 04055320 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll
2014-01-16 01:47 - 2014-01-11 11:29 - 00399640 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll
2014-01-16 01:47 - 2014-01-11 11:28 - 01634584 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:D20FFA63
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/16/2014 07:32:58 PM) (Source: WDSmartWareBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.WDSmartWareBackgroundService.OnStart(String[] args)
Error: (01/16/2014 05:49:50 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5023
Error: (01/16/2014 05:49:50 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5023
Error: (01/16/2014 05:49:50 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/16/2014 05:49:49 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4024
Error: (01/16/2014 05:49:49 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4024
Error: (01/16/2014 05:49:49 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/16/2014 05:49:48 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3010
Error: (01/16/2014 05:49:48 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3010
Error: (01/16/2014 05:49:48 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (01/16/2014 07:32:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/16/2014 07:32:28 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (01/16/2014 02:53:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/16/2014 02:53:36 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (01/16/2014 01:22:27 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (01/16/2014 01:22:27 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (01/16/2014 01:22:26 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (01/16/2014 01:22:26 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (01/16/2014 01:22:25 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (01/16/2014 00:36:32 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 31%
Total physical RAM: 8104.14 MB
Available physical RAM: 5536.73 MB
Total Pagefile: 16206.47 MB
Available Pagefile: 13273.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:250.05 GB) (Free:110.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:321.12 GB) (Free:129.21 GB) NTFS
Drive e: (MIRANDA_S2) (CDROM) (Total:7.1 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: AA9693FE)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=250 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=321 GB) - (Type=OF Extended)
==================== End Of Log ============================
GMER Code:
ATTFilter GMER 2.1.19322 - hxxp://www.gmer.net
Rootkit scan 2014-01-17 00:00:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JEDO 596,17GB
Running: hvrqjjul.exe; Driver: C:\Users\Amanda\AppData\Local\Temp\fxldrpoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[740] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[788] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[836] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\LSASS.EXE[844] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[944] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\NVVSVC.EXE[148] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[504] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[656] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[736] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\FBAGENT.EXE[1372] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Windows\system32\WLANExt.exe[1380] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe[1444] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1460] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\NVVSVC.EXE[1472] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe[1732] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[2008] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe[1668] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1652] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1824] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\CMW_SRV.EXE[1804] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\CMW_SRV.EXE[1804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076771465 2 bytes [77, 76]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\CMW_SRV.EXE[1804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767714bb 2 bytes [77, 76]
.text ... * 2
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\HSSWD.EXE[160] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\HSSWD.EXE[160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076771465 2 bytes [77, 76]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\HSSWD.EXE[160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767714bb 2 bytes [77, 76]
.text ... * 2
.text C:\PROGRA~2\RADIOR~1\bar\1.bin\4jbarsvc.exe[2132] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe[2192] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[2272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe[2336] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WINDOWS LIVE\WLIDSVC.EXE[2852] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3444] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\NVIDIA CORPORATION\NVIDIA UPDATUS\DAEMONU.EXE[3636] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\NVIDIA CORPORATION\NVIDIA UPDATUS\DAEMONU.EXE[3636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076771465 2 bytes [77, 76]
.text C:\PROGRAM FILES (X86)\NVIDIA CORPORATION\NVIDIA UPDATUS\DAEMONU.EXE[3636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767714bb 2 bytes [77, 76]
.text ... * 2
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[3376] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE[1816] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\SEARCHINDEXER.EXE[1924] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4064] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\WINDOWS\SYSTEM32\TASKHOST.EXE[2184] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\DWM.EXE[2016] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\EXPLORER.EXE[3280] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Windows\AsScrPro.exe[3544] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Windows\AsScrPro.exe[3544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076771465 2 bytes [77, 76]
.text C:\Windows\AsScrPro.exe[3544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767714bb 2 bytes [77, 76]
.text ... * 2
.text C:\Windows\System32\igfxtray.exe[4012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Windows\System32\hkcmd.exe[3268] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Windows\System32\igfxpers.exe[1124] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4108] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe[4200] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE[4284] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4404] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Windows\PixArt\PAC7302\Monitor.exe[4580] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe[4652] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RAVCPL64.EXE[4968] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\PROGRAM FILES (X86)\ASUS\ATK PACKAGE\ATK MEDIA\DMEDIA.EXE[5056] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\ASUS\ATK PACKAGE\ATK HOTKEY\HCONTROLUSER.EXE[1304] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\ASUS\WIRELESS CONSOLE 3\WCOURIER.EXE[4480] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[4680] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\AF_PROXY_CMD.EXE[5276] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\AF_PROXY_CMD.EXE[5276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076771465 2 bytes [77, 76]
.text C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\AF_PROXY_CMD.EXE[5276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767714bb 2 bytes [77, 76]
.text ... * 2
.text C:\WINDOWS\SYSTEM32\STIKYNOT.EXE[5140] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\WINDOWS\SYSTEM32\AUDIODG.EXE[5896] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 0000000076f8eecd 1 byte [62]
.text C:\Users\Amanda\Downloads\hvrqjjul.exe[7100] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bca2ba 1 byte [62]
---- Services - GMER 2.1 ----
Service C:\Windows\system32\drivers\aswFsBlk.sys (*** hidden *** ) [AUTO] aswFsBlk <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\aswMonFlt.sys (*** hidden *** ) [AUTO] aswMonFlt <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\aswRdr2.sys (*** hidden *** ) [SYSTEM] aswRdr <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\aswRvrt.sys (*** hidden *** ) [BOOT] aswRvrt <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\aswSnx.sys (*** hidden *** ) [SYSTEM] aswSnx <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\aswSP.sys (*** hidden *** ) [SYSTEM] aswSP <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\aswTdi.sys (*** hidden *** ) [SYSTEM] aswTdi <-- ROOTKIT !!!
Service C:\Windows\system32\drivers\aswVmm.sys (*** hidden *** ) [BOOT] aswVmm <-- ROOTKIT !!!
Service C:\Program Files\AVAST Software\Avast\AvastSvc.exe (*** hidden *** ) [AUTO] avast! Antivirus <-- ROOTKIT !!!
