| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Absturz des Laptops bei jedem Viren ScanWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
03.09.2014, 19:54
| #5 |
| |  Absturz des Laptops bei jedem Viren ScanCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2014 01
Ran by Sedina K at 2014-09-03 15:52:52 Run:1
Running from C:\Users\Sedina K\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]
S2 mcbootdelaystartsvc; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
CHR HKLM-x32\...\Chrome\Extension: [gnfaiijpfcmdehcgcnnippmnhjjnbllp] - C:\Program Files (x86)\Blingee Plus\blingee_plus_nt.crx []
CHR HKLM-x32\...\Chrome\Extension: [inemjdopipfdlbnbpjjnjkebpknphoba] - C:\Program Files (x86)\Blingee Plus\blingee_plus_si.crx []
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR Extension: (Avira Browser Safety) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-03]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: Blingee Toolbar - C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\Extensions\{6226BA26-C017-4007-928C-DE9715C6FA67}.xpi [2014-06-13]
*****************
AntiVirWebService => Service deleted successfully.
mcbootdelaystartsvc => Service deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gnfaiijpfcmdehcgcnnippmnhjjnbllp" => Key deleted successfully.
"C:\Program Files (x86)\Blingee Plus\blingee_plus_nt.crx" => File/Directory not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\inemjdopipfdlbnbpjjnjkebpknphoba" => Key deleted successfully.
"C:\Program Files (x86)\Blingee Plus\blingee_plus_si.crx" => File/Directory not found.
"HKCU\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => Moved successfully.
HKLM\Software\Wow6432Node\Mozilla\Thunderbird\Extensions\\msktbird@mcafee.com => value deleted successfully.
C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\Extensions\{6226BA26-C017-4007-928C-DE9715C6FA67}.xpi => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter # AdwCleaner v3.309 - Bericht erstellt am 03/09/2014 um 16:02:32
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzername : Sedina K - SEDINA
# Gestartet von : C:\Users\Sedina K\Downloads\adwcleaner_3.309.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\AVG SafeGuard toolbar
Ordner Gelöscht : C:\ProgramData\AVG Secure Search
Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar
Ordner Gelöscht : C:\Program Files (x86)\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Program Files (x86)\AVG Security Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search
[!] Ordner Gelöscht : C:\Users\Sedina K\AppData\Local\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Users\Sedina K\AppData\LocalLow\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\Extensions\Avg@toolbar
Datei Gelöscht : C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\searchplugins\avg-secure-search.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKCU\Software\AVG SafeGuard toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG SafeGuard toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.17054
-\\ Mozilla Firefox v30.0 (de)
[ Datei : C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\prefs.js ]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "AVG Secure Search");
-\\ Google Chrome v36.0.1985.143
*************************
AdwCleaner[R0].txt - [7687 octets] - [20/08/2014 00:22:11]
AdwCleaner[R1].txt - [5849 octets] - [03/09/2014 16:00:29]
AdwCleaner[S0].txt - [5948 octets] - [20/08/2014 00:23:08]
AdwCleaner[S1].txt - [5475 octets] - [03/09/2014 16:02:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5535 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Sedina K on 03.09.2014 at 16:07:35,08
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1255148651-4057963442-3932389802-1001\Software\sweetim
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Successfully deleted the following from C:\Users\Sedina K\AppData\Roaming\mozilla\firefox\profiles\b4i5e3jt.default\prefs.js
user_pref("browser.startup.homepage", "hxxps://mysearch.avg.com?cid={B50C8B25-CA33-4CF3-9490-6D4399B655DD}&mid=960c3d6119db47d29d14a5996dec70f1-2d69af40bc8f83db3f26392d5f7c897
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.09.2014 at 16:14:09,92
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[QUOTE=Sedi1952;1353526] Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-09-2014 01
Ran by Sedina K at 2014-09-03 15:52:52 Run:1
Running from C:\Users\Sedina K\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]
S2 mcbootdelaystartsvc; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
CHR HKLM-x32\...\Chrome\Extension: [gnfaiijpfcmdehcgcnnippmnhjjnbllp] - C:\Program Files (x86)\Blingee Plus\blingee_plus_nt.crx []
CHR HKLM-x32\...\Chrome\Extension: [inemjdopipfdlbnbpjjnjkebpknphoba] - C:\Program Files (x86)\Blingee Plus\blingee_plus_si.crx []
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR Extension: (Avira Browser Safety) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-03]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: Blingee Toolbar - C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\Extensions\{6226BA26-C017-4007-928C-DE9715C6FA67}.xpi [2014-06-13]
*****************
AntiVirWebService => Service deleted successfully.
mcbootdelaystartsvc => Service deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gnfaiijpfcmdehcgcnnippmnhjjnbllp" => Key deleted successfully.
"C:\Program Files (x86)\Blingee Plus\blingee_plus_nt.crx" => File/Directory not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\inemjdopipfdlbnbpjjnjkebpknphoba" => Key deleted successfully.
"C:\Program Files (x86)\Blingee Plus\blingee_plus_si.crx" => File/Directory not found.
"HKCU\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => Moved successfully.
HKLM\Software\Wow6432Node\Mozilla\Thunderbird\Extensions\\msktbird@mcafee.com => value deleted successfully.