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ImagePath \??\C:\Windows\system32\drivers\aswFsBlk.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description Avast! Mini-filter Driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \??\C:\Windows\system32\drivers\aswRdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 113
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 2543045
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@ Commited
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@BootTimeout 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@TickTimeout 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@CreationTime 0xE9 0xFF 0xE1 0xD1 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@SetupOperations MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll",TRUE)?MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.sum.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll.sum",TRUE)?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@StartBootCounter 42
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@StartTickCounter 1382758
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ImagePath \??\C:\Windows\system32\drivers\aswSnx.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \??\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \??\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ImagePath \??\C:\Windows\system32\drivers\aswSP.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \??\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \??\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \??\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \??\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 10
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ImagePath \??\C:\Windows\system32\drivers\aswTdi.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 288
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert die avast! Antivirus Dienste auf diesem Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus Container sowie die Zeitplan.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ImagePath \??\C:\Windows\system32\drivers\aswFsBlk.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description Avast! Mini-filter Driver
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \??\C:\Windows\system32\drivers\aswRdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 113
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 2543045
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@ Commited
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@BootTimeout 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@TickTimeout 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@CreationTime 0xE9 0xFF 0xE1 0xD1 ...
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@SetupOperations MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll",TRUE)?MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.sum.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll.sum",TRUE)?
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@StartBootCounter 42
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@StartTickCounter 1382758
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ImagePath \??\C:\Windows\system32\drivers\aswSnx.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \??\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \??\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ImagePath \??\C:\Windows\system32\drivers\aswSP.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \??\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \??\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \??\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \??\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 10
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ImagePath \??\C:\Windows\system32\drivers\aswTdi.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName aswTdi
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description aswTdi
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 288
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert die avast! Antivirus Dienste auf diesem Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus Container sowie die Zeitplan.
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet)
---- EOF - GMER 2.1 ----
|
|
18.01.2014, 07:17
| #5 | |
| /// the machine /// TB-Ausbilder | Windows 7: System und Browser sehr langsam: G-Service als ursache?Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.01.2014, 17:12
| #6 |
| | Windows 7: System und Browser sehr langsam: G-Service als ursache?Code:
ATTFilter ComboFix 14-01-16.03 - Amanda 18.01.2014 16:49:28.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8104.5813 [GMT 1:00]
ausgeführt von:: c:\users\Amanda\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\RadioRage_4j
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jauxstb64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbar.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbrmon64.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbrstub64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdatact.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdlghk64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jfeedmg.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhighin.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhkstub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhtmlmu.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhttpct.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jidle.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jmedint.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jmlbtn.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jPlugin.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jradio.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jregfft.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jreghk.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jscript.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jskin.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jskplay.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jSrchMn.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jsrchmr.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jtpinst.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\AppIntegratorStub64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\BOOTSTRAP.JS
c:\program files (x86)\RadioRage_4j\bar\1.bin\CHROME.MANIFEST
c:\program files (x86)\RadioRage_4j\bar\1.bin\chrome\4jffxtbr.jar
c:\program files (x86)\RadioRage_4j\bar\1.bin\CREXT.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\CrExtP4j.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\DPNMNGR.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\EXEMANAGER.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\FF-NativeMessagingDispatcher.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\Hpg64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\INSTALL.RDF
c:\program files (x86)\RadioRage_4j\bar\1.bin\installKeys.js
c:\program files (x86)\RadioRage_4j\bar\1.bin\LOGO.BMP
c:\program files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EPMSUP.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EXTEX.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EXTPEX.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8HTML.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8RES.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8TICKER.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\UNIFIEDLOGGING.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\VERIFY.DLL
c:\program files (x86)\RadioRage_4j\bar\gen1\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\IE9Mesg\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\Message\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\Settings\s_pid.dat
c:\programdata\ASUS
c:\programdata\ASUS\LifeFrame\config0.cfg
c:\programdata\ASUS\LifeFrame\config1.cfg
c:\programdata\ASUS\LifeFrame\config2.cfg
c:\programdata\ASUS\LifeFrame\config3.cfg
c:\programdata\ASUS\LifeFrame\config4.cfg
c:\programdata\ASUS\LifeFrame\config5.cfg
c:\programdata\ASUS\LifeFrame\tmp0.img
c:\programdata\ASUS\LifeFrame\tmp1.img
c:\programdata\ASUS\LifeFrame\tmp2.img
c:\programdata\ASUS\LifeFrame\tmp3.img
c:\programdata\ASUS\LifeFrame\tmp4.img
c:\programdata\ASUS\LifeFrame\tmp5.img
c:\programdata\DNSErrorHelper\bhO.dll
c:\windows\msvcr71.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-18 bis 2014-01-18 ))))))))))))))))))))))))))))))
.
.
2014-01-18 15:54 . 2014-01-18 15:54 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-01-18 15:54 . 2014-01-18 15:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-17 11:09 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CC1921C2-2CA6-4B9B-91BA-6E962B4ED219}\mpengine.dll
2014-01-16 23:56 . 2014-01-17 00:37 117464 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-01-16 22:33 . 2014-01-16 22:33 -------- d-----w- C:\FRST
2014-01-16 00:45 . 2014-01-16 00:47 -------- d-----w- c:\users\Amanda\AppData\Local\Google
2014-01-15 11:29 . 2014-01-15 11:29 -------- d-----w- c:\programdata\McAfee
2014-01-15 11:28 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 11:28 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 11:28 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 11:28 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 11:28 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 11:28 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 11:28 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 11:28 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-15 11:28 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-14 23:02 . 2014-01-14 23:02 -------- d-----w- c:\users\Amanda\AppData\Local\Apps
2014-01-12 18:29 . 2014-01-17 00:52 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-01-12 18:27 . 2014-01-16 23:56 89304 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-01-12 18:20 . 2014-01-12 18:20 -------- d-----w- c:\users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 18:20 . 2014-01-12 18:20 -------- d-----w- c:\programdata\Malwarebytes
2014-01-12 18:20 . 2014-01-12 18:20 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2014-01-12 18:20 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-01-12 17:55 . 2014-01-12 17:55 -------- d-----w- c:\windows\system32\IO
2014-01-08 23:33 . 2014-01-08 23:33 -------- d-----w- c:\users\Amanda\AppData\Roaming\cYo
2014-01-08 23:33 . 2014-01-08 23:33 -------- d-----w- c:\users\Amanda\AppData\Local\cYo
2014-01-08 22:14 . 2014-01-08 22:15 -------- d-----w- c:\program files\ComicRack
2014-01-08 21:27 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-01-08 21:26 . 2014-01-08 21:26 -------- d-----w- c:\program files\iPod
2014-01-08 21:26 . 2014-01-08 21:27 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 21:26 . 2014-01-08 21:27 -------- d-----w- c:\program files\iTunes
2014-01-08 21:26 . 2014-01-08 21:27 -------- d-----w- c:\program files (x86)\iTunes
2014-01-08 21:25 . 2014-01-08 21:25 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-01-08 21:25 . 2014-01-08 21:25 -------- d-----w- c:\program files\Common Files\Apple
2014-01-08 21:25 . 2014-01-08 21:25 -------- d-----w- c:\program files\Bonjour
2014-01-08 21:25 . 2014-01-08 21:25 -------- d-----w- c:\program files (x86)\Bonjour
2014-01-08 21:25 . 2014-01-08 21:26 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-01-07 14:58 . 2014-01-07 14:58 51496 ----a-w- c:\windows\system32\drivers\stflt.sys
2014-01-07 14:58 . 2014-01-17 16:10 -------- d-----w- c:\programdata\Spyware Terminator
2014-01-07 14:58 . 2014-01-07 14:58 -------- d-----w- c:\users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 14:58 . 2014-01-07 14:58 -------- d-----w- c:\program files (x86)\Spyware Terminator
2014-01-07 14:54 . 2014-01-17 17:56 -------- d-----w- c:\windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 14:54 . 2014-01-07 14:54 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2014-01-04 11:45 . 2013-12-17 21:11 44744 ----a-w- c:\windows\system32\drivers\hssdrv6.sys
2013-12-26 02:00 . 2013-12-26 02:00 -------- d-----w- c:\windows\SysWow64\Wat
2013-12-26 02:00 . 2013-12-26 02:00 -------- d-----w- c:\windows\system32\Wat
2013-12-25 01:01 . 2014-01-14 14:32 -------- d-----w- c:\programdata\Hotspot Shield
2013-12-25 01:00 . 2014-01-04 11:45 -------- d-----w- c:\program files (x86)\Hotspot Shield
2013-12-25 01:00 . 2013-12-25 01:00 -------- d-----w- c:\users\Amanda\AppData\Roaming\Hotspot Shield
2013-12-25 00:35 . 2013-12-25 00:35 -------- d-----w- c:\users\Amanda\AppData\Roaming\ACStealth4
2013-12-25 00:35 . 2013-12-25 00:53 -------- d-----w- c:\program files (x86)\ArchiCrypt Stealth 4
2013-12-23 12:32 . 2013-12-23 12:32 -------- d-----w- c:\users\Amanda\AppData\Roaming\CyberLink
2013-12-23 12:32 . 2013-12-23 12:32 -------- d-----w- c:\users\Public\CyberLink
2013-12-23 12:15 . 2013-12-23 12:49 -------- d-----w- c:\program files\Lightroom Tutorial
2013-12-23 12:14 . 2013-12-23 12:14 -------- d-----w- c:\programdata\Canneverbe Limited
2013-12-23 12:13 . 2013-12-23 12:13 -------- d-----w- c:\users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 12:11 . 2013-12-23 12:11 -------- d-----w- c:\users\Amanda\AppData\Roaming\GalileoPress
2013-12-20 19:23 . 2007-09-10 07:50 527360 ----a-w- c:\windows\system32\drivers\PAC7302.SYS
2013-12-20 19:23 . 2007-09-05 16:01 8704 ----a-w- c:\windows\system32\CoInst_070910.dll
2013-12-20 19:23 . 2013-12-20 19:23 -------- d-----w- c:\program files (x86)\Common Files\PAC7302
2013-12-20 19:23 . 2013-12-20 19:23 -------- d-----w- c:\windows\PixArt
2013-12-20 19:23 . 2013-12-20 19:23 -------- d-----w- c:\program files (x86)\Micro Innovations
2013-12-20 19:23 . 2007-08-27 10:36 129024 ----a-w- c:\windows\SysWow64\SP7302.ax
2013-12-20 19:23 . 2006-10-12 10:57 14336 ----a-w- c:\windows\SysWow64\P7302USD.dll
2013-12-20 19:23 . 2013-12-20 19:23 -------- d-----w- c:\users\Amanda\AppData\Roaming\InstallShield
2013-12-20 18:49 . 2014-01-14 22:50 -------- d-----w- c:\users\Amanda\AppData\Roaming\Skype
2013-12-20 18:48 . 2013-12-20 18:48 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-12-20 18:48 . 2013-12-20 18:48 -------- d-----r- c:\program files (x86)\Skype
2013-12-20 18:48 . 2013-12-20 18:49 -------- d-----w- c:\programdata\Skype
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-16 02:00 . 2013-11-27 11:44 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-11-28 03:09 . 2013-11-20 21:48 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-28 03:09 . 2013-11-20 21:48 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-26 11:54 . 2013-12-12 02:02 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 02:02 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 02:02 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 02:02 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 02:02 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 02:02 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 02:02 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 02:02 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 02:02 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 02:02 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 02:02 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 02:02 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 02:02 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 02:02 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 02:02 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 02:02 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 02:02 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 02:02 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 02:02 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 02:02 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 02:02 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-12 02:02 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-12 02:02 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-12 02:02 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-26 03:08 . 2013-11-26 03:08 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-26 03:08 . 2013-11-26 03:08 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-26 03:08 . 2013-11-26 03:08 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-26 03:08 . 2013-11-26 03:08 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-26 03:08 . 2013-11-26 03:08 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-26 03:08 . 2013-11-26 03:08 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-26 03:08 . 2013-11-26 03:08 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-26 03:08 . 2013-11-26 03:08 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-26 03:08 . 