C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\Extensions\{6226BA26-C017-4007-928C-DE9715C6FA67}.xpi => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter # AdwCleaner v3.309 - Bericht erstellt am 03/09/2014 um 16:02:32
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzername : Sedina K - SEDINA
# Gestartet von : C:\Users\Sedina K\Downloads\adwcleaner_3.309.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\AVG SafeGuard toolbar
Ordner Gelöscht : C:\ProgramData\AVG Secure Search
Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar
Ordner Gelöscht : C:\Program Files (x86)\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Program Files (x86)\AVG Security Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search
[!] Ordner Gelöscht : C:\Users\Sedina K\AppData\Local\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Users\Sedina K\AppData\LocalLow\AVG SafeGuard toolbar
Ordner Gelöscht : C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\Extensions\Avg@toolbar
Datei Gelöscht : C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\searchplugins\avg-secure-search.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKCU\Software\AVG SafeGuard toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG SafeGuard toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.17054
-\\ Mozilla Firefox v30.0 (de)
[ Datei : C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\prefs.js ]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "AVG Secure Search");
-\\ Google Chrome v36.0.1985.143
*************************
AdwCleaner[R0].txt - [7687 octets] - [20/08/2014 00:22:11]
AdwCleaner[R1].txt - [5849 octets] - [03/09/2014 16:00:29]
AdwCleaner[S0].txt - [5948 octets] - [20/08/2014 00:23:08]
AdwCleaner[S1].txt - [5475 octets] - [03/09/2014 16:02:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [5535 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Sedina K on 03.09.2014 at 16:07:35,08
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1255148651-4057963442-3932389802-1001\Software\sweetim
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Successfully deleted the following from C:\Users\Sedina K\AppData\Roaming\mozilla\firefox\profiles\b4i5e3jt.default\prefs.js
user_pref("browser.startup.homepage", "hxxps://mysearch.avg.com?cid={B50C8B25-CA33-4CF3-9490-6D4399B655DD}&mid=960c3d6119db47d29d14a5996dec70f1-2d69af40bc8f83db3f26392d5f7c897
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.09.2014 at 16:14:09,92
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 03.09.2014 Suchlauf-Zeit: 16:17:35 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.03.04 Rootkit Datenbank: v2014.08.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 8 CPU: x64 Dateisystem: NTFS Benutzer: Sedina K Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 314460 Verstrichene Zeit: 14 Min, 32 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 01 Ran by Sedina K (administrator) on SEDINA on 03-09-2014 19:31:50 Running from C:\Users\Sedina K\Desktop\Neuer Ordner Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe (ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIJJE.EXE (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIJJE.EXE (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe () C:\ProgramData\Avg_Update_0814av\AVG-Secure-Search-Update_0814av.exe () C:\Users\Sedina K\AppData\Roaming\Avg_Update_0814av\AVG-Secure-Search-Update_0814av.exe (AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe () C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.218\deploy\LoLLauncher.exe () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.2\deploy\LoLPatcher.exe () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.2\deploy\LoLPatcher.exe () C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.2\deploy\LoLPatcher.exe (Farbar) C:\Users\Sedina K\Desktop\Neuer Ordner\FRST64 (1).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [ACMON] => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-09-11] (ASUS) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2012-11-27] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe [3423104 2012-08-31] (ASUS Cloud Corporation) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.) HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-20] (Nullsoft, Inc.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502952 2012-07-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863400 2012-07-09] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.) HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3600728 2014-08-07] (Electronic Arts) HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\Run: [Spotify] => C:\Users\Sedina K\AppData\Roaming\Spotify\Spotify.exe [6162488 2014-08-07] (Spotify Ltd) HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\Run: [Spotify Web Helper] => C:\Users\Sedina K\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1178168 2014-08-07] (Spotify Ltd) HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\Run: [AVG-Secure-Search-Update_0814av] => C:\Users\Sedina K\AppData\Roaming\Avg_Update_0814av\AVG-Secure-Search-Update_0814av.exe [2775576 2014-08-12] () HKU\S-1-5-21-1255148651-4057963442-3932389802-1001\...\RunOnce: [Uninstall C:\Users\Sedina K\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Sedina K\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64" ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: AsusWSShellExt_U -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default FF Keyword.URL: user_pref("keyword.URL", ""); FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Sedina K\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\Sedina K\AppData\Roaming\Mozilla\Firefox\Profiles\b4i5e3jt.default\extensions\{6226BA26-C017-4007-928C-DE9715C6FA67}.xpi [] Chrome: ======= CHR Profile: C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-03] CHR Extension: (Google Drive) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-03] CHR Extension: (YouTube) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-03] CHR Extension: (Google-Suche) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-03] CHR Extension: (Avira Browser Safety) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-03] CHR Extension: (Google Wallet) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31] CHR Extension: (Google Mail) - C:\Users\Sedina K\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-03] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.) R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation) S2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation) S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-21] (AVG Technologies) R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.) S3 esihdrv; C:\Users\Sedina K\AppData\Local\Temp\esihdrv.sys [122240 2014-07-25] (ESET) R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( ) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-03] (Malwarebytes Corporation) S3 Netaapl; C:\Windows\system32\DRIVERS\netaapl64.sys [22528 2012-09-10] (Apple Inc.) [File not signed] U0 msahci; No ImagePath ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-03 19:29 - 2014-09-03 19:29 - 00001145 _____ () C:\Users\Sedina K\Desktop\mbam.txt 2014-09-03 19:26 - 2014-09-03 19:26 - 00002474 _____ () C:\Users\Sedina K\Desktop\mbam-log-2014-09-03 (18-57-32).xml 2014-09-03 17:46 - 2014-09-03 17:46 - 00002892 _____ () C:\Windows\System32\Tasks\AVG_SYS_TASK_0814av_DELETE 2014-09-03 17:46 - 2014-09-03 17:46 - 00002816 _____ () C:\Windows\System32\Tasks\AVG_SYS_TASK_0814av 2014-09-03 17:46 - 2014-09-03 17:46 - 00000542 _____ () C:\Windows\Tasks\AVG_SYS_TASK_0814av.job 2014-09-03 17:46 - 2014-09-03 17:46 - 00000410 _____ () C:\Windows\Tasks\AVG_SYS_TASK_0814av_DELETE.job 2014-09-03 17:46 - 2014-09-03 17:46 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Avg_Update_0814av 2014-09-03 17:45 - 2014-09-03 17:45 - 00000000 ____D () C:\ProgramData\Avg_Update_0814av 2014-09-03 16:15 - 2014-09-03 16:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sedina K\Downloads\mbam-setup-2.0.2.1012 (2).exe 2014-09-03 16:14 - 2014-09-03 16:14 - 00001317 _____ () C:\Users\Sedina K\Desktop\JRT.txt 2014-09-03 16:07 - 2014-09-03 16:07 - 01016261 _____ (Thisisu) C:\Users\Sedina K\Downloads\JRT.exe 2014-09-03 16:07 - 2014-09-03 16:07 - 00000000 ____D () C:\Windows\ERUNT 2014-09-03 16:00 - 2014-09-03 16:00 - 01370483 _____ () C:\Users\Sedina K\Downloads\adwcleaner_3.309.exe 2014-09-03 15:57 - 2014-09-03 19:31 - 00000000 ____D () C:\Users\Sedina K\Desktop\Neuer Ordner 2014-09-03 15:03 - 2014-09-03 19:31 - 00000000 ____D () C:\FRST 2014-09-03 15:01 - 2014-09-03 15:01 - 02104832 _____ (Farbar) C:\Users\Sedina K\Downloads\FRST64.exe 2014-09-03 14:19 - 2014-09-03 14:19 - 02347384 _____ (ESET) C:\Users\Sedina K\Downloads\esetsmartinstaller_deu.exe 2014-09-03 14:19 - 2014-09-03 14:19 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-09-03 14:19 - 2014-06-26 07:44 - 00535304 _____ (ESET) C:\Users\Sedina K\Desktop\OnlineScannerApp.exe 2014-09-03 14:18 - 2014-09-03 14:18 - 05412944 _____ (Canneverbe Limited ) C:\Users\Sedina K\Downloads\cdbxp_setup_4.5.4.5000_minimal (1).exe 2014-09-03 14:18 - 2014-09-03 14:18 - 00001955 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk 2014-09-03 14:18 - 2014-09-03 14:18 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk 2014-09-03 14:18 - 2014-09-03 14:18 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Canneverbe Limited 2014-09-03 14:18 - 2014-09-03 14:18 - 00000000 ____D () C:\ProgramData\Canneverbe Limited 2014-09-03 14:18 - 2014-09-03 14:18 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP 2014-08-30 21:35 - 2014-08-30 21:35 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-08-30 21:35 - 2014-08-30 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-08-30 21:33 - 2014-08-30 21:35 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-08-30 21:33 - 2014-08-30 21:35 - 00000000 ____D () C:\Program Files\iTunes 2014-08-30 21:33 - 2014-08-30 21:35 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-08-30 21:33 - 2014-08-30 21:33 - 00000000 ____D () C:\Program Files\iPod 2014-08-30 21:11 - 2014-08-30 21:11 - 00000000 ____D () C:\ProgramData\Avg_Update_0814tb 2014-08-30 18:17 - 2014-08-30 18:17 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software 2014-08-30 18:17 - 2014-08-30 18:17 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software 2014-08-21 17:13 - 2014-09-03 16:03 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\AVG SafeGuard toolbar 2014-08-21 17:13 - 2014-08-21 17:21 - 00000386 _____ () C:\Windows\Tasks\Open Chrome.job 2014-08-21 17:13 - 2014-08-21 17:13 - 00002614 _____ () C:\Windows\System32\Tasks\Open Chrome 2014-08-21 17:13 - 2014-08-21 17:13 - 00000222 _____ () C:\Users\Sedina K\Desktop\Robocraft.url 2014-08-21 17:12 - 2014-08-21 17:12 - 00050976 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys 2014-08-20 01:55 - 2014-08-20 01:55 - 00000000 ____D () C:\OETemp 2014-08-20 01:50 - 2014-08-20 01:51 - 00283752 _____ () C:\Windows\Minidump\082014-69843-01.dmp 2014-08-20 01:42 - 2014-08-20 01:42 - 00000295 _____ () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Papierkorb (2).lnk 2014-08-20 01:27 - 2014-08-20 01:27 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\AVG2014 2014-08-20 01:26 - 2014-08-30 18:17 - 00000983 _____ () C:\Users\Public\Desktop\AVG 2014.lnk 2014-08-20 01:26 - 2014-08-30 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2014-08-20 01:26 - 2014-08-20 01:27 - 00000000 ____D () C:\ProgramData\AVG2014 2014-08-20 01:26 - 2014-08-20 01:26 - 00000000 ___HD () C:\$AVG 2014-08-20 01:26 - 2014-08-20 01:26 - 00000000 ____D () C:\Program Files (x86)\AVG 2014-08-20 01:24 - 2014-09-03 17:45 - 00000000 ____D () C:\ProgramData\MFAData 2014-08-20 01:24 - 2014-08-20 01:41 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\Avg2014 2014-08-20 01:24 - 2014-08-20 01:24 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\MFAData 2014-08-20 01:21 - 2014-08-20 01:22 - 158049496 _____ (AVG Technologies) C:\Users\Sedina K\Downloads\avg_free_x86_all_2014_4745a8017.exe 2014-08-20 00:35 - 2014-08-20 00:35 - 00000085 _____ () C:\Windows\wininit.ini 2014-08-20 00:30 - 2014-09-03 16:16 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-20 00:30 - 2014-09-03 16:16 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-20 00:30 - 2014-09-03 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-20 00:30 - 2014-09-03 16:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-08-20 00:30 - 2014-08-20 00:30 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-20 00:30 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-20 00:30 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-20 00:30 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-08-20 00:22 - 2014-09-03 16:02 - 00000000 ____D () C:\AdwCleaner 2014-08-20 00:22 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-08-20 00:19 - 2014-08-20 00:20 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sedina K\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-20 00:19 - 2014-08-20 00:20 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sedina K\Downloads\mbam-setup-2.0.2.1012 (1).exe 2014-08-20 00:17 - 2014-08-20 00:17 - 01361671 _____ () C:\Users\Sedina K\Downloads\adwcleaner_3.307.exe 2014-08-20 00:15 - 2014-08-20 00:15 - 03007700 _____ () C:\Users\Sedina K\Downloads\revouninstaller.zip 2014-08-20 00:14 - 2014-08-20 00:14 - 01093632 _____ (Farbar) C:\Users\Sedina K\Downloads\FRST.exe 2014-08-19 23:57 - 2014-08-19 23:57 - 00000000 ____D () C:\Users\Sedina K\Downloads\NRaas_DebugEnabler_V54 2014-08-19 23:56 - 2014-08-19 23:56 - 00181923 _____ () C:\Users\Sedina K\Downloads\NRaas_DebugEnabler_V54.zip 2014-08-19 19:43 - 2014-08-20 01:26 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\TuneUp Software 2014-08-19 19:43 - 2014-08-19 19:44 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-08-19 19:43 - 2014-08-19 19:43 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\TuneUp Software 2014-08-19 19:42 - 2014-08-19 19:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-08-19 19:41 - 2014-08-20 00:28 - 00001360 _____ () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2014-08-19 19:40 - 2014-08-19 19:40 - 00001538 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk 2014-08-19 19:37 - 2014-08-19 19:37 - 29553288 _____ (DVDVideoSoft Ltd. ) C:\Users\Sedina K\Downloads\FreeYouTubeToMP3Converter.exe 2014-08-19 19:30 - 2014-08-02 02:15 - 00704480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-08-19 19:30 - 2014-08-02 02:15 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-08-19 03:03 - 2014-08-19 03:03 - 00332128 _____ (Playtech) C:\Users\Sedina K\Downloads\SetupPoker.exe 2014-08-18 07:31 - 2014-07-16 00:51 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys 2014-08-17 03:07 - 2014-08-17 03:07 - 00000000 ___HD () C:\$Windows.~BT 2014-08-15 20:30 - 2014-06-11 00:44 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-15 20:30 - 2014-06-11 00:43 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-15 18:24 - 2014-08-07 08:33 - 00712192 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-15 18:24 - 2014-08-07 05:09 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-15 17:56 - 2014-06-13 03:57 - 01453400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-15 17:56 - 2014-06-13 03:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-08-15 17:55 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-15 17:55 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-15 17:55 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-15 17:55 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-15 17:55 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-15 17:55 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-15 17:54 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-15 17:54 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-15 17:54 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-15 17:54 - 2014-07-24 14:10 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2014-08-15 17:54 - 2014-07-24 14:10 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-15 17:54 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-15 17:54 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-15 17:54 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-15 17:54 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-15 17:54 - 2014-07-24 12:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-15 17:54 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-15 17:54 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-15 17:53 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-15 17:53 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-15 17:53 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-15 17:53 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-15 17:53 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-15 17:53 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-15 17:53 - 2014-07-24 10:03 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll 2014-08-15 17:53 - 2014-07-16 01:03 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-15 17:53 - 2014-07-16 00:55 - 04035072 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-15 17:53 - 2014-07-12 04:36 - 01023488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-15 17:53 - 2014-06-20 01:35 - 01312768 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-15 17:53 - 2014-06-20 00:24 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-15 17:52 - 2014-06-05 19:30 - 10116608 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2014-08-15 