2013-11-26 03:08 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-26 03:08 . 2013-11-26 03:08 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-26 03:08 . 2013-11-26 03:08 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-26 03:08 . 2013-11-26 03:08 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-26 03:08 . 2013-11-26 03:08 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-26 03:08 . 2013-11-26 03:08 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-26 03:08 . 2013-11-26 03:08 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-26 03:08 . 2013-11-26 03:08 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-26 03:08 . 2013-11-26 03:08 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-26 03:08 . 2013-11-26 03:08 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-26 03:08 . 2013-11-26 03:08 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-26 03:08 . 2013-11-26 03:08 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-26 03:08 . 2013-11-26 03:08 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-26 03:08 . 2013-11-26 03:08 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-26 03:08 . 2013-11-26 03:08 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-26 03:08 . 2013-11-26 03:08 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-26 03:08 . 2013-11-26 03:08 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-26 03:08 . 2013-11-26 03:08 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-26 03:08 . 2013-11-26 03:08 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-26 03:08 . 2013-11-26 03:08 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-26 03:08 . 2013-11-26 03:08 413696 ----a-w- c:\windows\system32\html.iec
2013-11-26 03:08 . 2013-11-26 03:08 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-26 03:08 . 2013-11-26 03:08 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-26 03:08 . 2013-11-26 03:08 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-26 03:08 . 2013-11-26 03:08 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-26 03:08 . 2013-11-26 03:08 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-26 03:08 . 2013-11-26 03:08 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-26 03:08 . 2013-11-26 03:08 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-26 03:08 . 2013-11-26 03:08 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-26 03:08 . 2013-11-26 03:08 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-26 03:08 . 2013-11-26 03:08 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-26 03:08 . 2013-11-26 03:08 235520 ----a-w- c:\windows\system32\url.dll
2013-11-26 03:08 . 2013-11-26 03:08 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-26 03:08 . 2013-11-26 03:08 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-26 03:08 . 2013-11-26 03:08 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-26 03:08 . 2013-11-26 03:08 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-26 03:08 . 2013-11-26 03:08 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-26 03:08 . 2013-11-26 03:08 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-26 03:08 . 2013-11-26 03:08 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-26 03:08 . 2013-11-26 03:08 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-26 03:08 . 2013-11-26 03:08 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-26 03:08 . 2013-11-26 03:08 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-26 03:08 . 2013-11-26 03:08 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-26 03:08 . 2013-11-26 03:08 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-26 03:08 . 2013-11-26 03:08 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-26 03:08 . 2013-11-26 03:08 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-26 03:08 . 2013-11-26 03:08 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-26 03:08 . 2013-11-26 03:08 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-26 03:08 . 2013-11-26 03:08 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-26 03:08 . 2013-11-26 03:08 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-26 03:08 . 2013-11-26 03:08 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-23 18:26 . 2013-12-12 01:26 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 01:26 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-22 02:41 . 2013-11-22 02:41 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 648192 ----a-w- c:\windows\system32\d3d10level9.dll
2013-11-22 02:41 . 2013-11-22 02:41 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2013-11-22 02:41 . 2013-11-22 02:41 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2013-11-22 02:41 . 2013-11-22 02:41 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41 3928064 ----a-w- c:\windows\system32\d2d1.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoogleChromeAutoLaunch_B5BA1AC00E9D5F3D11339DA34D270473"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-01-11 866584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-13 2018032]
"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-24 1601536]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-11-20 3568312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-01 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2013-11-20 113664]
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2011-4-13 548528]
FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe -d [2013-11-21 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 AddonsHelper;AddonsHelper;c:\users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe;c:\users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys;c:\windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe [x]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [x]
S2 RadioRage_4jService;RadioRageService;c:\progra~2\RADIOR~1\bar\1.bin\4jbarsvc.exe;c:\progra~2\RADIOR~1\bar\1.bin\4jbarsvc.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 WDDMService;WD SmartWare Drive Manager Service;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [x]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-16 00:47 1211672 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16 00:45]
.
2014-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16 00:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-11-20 21:22 326944 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-10 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-10 418328]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-03-01 2189416]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-08-11 324096]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-04-03 2777736]
"SpywareTerminatorUpdater"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2013-04-03 3684488]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>127.0.0.1;localhost;10.*;192.168.*;127.0.0.1:895;127.0.0.1:896;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:8555;https=127.0.0.1:8555
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-11-20 22:22; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: 2013-11-21 00:05; ffextension@weheartit.com; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\ffextension@weheartit.com.xpi
FF - ExtSQL: 2013-11-22 00:55; youtubeunblocker@unblocker.yt; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\youtubeunblocker@unblocker.yt
FF - ExtSQL: 2013-11-28 03:24; jid1-W5guVoyeUR0uBg@jetpack; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi
FF - ExtSQL: 2013-11-28 21:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-12-04 21:14; ich@maltegoetz.de; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\ich@maltegoetz.de
FF - ExtSQL: 2013-12-20 02:37; {c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi
FF - ExtSQL: !HIDDEN! 2013-12-04 21:14; firejump@firejump.net; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\firejump@firejump.net
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{9B6B03F1-16CF-4491-BBBB-E872802DD717} - c:\programdata\DNSErrorHelper\bho.dll
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\SYSTEM32\STIKYNOT.EXE
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe
HKLM-Run-RadioRage Home Page Guard 64 bit - c:\progra~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-18 16:56:18
ComboFix-quarantined-files.txt 2014-01-18 15:56
.
Vor Suchlauf: 12 Verzeichnis(se), 119.487.881.216 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 119.329.918.976 Bytes frei
.