17:52 - 2014-06-05 19:29 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-15 17:52 - 2014-06-05 19:28 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-15 17:52 - 2014-06-05 19:28 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2014-08-15 17:52 - 2014-06-05 15:12 - 08857600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll 2014-08-15 17:52 - 2014-06-05 15:11 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-15 17:51 - 2014-06-05 19:56 - 00112984 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-15 17:51 - 2014-06-05 19:29 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-15 17:51 - 2014-06-05 15:11 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-15 17:51 - 2014-06-05 15:10 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-15 17:51 - 2014-06-05 15:10 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll 2014-08-15 17:51 - 2014-05-29 06:04 - 00094552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2014-08-15 17:51 - 2014-05-08 03:34 - 00328024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____H () C:\ProgramData\DP45977C.lfl 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Realtek 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____D () C:\Program Files\Realtek 2014-08-10 22:16 - 2014-05-06 21:20 - 03956056 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys 2014-08-10 22:16 - 2014-05-06 16:51 - 60955136 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat 2014-08-10 22:16 - 2014-05-05 15:15 - 01057494 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT 2014-08-10 22:16 - 2014-05-02 11:19 - 00033592 _____ () C:\Windows\system32\audioLibVc.dll 2014-08-10 22:16 - 2014-04-30 11:34 - 00948952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll 2014-08-10 22:16 - 2014-04-28 15:48 - 02800344 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll 2014-08-10 22:16 - 2014-04-25 13:51 - 02834648 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll 2014-08-10 22:16 - 2014-04-25 13:23 - 01022168 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll 2014-08-10 22:16 - 2014-04-23 17:51 - 02117424 _____ () C:\Windows\system32\SStudio.dll 2014-08-10 22:16 - 2014-04-17 17:42 - 01317976 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll 2014-08-10 22:16 - 2014-04-17 17:42 - 01168472 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll 2014-08-10 22:16 - 2014-04-17 17:42 - 01136728 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll 2014-08-10 22:16 - 2014-04-10 12:20 - 12894808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll 2014-08-10 22:16 - 2014-04-10 12:20 - 01934424 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek264.dll 2014-08-10 22:16 - 2014-04-10 12:19 - 28343384 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnA64.dll 2014-08-10 22:16 - 2014-04-10 12:19 - 14863448 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll 2014-08-10 22:16 - 2014-04-10 12:19 - 03959384 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnN64.dll 2014-08-10 22:16 - 2014-04-10 12:19 - 02101848 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll 2014-08-10 22:16 - 2014-04-10 12:19 - 02041432 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll 2014-08-10 22:16 - 2014-04-10 12:19 - 01063512 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll 2014-08-10 22:16 - 2014-04-10 12:19 - 00900696 _____ (Waves Audio Ltd.) C:\Windows\SysWOW64\MaxxAudioAPOShell.dll 2014-08-10 22:16 - 2014-04-09 16:39 - 00942384 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOSettingsIPC.dll 2014-08-10 22:16 - 2014-04-09 16:38 - 05751048 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll 2014-08-10 22:16 - 2014-04-07 16:03 - 06218072 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll 2014-08-10 22:16 - 2014-04-07 16:03 - 01939800 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll 2014-08-10 22:16 - 2014-04-07 16:03 - 00315736 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll 2014-08-10 22:16 - 2014-04-07 16:03 - 00261464 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll 2014-08-10 22:16 - 2014-03-28 18:03 - 00628952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll 2014-08-10 22:16 - 2014-03-21 14:17 - 00291488 _____ (ICEpower a/s) C:\Windows\system32\ICEsoundAPO64.dll 2014-08-10 22:16 - 2014-03-19 19:19 - 00956504 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll 2014-08-10 22:16 - 2014-03-06 16:35 - 01959128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl 2014-08-10 22:16 - 2014-03-05 05:11 - 01048824 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt64.dll 2014-08-10 22:16 - 2014-03-05 05:11 - 00889592 _____ (DTS, Inc.) C:\Windows\system32\sl3apo64.dll 2014-08-10 22:16 - 2014-03-05 05:11 - 00724728 _____ (DTS, Inc.) C:\Windows\system32\sltech64.dll 2014-08-10 22:16 - 2014-03-05 05:11 - 00246008 _____ (TODO: <Company name>) C:\Windows\system32\slprp64.dll 2014-08-10 22:16 - 2014-02-27 20:02 - 02162992 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE.dll 2014-08-10 22:16 - 2014-02-26 15:16 - 02080472 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll 2014-08-10 22:16 - 2014-02-18 17:04 - 02770976 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll 2014-08-10 22:16 - 2014-02-06 11:28 - 05804772 _____ () C:\Windows\system32\Drivers\rtvienna.dat 2014-08-10 22:16 - 2014-01-31 17:27 - 01313904 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxSpeechAPO64.dll 2014-08-10 22:16 - 2014-01-28 11:48 - 01286872 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll 2014-08-10 22:16 - 2013-10-16 03:43 - 00209096 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll 2014-08-10 22:16 - 2013-10-11 12:47 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll 2014-08-10 22:16 - 2013-10-11 11:31 - 00947760 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll 2014-08-10 22:16 - 2013-10-07 00:26 - 00501184 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll 2014-08-10 22:16 - 2013-10-07 00:26 - 00487360 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll 2014-08-10 22:16 - 2013-10-07 00:26 - 00415680 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll 2014-08-10 22:16 - 2013-08-14 15:36 - 00662784 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll 2014-08-10 22:16 - 2013-08-14 15:35 - 00663296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll 2014-08-10 22:16 - 2013-06-25 12:47 - 00871856 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll 2014-08-10 22:16 - 2013-06-25 12:47 - 00162224 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll 2014-08-10 22:16 - 2013-06-25 12:46 - 00582056 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll 2014-08-10 22:16 - 2013-06-21 11:01 - 00109848 _____ () C:\Windows\system32\AcpiServiceVnA64.dll 2014-08-10 22:16 - 2013-04-03 14:13 - 00906800 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll 2014-08-10 22:16 - 2012-08-31 19:18 - 07164176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll 2014-08-10 22:16 - 2012-08-31 19:17 - 00434960 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll 2014-08-10 22:16 - 2012-08-31 19:17 - 00141584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll 2014-08-10 22:16 - 2012-08-31 19:17 - 00124176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll 2014-08-10 22:16 - 2012-08-31 19:17 - 00075024 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll 2014-08-10 22:16 - 2012-03-08 11:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll 2014-08-10 22:16 - 2012-01-30 11:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll 2014-08-10 22:16 - 2012-01-10 10:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll 2014-08-10 22:16 - 2011-12-20 15:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll 2014-08-10 22:16 - 2011-11-22 16:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll 2014-08-10 22:16 - 2011-09-02 14:21 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll 2014-08-10 22:16 - 2011-09-02 14:21 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll 2014-08-10 22:16 - 2011-09-02 14:21 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll 2014-08-10 22:16 - 2011-08-23 17:00 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll 2014-08-10 22:16 - 2011-05-31 09:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll 2014-08-10 22:16 - 2011-03-17 12:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll 2014-08-10 22:16 - 2011-03-07 17:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll 2014-08-10 22:16 - 2010-11-08 07:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll 2014-08-10 22:16 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll 2014-08-10 22:16 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll 2014-08-10 22:16 - 2010-11-08 07:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll 2014-08-10 22:16 - 2010-11-08 07:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll 2014-08-10 22:16 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll 2014-08-10 22:16 - 2010-11-03 18:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll 2014-08-10 22:16 - 2010-09-27 09:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll 2014-08-10 22:16 - 2010-07-22 16:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll 2014-08-10 22:16 - 2009-11-24 09:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll 2014-08-10 22:16 - 2009-11-24 09:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll 2014-08-10 22:16 - 2009-11-24 09:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll 2014-08-10 22:16 - 2009-11-24 09:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll 2014-08-10 22:13 - 2014-08-10 22:14 - 124637134 _____ (Realtek Semiconductor Corp.) C:\Users\Sedina K\Downloads\64bit_Win7_Win8_Win81_R274.exe 2014-08-09 22:01 - 2014-08-21 17:13 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2014-08-09 22:01 - 2014-08-09 22:01 - 00000219 _____ () C:\Users\Sedina K\Desktop\Counter-Strike Source.url 2014-08-09 14:40 - 2014-08-21 17:35 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-08-09 14:40 - 2014-08-09 14:40 - 01141680 _____ () C:\Users\Sedina K\Downloads\SteamSetup_API_v015.exe 2014-08-09 14:40 - 2014-08-09 14:40 - 00000969 _____ () C:\Users\Public\Desktop\Steam.lnk 2014-08-09 14:40 - 2014-08-09 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam 2014-08-07 15:32 - 2014-08-07 15:33 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\Spotify 2014-08-07 15:32 - 2014-08-07 15:32 - 00001822 _____ () C:\Users\Sedina K\Desktop\Spotify.lnk 2014-08-07 15:32 - 2014-08-07 15:32 - 00001808 _____ () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2014-08-07 15:31 - 2014-08-19 19:31 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Spotify 2014-08-07 15:31 - 2014-08-07 15:31 - 00127136 _____ (Spotify Ltd) C:\Users\Sedina K\Downloads\SpotifySetup.exe 2014-08-07 15:31 - 2014-08-07 15:31 - 00127136 _____ (Spotify Ltd) C:\Users\Sedina K\Downloads\SpotifySetup (2).exe 2014-08-07 15:31 - 2014-08-07 15:31 - 00127136 _____ (Spotify Ltd) C:\Users\Sedina K\Downloads\SpotifySetup (1).exe 2014-08-06 18:43 - 2014-08-06 18:43 - 00002252 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk 2014-08-06 10:50 - 2014-08-06 10:50 - 00123672 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys 2014-08-05 15:32 - 2014-08-19 19:20 - 03286528 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 01623040 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 00773632 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-05 15:32 - 2014-08-19 19:20 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-05 15:31 - 2014-08-19 19:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-05 15:31 - 2014-08-19 19:21 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-05 15:31 - 2014-08-19 19:21 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-05 