- - End Of File - - ED4F1550CA802F2568E4D9808853EB71
|
|
19.01.2014, 10:25
| #7 |
| /// the machine /// TB-Ausbilder | Windows 7: System und Browser sehr langsam: G-Service als ursache? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.01.2014, 14:00
| #8 |
| | Windows 7: System und Browser sehr langsam: G-Service als ursache? Malwarebytes kein Fund Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.19.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Amanda :: ASUS [Administrator] 19.01.2014 13:07:08 mbam-log-2014-01-19 (13-07-08).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 240276 Laufzeit: 5 Minute(n), 19 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Adwarecleaner hat Hotspotshield dateien mit aufgelistet und gelöscht, HSS ist aber meines Wissens nach nix gefährliches, ich würde es auch gern in Zukunft wieder nutzen... Code:
ATTFilter # AdwCleaner v3.017 - Bericht erstellt am 19/01/2014 um 13:21:38
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Amanda - ASUS
# Gestartet von : C:\Users\Amanda\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : AddonsHelper
Dienst Gelöscht : hshld
[#] Dienst Gelöscht : hsstrayservice
Dienst Gelöscht : hsswd
[#] Dienst Gelöscht : RadioRage_4jService
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\DNSErrorHelper
Ordner Gelöscht : C:\ProgramData\hotspot shield
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hotspot shield
Ordner Gelöscht : C:\Program Files (x86)\hotspot shield
Ordner Gelöscht : C:\Users\Amanda\AppData\LocalLow\RadioRage_4j
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\HELPER
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\hotspot shield
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\firejump@firejump.net
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [dnshelp@dnshelp.com]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [firejump@firejump.net]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.FeedManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.FeedManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLMenu
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLMenu.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLPanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLPanel.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.MultipleButton
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.MultipleButton.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.PseudoTransparentPlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.PseudoTransparentPlugin.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.Radio
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.Radio.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.RadioSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.RadioSettings.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ScriptButton
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ScriptButton.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.SettingsPlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.SettingsPlugin.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ThirdPartyInstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ThirdPartyInstaller.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@RadioRage_4j.com/Plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00A2B7C6-7487-4B99-9F6C-1FDF57FE130B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11D4B723-18CA-48C6-BA13-965488F19A70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{53855564-CF81-410C-9C1C-321C7E067816}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{581C7D7D-F809-4E03-A631-74C069D5F04A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60B34F47-3FDD-46F8-AB6C-AAABEA55C3D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{68122F44-3A4A-4EDB-B28F-0C0E07F89BD0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{78BA36C9-6036-482B-B48D-ECCA6F964B84}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9638B7D6-11F5-4406-B387-327642A11FFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D740AD89-BAF4-47D5-9B5E-343D30F07A7A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DFEB941C-8B58-4899-97C3-88FE394E1285}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E23760BE-23A3-4CEF-9304-66AF079F53DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E6AD866F-EA06-476A-8432-ED943683FAB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ECEF0D95-32FA-48D3-8A2D-D6453B5B7361}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F69FE1BE-09C3-460C-AC89-8CCD9D3DF1CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F706E19B-6C14-4272-BA98-2F16636A898D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A25AA6E2-1CDE-4D0F-A5D4-4898D7FB3C86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A5C9CB1C-1C0A-45A2-81CC-1DD342D0A478}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0978C5FA-83C0-4118-A54F-99DACCEECB8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1ED65BE2-AE84-46CB-8EA6-1C2B86ADF768}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1FDAD7F1-B87C-4E79-9150-DE235FF80B3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A50E810-71EB-43A8-A665-19ED8CCD1630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4DD9EB5D-8657-4856-A804-535841B09D73}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{569A9014-22E3-4F11-A243-CA4E3D95ADED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{597494DA-C59F-4EDF-B2D1-CE137E2DB9E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5E5E0B49-1A81-4ACC-BD6B-FF5F4EFEF01A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B872D222-3F52-4CD9-A4BE-9D69EE4F293D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{581C7D7D-F809-4E03-A631-74C069D5F04A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{60B34F47-3FDD-46F8-AB6C-AAABEA55C3D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{68122F44-3A4A-4EDB-B28F-0C0E07F89BD0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9638B7D6-11F5-4406-B387-327642A11FFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F706E19B-6C14-4272-BA98-2F16636A898D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{53855564-CF81-410C-9C1C-321C7E067816}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{721061FB-EB79-4568-A03C-3CE26D68DAE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{721061FB-EB79-4568-A03C-3CE26D68DAE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A25AA6E2-1CDE-4D0F-A5D4-4898D7FB3C86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A5C9CB1C-1C0A-45A2-81CC-1DD342D0A478}
Schlüssel Gelöscht : HKCU\Software\anchorfree
Schlüssel Gelöscht : HKCU\Software\FLEXnet
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\RadioRage_4j
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\hotspotshield
Schlüssel Gelöscht : HKLM\Software\RadioRage_4j
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{206a7328-437f-4bd9-b53e-12bfee24d588}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\hotspotshield
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RadioRage_4jbar Uninstall Firefox
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\prefs.js ]
-\\ Google Chrome v32.0.1700.76
[ Datei : C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [8381 octets] - [19/01/2014 13:17:26]
AdwCleaner[S0].txt - [7949 octets] - [19/01/2014 13:21:38]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8009 octets] ##########
Junkware removal tool, hat ebenfalls Hotspotshield dateien entfernt :-/ Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Amanda on 19.01.2014 at 13:41:46,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\hotspot shield"
Successfully deleted: [Folder] "C:\Program Files (x86)\hotspot shield"
~~~ FireFox
Emptied folder: C:\Users\Amanda\AppData\Roaming\mozilla\firefox\profiles\p56h4w7p.default\minidumps [16 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.01.2014 at 13:54:04,40
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
neues FRST.log FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2014
Ran by Amanda (administrator) on ASUS on 19-01-2014 13:55:47
Running from C:\Users\Amanda\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] - "C:\PROGRA~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
==================== Internet (Whitelisted) ====================
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default
FF SearchEngineOrder.user_pref("browser.search.order.2", "");: user_pref("browser.search.order.2", "");
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Amanda\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-16]
FF Extension: Heart Button - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ffextension@weheartit.com.xpi [2013-11-20]
FF Extension: Tumblr Savior - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi [2013-11-28]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-28]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2013-12-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-20]
Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-01-16]
CHR Extension: (Google Docs) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-16]
CHR Extension: (YouTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-16]
CHR Extension: (Chrome YouTube Downloader) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdjiinahkdjdcdlgfimlcolkjpbooja [2014-01-18]
CHR Extension: (Google-Suche) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-16]
CHR Extension: (AdBlock) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-16]
CHR Extension: (avast! Online Security) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-16]
CHR Extension: (YouTube Unblocker) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2014-01-17]
CHR Extension: (Google Mail) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-16]
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\Amanda\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-11-20]
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-20] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-20] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2013-12-17] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527360 2007-09-10] (PixArt Imaging Inc.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-07] (Windows (R) Win 7 DDK provider)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-11-13] (Anchorfree Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:54 - 2014-01-19 13:54 - 00000897 _____ C:\Users\Amanda\Desktop\JRT.txt
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:27 - 2014-01-19 13:27 - 00008097 _____ C:\Users\Amanda\Desktop\AdwCleaner[S0].txt
2014-01-19 13:17 - 2014-01-19 13:21 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-19 13:10 - 2014-01-19 13:10 - 01037068 _____ (Thisisu) C:\Users\Amanda\Desktop\JRT.exe
2014-01-19 13:08 - 2014-01-19 13:08 - 01236282 _____ C:\Users\Amanda\Desktop\adwcleaner.exe
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:48 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-18 16:48 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-18 16:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-18 16:47 - 2014-01-18 16:56 - 00000000 ____D C:\Qoobox
2014-01-18 16:47 - 2014-01-18 16:55 - 00000000 ____D C:\Windows\erdnt
2014-01-18 16:43 - 2014-01-18 16:44 - 05167985 ____R (Swearware) C:\Users\Amanda\Desktop\ComboFix.exe
2014-01-18 02:29 - 2014-01-18 02:30 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 01:49 - 2014-01-19 13:55 - 00016000 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:33 - 2014-01-19 13:55 - 00000000 ____D C:\FRST
2014-01-16 23:32 - 2014-01-19 13:55 - 02076672 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 14:53 - 2014-01-19 13:25 - 00000560 _____ C:\Windows\setupact.log
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:52 - 2014-01-18 17:13 - 00000872 _____ C:\Windows\PFRO.log
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:45 - 2014-01-19 13:56 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 01:45 - 2014-01-19 13:26 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 01:45 - 2014-01-16 01:51 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:45 - 2014-01-16 01:51 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:45 - 2014-01-16 01:47 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 12:28 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 12:28 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 12:28 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-12 19:29 - 2014-01-17 01:52 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 19:27 - 2014-01-17 00:56 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-17 01:52 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 19:25 - 2014-01-12 19:26 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-12 19:18 - 2014-01-12 19:19 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-08 23:43 - 2014-01-09 00:05 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:14 - 2014-01-08 23:15 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 23:10 - 2014-01-10 03:08 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 22:49 - 2014-01-08 22:50 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:04 - 2014-01-08 22:21 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:26 - 2014-01-07 22:45 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-17 17:10 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:55 - 2014-01-17 18:56 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:54 - 2014-01-17 18:56 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-04 12:45 - 2013-12-17 22:11 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-12-29 15:32 - 2013-12-29 21:30 - 00000000 ____D C:\Windows\Minidump
2013-12-27 19:03 - 2013-12-28 19:23 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:02 - 2014-01-04 12:44 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-25 01:35 - 2013-12-25 01:53 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:15 - 2013-12-23 13:49 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2007-09-10 08:50 - 00527360 _____ (PixArt Imaging Inc.) C:\Windows\system32\Drivers\PAC7302.SYS
2013-12-20 20:23 - 2007-09-05 17:01 - 00008704 _____ (PixArt Imaging Inc.) C:\Windows\system32\CoInst_070910.dll
2013-12-20 20:23 - 2007-08-27 11:36 - 00129024 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\SP7302.ax
2013-12-20 20:23 - 2007-03-20 16:44 - 00000566 _____ C:\Windows\SysWOW64\SP7302.ini
2013-12-20 20:23 - 2006-10-12 11:57 - 00014336 _____ (PixArt Imaging Inc.) C:\Windows\SysWOW64\P7302USD.dll
2013-12-20 19:49 - 2014-01-14 23:50 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2013-12-20 19:48 - 2013-12-20 19:49 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2014-01-19 13:56 - 2014-01-17 01:49 - 00016000 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-19 13:56 - 2014-01-16 01:45 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:55 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-19 13:55 - 2014-01-16 23:32 - 02076672 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-19 13:54 - 2014-01-19 13:54 - 00000897 _____ C:\Users\Amanda\Desktop\JRT.txt
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:35 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-19 13:35 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-19 13:27 - 2014-01-19 13:27 - 00008097 _____ C:\Users\Amanda\Desktop\AdwCleaner[S0].txt
2014-01-19 13:26 - 2014-01-16 01:45 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-19 13:26 - 2013-11-20 22:03 - 00000000 ___HD C:\ASUS.DAT
2014-01-19 13:25 - 2014-01-16 14:53 - 00000560 _____ C:\Windows\setupact.log
2014-01-19 13:25 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-19 13:24 - 2013-11-21 22:30 - 01197542 _____ C:\Windows\WindowsUpdate.log
2014-01-19 13:21 - 2014-01-19 13:17 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-19 13:10 - 2014-01-19 13:10 - 01037068 _____ (Thisisu) C:\Users\Amanda\Desktop\JRT.exe
2014-01-19 13:09 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\Random cool shit
2014-01-19 13:08 - 2014-01-19 13:08 - 01236282 _____ C:\Users\Amanda\Desktop\adwcleaner.exe
2014-01-19 04:45 - 2013-11-25 22:15 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\vlc
2014-01-19 00:12 - 2013-11-20 23:08 - 00000000 ____D C:\Users\Amanda\AppData\Local\Last.fm
2014-01-18 17:13 - 2014-01-16 14:52 - 00000872 _____ C:\Windows\PFRO.log
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:56 - 2014-01-18 16:47 - 00000000 ____D C:\Qoobox
2014-01-18 16:56 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-18 16:55 - 2014-01-18 16:47 - 00000000 ____D C:\Windows\erdnt
2014-01-18 16:54 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-18 16:44 - 2014-01-18 16:43 - 05167985 ____R (Swearware) C:\Users\Amanda\Desktop\ComboFix.exe
2014-01-18 12:08 - 2013-11-21 22:46 - 00002570 _____ C:\Windows\system32\AutoRunFilter.ini
2014-01-18 02:30 - 2014-01-18 02:29 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 18:56 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-17 18:56 - 2014-01-07 15:54 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-17 17:10 - 2014-01-07 15:58 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-17 12:06 - 2013-11-20 22:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-17 01:52 - 2014-01-12 19:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-17 01:52 - 2014-01-12 19:26 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-17 00:56 - 2014-01-12 19:27 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:31 - 2013-11-20 22:03 - 00000000 ____D C:\Users\Amanda
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 19:30 - 2013-11-20 23:03 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Winamp
2014-01-16 14:54 - 2013-11-21 22:46 - 00001430 _____ C:\Windows\system32\ServiceFilter.ini