15:31 - 2014-08-19 19:21 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-03 19:31 - 2014-09-03 15:57 - 00000000 ____D () C:\Users\Sedina K\Desktop\Neuer Ordner 2014-09-03 19:31 - 2014-09-03 15:03 - 00000000 ____D () C:\FRST 2014-09-03 19:29 - 2014-09-03 19:29 - 00001145 _____ () C:\Users\Sedina K\Desktop\mbam.txt 2014-09-03 19:26 - 2014-09-03 19:26 - 00002474 _____ () C:\Users\Sedina K\Desktop\mbam-log-2014-09-03 (18-57-32).xml 2014-09-03 19:25 - 2013-08-02 11:43 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-03 19:00 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru 2014-09-03 18:58 - 2014-07-01 21:53 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Skype 2014-09-03 17:46 - 2014-09-03 17:46 - 00002892 _____ () C:\Windows\System32\Tasks\AVG_SYS_TASK_0814av_DELETE 2014-09-03 17:46 - 2014-09-03 17:46 - 00002816 _____ () C:\Windows\System32\Tasks\AVG_SYS_TASK_0814av 2014-09-03 17:46 - 2014-09-03 17:46 - 00000542 _____ () C:\Windows\Tasks\AVG_SYS_TASK_0814av.job 2014-09-03 17:46 - 2014-09-03 17:46 - 00000410 _____ () C:\Windows\Tasks\AVG_SYS_TASK_0814av_DELETE.job 2014-09-03 17:46 - 2014-09-03 17:46 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Avg_Update_0814av 2014-09-03 17:45 - 2014-09-03 17:45 - 00000000 ____D () C:\ProgramData\Avg_Update_0814av 2014-09-03 17:45 - 2014-08-20 01:24 - 00000000 ____D () C:\ProgramData\MFAData 2014-09-03 17:25 - 2013-08-02 11:43 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-03 16:16 - 2014-08-20 00:30 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-03 16:16 - 2014-08-20 00:30 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-09-03 16:16 - 2014-08-20 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-03 16:16 - 2014-08-20 00:30 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-03 16:15 - 2014-09-03 16:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sedina K\Downloads\mbam-setup-2.0.2.1012 (2).exe 2014-09-03 16:14 - 2014-09-03 16:14 - 00001317 _____ () C:\Users\Sedina K\Desktop\JRT.txt 2014-09-03 16:07 - 2014-09-03 16:07 - 01016261 _____ (Thisisu) C:\Users\Sedina K\Downloads\JRT.exe 2014-09-03 16:07 - 2014-09-03 16:07 - 00000000 ____D () C:\Windows\ERUNT 2014-09-03 16:05 - 2013-06-13 21:13 - 00000500 _____ () C:\Users\Sedina K\AppData\Roaming\sp_data.sys 2014-09-03 16:03 - 2014-08-21 17:13 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\AVG SafeGuard toolbar 2014-09-03 16:03 - 2014-07-15 23:50 - 00452496 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-09-03 16:03 - 2012-08-02 15:24 - 00415010 _____ () C:\Windows\PFRO.log 2014-09-03 16:03 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-03 16:02 - 2014-08-20 00:22 - 00000000 ____D () C:\AdwCleaner 2014-09-03 16:02 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-09-03 16:00 - 2014-09-03 16:00 - 01370483 _____ () C:\Users\Sedina K\Downloads\adwcleaner_3.309.exe 2014-09-03 15:01 - 2014-09-03 15:01 - 02104832 _____ (Farbar) C:\Users\Sedina K\Downloads\FRST64.exe 2014-09-03 14:50 - 2013-06-13 22:08 - 05890048 ___SH () C:\Users\Sedina K\Desktop\Thumbs.db 2014-09-03 14:44 - 2013-06-13 21:10 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\VirtualStore 2014-09-03 14:41 - 2013-06-18 23:04 - 00354816 ___SH () C:\Users\Sedina K\Downloads\Thumbs.db 2014-09-03 14:35 - 2013-10-04 17:01 - 00000000 ____D () C:\Windows\Minidump 2014-09-03 14:35 - 2013-10-04 17:00 - 557568625 _____ () C:\Windows\MEMORY.DMP 2014-09-03 14:19 - 2014-09-03 14:19 - 02347384 _____ (ESET) C:\Users\Sedina K\Downloads\esetsmartinstaller_deu.exe 2014-09-03 14:19 - 2014-09-03 14:19 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-09-03 14:18 - 2014-09-03 14:18 - 05412944 _____ (Canneverbe Limited ) C:\Users\Sedina K\Downloads\cdbxp_setup_4.5.4.5000_minimal (1).exe 2014-09-03 14:18 - 2014-09-03 14:18 - 00001955 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk 2014-09-03 14:18 - 2014-09-03 14:18 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk 2014-09-03 14:18 - 2014-09-03 14:18 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Canneverbe Limited 2014-09-03 14:18 - 2014-09-03 14:18 - 00000000 ____D () C:\ProgramData\Canneverbe Limited 2014-09-03 14:18 - 2014-09-03 14:18 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP 2014-09-02 16:37 - 2013-06-14 13:30 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Winamp 2014-08-30 21:35 - 2014-08-30 21:35 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk 2014-08-30 21:35 - 2014-08-30 21:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-08-30 21:35 - 2014-08-30 21:33 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-08-30 21:35 - 2014-08-30 21:33 - 00000000 ____D () C:\Program Files\iTunes 2014-08-30 21:35 - 2014-08-30 21:33 - 00000000 ____D () C:\Program Files (x86)\iTunes 2014-08-30 21:33 - 2014-08-30 21:33 - 00000000 ____D () C:\Program Files\iPod 2014-08-30 21:11 - 2014-08-30 21:11 - 00000000 ____D () C:\ProgramData\Avg_Update_0814tb 2014-08-30 18:17 - 2014-08-30 18:17 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software 2014-08-30 18:17 - 2014-08-30 18:17 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software 2014-08-30 18:17 - 2014-08-20 01:26 - 00000983 _____ () C:\Users\Public\Desktop\AVG 2014.lnk 2014-08-30 18:17 - 2014-08-20 01:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2014-08-30 18:14 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2014-08-30 18:11 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-08-22 18:37 - 2013-06-13 21:10 - 01597047 _____ () C:\Windows\WindowsUpdate.log 2014-08-21 17:35 - 2014-08-09 14:40 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-08-21 17:21 - 2014-08-21 17:13 - 00000386 _____ () C:\Windows\Tasks\Open Chrome.job 2014-08-21 17:13 - 2014-08-21 17:13 - 00002614 _____ () C:\Windows\System32\Tasks\Open Chrome 2014-08-21 17:13 - 2014-08-21 17:13 - 00000222 _____ () C:\Users\Sedina