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:53 - 2009-07-14 05:45 - 00305344 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-11-27 12:44 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 03:03 - 2013-11-20 23:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 03:00 - 2013-11-27 12:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 01:51 - 2014-01-16 01:45 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:51 - 2014-01-16 01:45 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:47 - 2014-01-16 01:45 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:47 - 2011-04-13 03:33 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-15 12:56 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\LEBENSLAUF--Bewerbungen
2014-01-15 12:31 - 2013-11-20 22:35 - 00000000 ____D C:\Users\Amanda\AppData\Local\Adobe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 00:18 - 2011-02-19 05:24 - 00708282 _____ C:\Windows\system32\perfh007.dat
2014-01-15 00:18 - 2011-02-19 05:24 - 00151886 _____ C:\Windows\system32\perfc007.dat
2014-01-15 00:18 - 2009-07-14 06:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-15 00:06 - 2013-12-07 22:51 - 00000000 ____D C:\Users\Amanda\Desktop\Luni
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-14 23:50 - 2013-12-20 19:49 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2014-01-13 15:38 - 2009-07-14 06:08 - 00032572 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-12 19:26 - 2014-01-12 19:25 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:19 - 2014-01-12 19:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-10 03:08 - 2014-01-08 23:10 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-09 00:05 - 2014-01-08 23:43 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:15 - 2014-01-08 23:14 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 22:50 - 2014-01-08 22:49 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:21 - 2014-01-08 22:04 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:45 - 2014-01-07 22:26 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-05 20:35 - 2013-11-20 23:42 - 00000000 ____D C:\Program Files\Adobe
2014-01-05 20:35 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-04 12:44 - 2013-12-25 02:02 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-30 20:27 - 2013-11-22 23:53 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-29 21:30 - 2013-12-29 15:32 - 00000000 ____D C:\Windows\Minidump
2013-12-28 19:23 - 2013-12-27 19:03 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 01:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Resources
2013-12-25 01:53 - 2013-12-25 01:35 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:49 - 2013-12-23 13:15 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:32 - 2013-11-21 22:48 - 00000000 ____D C:\ProgramData\CyberLink
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-21 12:23 - 2013-11-20 22:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:25 - 2009-07-14 03:34 - 00000536 _____ C:\Windows\win.ini
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2013-11-21 22:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-20 19:49 - 2013-12-20 19:48 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-20 13:47 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
Some content of TEMP:
====================
C:\Users\Amanda\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-10 18:17
==================== End Of Log ============================
|
|
20.01.2014, 12:09
| #9 |
| /// the machine /// TB-Ausbilder | Windows 7: System und Browser sehr langsam: G-Service als ursache?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.01.2014, 23:53
| #10 |
| | Windows 7: System und Browser sehr langsam: G-Service als ursache?Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1f48d1fb3990fc4ea5bb5cd5f4029fc4
# engine=16724
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-01-20 09:01:49
# local_time=2014-01-20 10:01:49 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 71 77 1927358 5272787 0 0
# compatibility_mode=5893 16776573 100 94 298322 141881559 0 0
# compatibility_mode=7937 16777214 28 75 1148594 25296957 0 0
# scanned=287012
# found=4
# cleaned=0
# scan_time=5448
sh=18C17FF38FCDE8AD5B46549A50FFD98A319956B5 ft=1 fh=862260e8ce4a17d6 vn="probably a variant of Win32/Toolbar.MyWebSearch.P application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\4jskin.dll.vir"
sh=F168820EBBB25A99251B35F4328E09BB914DCC9A ft=1 fh=bab93d68c29f066d vn="a variant of Win64/Toolbar.MyWebSearch.A application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe.vir"
sh=A6AD21A19469FB3650387953DDA171CF78464458 ft=1 fh=8261ecd8fca1a29c vn="a variant of Win64/Toolbar.MyWebSearch.A application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegratorStub64.dll.vir"
sh=B879BC93FA5D87733EDC9FD055A6AF538A554074 ft=1 fh=a792084cb5dc54a4 vn="a variant of Win64/Toolbar.MyWebSearch.A application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\Hpg64.dll.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spyware Terminator 2012 Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.9.900.152 Adobe Reader XI Mozilla Firefox (26.0) Google Chrome 32.0.1700.76 ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2014
Ran by Amanda (administrator) on ASUS on 20-01-2014 22:36:32
Running from C:\Users\Amanda\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Windows\AsScrPro.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] - "C:\PROGRA~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [GoogleChromeAutoLaunch_B5BA1AC00E9D5F3D11339DA34D270473] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [866584 2014-01-11] (Google Inc.)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\system32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default
FF SearchEngineOrder.user_pref("browser.search.order.2", "");: user_pref("browser.search.order.2", "");
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Amanda\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-16]
FF Extension: Heart Button - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ffextension@weheartit.com.xpi [2013-11-20]
FF Extension: Tumblr Savior - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi [2013-11-28]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-28]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2013-12-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-20]
Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-01-16]
CHR Extension: (Google Docs) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-16]
CHR Extension: (YouTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-16]
CHR Extension: (Chrome YouTube Downloader) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdjiinahkdjdcdlgfimlcolkjpbooja [2014-01-18]
CHR Extension: (Google-Suche) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-16]
CHR Extension: (AdBlock) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-16]
CHR Extension: (avast! Online Security) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-16]
CHR Extension: (YouTube Unblocker) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2014-01-17]
CHR Extension: (Google Mail) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-16]
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\Amanda\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-11-20]
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-20] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-20] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2013-12-17] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527360 2007-09-10] (PixArt Imaging Inc.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-07] (Windows (R) Win 7 DDK provider)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-11-13] (Anchorfree Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-20 22:36 - 2014-01-20 22:36 - 00016986 _____ C:\Users\Amanda\Desktop\FRST.txt
2014-01-20 22:35 - 2014-01-20 22:35 - 00000911 _____ C:\Users\Amanda\Desktop\checkup.txt
2014-01-20 22:26 - 2014-01-20 22:26 - 00987425 _____ C:\Users\Amanda\Downloads\SecurityCheck.exe
2014-01-20 18:03 - 2014-01-20 18:03 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:17 - 2014-01-19 13:21 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:48 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-18 16:48 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-18 16:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-18 16:47 - 2014-01-18 16:56 - 00000000 ____D C:\Qoobox
2014-01-18 16:47 - 2014-01-18 16:55 - 00000000 ____D C:\Windows\erdnt
2014-01-18 02:29 - 2014-01-18 02:30 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 01:49 - 2014-01-19 13:56 - 00039110 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:33 - 2014-01-19 13:55 - 00000000 ____D C:\FRST
2014-01-16 23:32 - 2014-01-19 13:55 - 02076672 _____ (Farbar) C:\Users\Amanda\Desktop\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 14:53 - 2014-01-20 14:31 - 00000840 _____ C:\Windows\setupact.log
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:52 - 2014-01-18 17:13 - 00000872 _____ C:\Windows\PFRO.log
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:45 - 2014-01-20 21:56 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 01:45 - 2014-01-20 12:02 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 01:45 - 2014-01-16 01:51 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:45 - 2014-01-16 01:51 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:45 - 2014-01-16 01:47 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 12:28 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 12:28 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 12:28 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-12 19:29 - 2014-01-17 01:52 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 19:27 - 2014-01-17 00:56 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-17 01:52 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 19:25 - 2014-01-12 19:26 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-12 19:18 - 2014-01-12 19:19 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-08 23:43 - 2014-01-09 00:05 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:14 - 2014-01-08 23:15 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 23:10 - 2014-01-19 14:03 - 01672414 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 22:49 - 2014-01-08 22:50 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:04 - 2014-01-08 22:21 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:26 - 2014-01-07 22:45 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-20 12:04 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:55 - 2014-01-17 18:56 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:54 - 2014-01-17 18:56 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-04 12:45 - 2013-12-17 22:11 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-12-29 15:32 - 2013-12-29 21:30 - 00000000 ____D C:\Windows\Minidump
2013-12-27 19:03 - 2013-12-28 19:23 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:02 - 2014-01-04 12:44 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-25 01:35 - 2013-12-25 01:53 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:15 - 2013-12-23 13:49 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
==================== One Month Modified Files and Folders =======
2014-01-20 22:36 - 2014-01-20 22:36 - 00016986 _____ C:\Users\Amanda\Desktop\FRST.txt
2014-01-20 22:35 - 2014-01-20 22:35 - 00000911 _____ C:\Users\Amanda\Desktop\checkup.txt
2014-01-20 22:26 - 2014-01-20 22:26 - 00987425 _____ C:\Users\Amanda\Downloads\SecurityCheck.exe
2014-01-20 22:23 - 2013-11-21 22:30 - 01290627 _____ C:\Windows\WindowsUpdate.log
2014-01-20 21:56 - 2014-01-16 01:45 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-20 18:03 - 2014-01-20 18:03 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-20 14:31 - 2014-01-16 14:53 - 00000840 _____ C:\Windows\setupact.log
2014-01-20 13:34 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\LEBENSLAUF--Bewerbungen
2014-01-20 12:10 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-20 12:10 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-20 12:04 - 2014-01-07 15:58 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-20 12:02 - 2014-01-16 01:45 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-20 12:02 - 2013-11-20 22:03 - 00000000 ___HD C:\ASUS.DAT
2014-01-20 12:00 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-19 21:39 - 2013-11-20 23:08 - 00000000 ____D C:\Users\Amanda\AppData\Local\Last.fm
2014-01-19 14:03 - 2014-01-08 23:10 - 01672414 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-19 14:03 - 2011-02-19 05:24 - 00711224 _____ C:\Windows\system32\perfh007.dat
2014-01-19 14:03 - 2011-02-19 05:24 - 00152768 _____ C:\Windows\system32\perfc007.dat
2014-01-19 13:56 - 2014-01-17 01:49 - 00039110 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:55 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-19 13:55 - 2014-01-16 23:32 - 02076672 _____ (Farbar) C:\Users\Amanda\Desktop\FRST64.exe
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:21 - 2014-01-19 13:17 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-19 13:09 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\Random cool shit
2014-01-19 04:45 - 2013-11-25 22:15 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\vlc
2014-01-18 17:13 - 2014-01-16 14:52 - 00000872 _____ C:\Windows\PFRO.log
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:56 - 2014-01-18 16:47 - 00000000 ____D C:\Qoobox
2014-01-18 16:56 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-18 16:55 - 2014-01-18 16:47 - 00000000 ____D C:\Windows\erdnt
2014-01-18 16:54 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-18 12:08 - 2013-11-21 22:46 - 00002570 _____ C:\Windows\system32\AutoRunFilter.ini
2014-01-18 02:30 - 2014-01-18 02:29 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 18:56 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-17 18:56 - 2014-01-07 15:54 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-17 12:06 - 2013-11-20 22:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-17 01:52 - 2014-01-12 19:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-17 01:52 - 2014-01-12 19:26 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-17 00:56 - 2014-01-12 19:27 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:31 - 2013-11-20 22:03 - 00000000 ____D C:\Users\Amanda
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 19:30 - 2013-11-20 23:03 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Winamp
2014-01-16 14:54 - 2013-11-21 22:46 - 00001430 _____ C:\Windows\system32\ServiceFilter.ini
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:53 - 2009-07-14 05:45 - 00305344 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-11-27 12:44 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 03:03 - 2013-11-20 23:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 03:00 - 2013-11-27 12:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 01:51 - 2014-01-16 01:45 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:51 - 2014-01-16 01:45 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:47 - 2014-01-16 01:45 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:47 - 2011-04-13 03:33 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-15 12:31 - 2013-11-20 22:35 - 00000000 ____D C:\Users\Amanda\AppData\Local\Adobe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 00:18 - 2009-07-14 06:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-15 00:06 - 2013-12-07 22:51 - 00000000 ____D C:\Users\Amanda\Desktop\Luni
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-14 23:50 - 2013-12-20 19:49 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2014-01-13 15:38 - 2009-07-14 06:08 - 00032572 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-12 19:26 - 2014-01-12 19:25 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:19 - 2014-01-12 19:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-09 00:05 - 2014-01-08 23:43 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:15 - 2014-01-08 23:14 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 22:50 - 2014-01-08 22:49 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:21 - 2014-01-08 22:04 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:45 - 2014-01-07 22:26 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-05 20:35 - 2013-11-20 23:42 - 00000000 ____D C:\Program Files\Adobe
2014-01-05 20:35 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-04 12:44 - 2013-12-25 02:02 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-30 20:27 - 2013-11-22 23:53 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-29 21:30 - 2013-12-29 15:32 - 00000000 ____D C:\Windows\Minidump
2013-12-28 19:23 - 2013-12-27 19:03 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 01:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Resources
2013-12-25 01:53 - 2013-12-25 01:35 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:49 - 2013-12-23 13:15 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:32 - 2013-11-21 22:48 - 00000000 ____D C:\ProgramData\CyberLink
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-21 12:23 - 2013-11-20 22:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
Some content of TEMP:
====================
C:\Users\Amanda\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-19 18:22
==================== End Of Log ============================
|
|
21.01.2014, 17:29
| #11 |
| /// the machine /// TB-Ausbilder | Windows 7: System und Browser sehr langsam: G-Service als ursache? Fertig Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: System und Browser sehr langsam: G-Service als ursache? |
| antivir, avast, browser, cpu auslastung, formatieren, g-service, gen, gservice, langsam, laptop, malwarebytes, programm, recovery, seite, spyhunter, spyhunter entfernen, störungen, system, unbekannt, virenscanner, win32/toolbar.mywebsearch.p, win64/toolbar.mywebsearch.a, windows |
Linear-Darstellung