K\Desktop\Robocraft.url 2014-08-21 17:13 - 2014-08-09 22:01 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2014-08-21 17:12 - 2014-08-21 17:12 - 00050976 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys 2014-08-21 17:12 - 2014-01-23 22:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-08-20 13:41 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache 2014-08-20 07:59 - 2014-07-01 21:53 - 00000000 ____D () C:\ProgramData\Skype 2014-08-20 02:41 - 2013-06-13 21:19 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1255148651-4057963442-3932389802-1001 2014-08-20 01:55 - 2014-08-20 01:55 - 00000000 ____D () C:\OETemp 2014-08-20 01:55 - 2014-07-29 00:32 - 00000000 ____D () C:\ProgramData\Avira 2014-08-20 01:55 - 2014-07-29 00:32 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-20 01:52 - 2013-06-13 21:10 - 00000000 ____D () C:\Users\Sedina K 2014-08-20 01:51 - 2014-08-20 01:50 - 00283752 _____ () C:\Windows\Minidump\082014-69843-01.dmp 2014-08-20 01:42 - 2014-08-20 01:42 - 00000295 _____ () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Papierkorb (2).lnk 2014-08-20 01:41 - 2014-08-20 01:24 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\Avg2014 2014-08-20 01:27 - 2014-08-20 01:27 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\AVG2014 2014-08-20 01:27 - 2014-08-20 01:26 - 00000000 ____D () C:\ProgramData\AVG2014 2014-08-20 01:26 - 2014-08-20 01:26 - 00000000 ___HD () C:\$AVG 2014-08-20 01:26 - 2014-08-20 01:26 - 00000000 ____D () C:\Program Files (x86)\AVG 2014-08-20 01:26 - 2014-08-19 19:43 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\TuneUp Software 2014-08-20 01:26 - 2012-07-26 10:12 - 00000000 ___HD () C:\Windows\ELAMBKUP 2014-08-20 01:24 - 2014-08-20 01:24 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\MFAData 2014-08-20 01:22 - 2014-08-20 01:21 - 158049496 _____ (AVG Technologies) C:\Users\Sedina K\Downloads\avg_free_x86_all_2014_4745a8017.exe 2014-08-20 00:54 - 2012-08-03 01:02 - 00753134 _____ () C:\Windows\system32\perfh007.dat 2014-08-20 00:54 - 2012-08-03 01:02 - 00155826 _____ () C:\Windows\system32\perfc007.dat 2014-08-20 00:54 - 2012-07-26 09:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-20 00:49 - 2014-01-14 23:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-08-20 00:49 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\Offline Web Pages 2014-08-20 00:35 - 2014-08-20 00:35 - 00000085 _____ () C:\Windows\wininit.ini 2014-08-20 00:35 - 2014-01-14 23:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-08-20 00:30 - 2014-08-20 00:30 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-20 00:28 - 2014-08-19 19:41 - 00001360 _____ () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2014-08-20 00:20 - 2014-08-20 00:19 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sedina K\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-20 00:20 - 2014-08-20 00:19 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sedina K\Downloads\mbam-setup-2.0.2.1012 (1).exe 2014-08-20 00:17 - 2014-08-20 00:17 - 01361671 _____ () C:\Users\Sedina K\Downloads\adwcleaner_3.307.exe 2014-08-20 00:15 - 2014-08-20 00:15 - 03007700 _____ () C:\Users\Sedina K\Downloads\revouninstaller.zip 2014-08-20 00:14 - 2014-08-20 00:14 - 01093632 _____ (Farbar) C:\Users\Sedina K\Downloads\FRST.exe 2014-08-19 23:57 - 2014-08-19 23:57 - 00000000 ____D () C:\Users\Sedina K\Downloads\NRaas_DebugEnabler_V54 2014-08-19 23:56 - 2014-08-19 23:56 - 00181923 _____ () C:\Users\Sedina K\Downloads\NRaas_DebugEnabler_V54.zip 2014-08-19 19:46 - 2014-04-03 19:31 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Dropbox 2014-08-19 19:44 - 2014-08-19 19:43 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-08-19 19:43 - 2014-08-19 19:43 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\TuneUp Software 2014-08-19 19:43 - 2014-08-19 19:42 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-08-19 19:42 - 2014-07-25 16:33 - 00000000 ____D () C:\ProgramData\Origin 2014-08-19 19:40 - 2014-08-19 19:40 - 00001538 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk 2014-08-19 19:40 - 2013-08-31 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-08-19 19:40 - 2013-08-31 19:29 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\DVDVideoSoft 2014-08-19 19:40 - 2013-08-31 19:29 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-08-19 19:37 - 2014-08-19 19:37 - 29553288 _____ (DVDVideoSoft Ltd. ) C:\Users\Sedina K\Downloads\FreeYouTubeToMP3Converter.exe 2014-08-19 19:33 - 2014-04-03 19:34 - 00000000 ___RD () C:\Users\Sedina K\Dropbox 2014-08-19 19:31 - 2014-08-07 15:31 - 00000000 ____D () C:\Users\Sedina K\AppData\Roaming\Spotify 2014-08-19 19:31 - 2014-07-25 16:33 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-08-19 19:24 - 2014-07-11 16:08 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-08-19 19:22 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData 2014-08-19 19:22 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp 2014-08-19 19:21 - 2014-08-05 15:31 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-19 19:21 - 2014-08-05 15:31 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-19 19:21 - 2014-08-05 15:31 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-19 19:21 - 2014-08-05 15:31 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-08-19 19:20 - 2014-08-05 15:32 - 03286528 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 01623040 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 00773632 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-19 19:20 - 2014-08-05 15:32 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-19 14:36 - 2013-08-31 19:02 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-19 14:22 - 2013-06-15 17:00 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-19 04:35 - 2012-11-27 06:08 - 06104954 _____ () C:\Windows\AsDebug.log 2014-08-19 03:06 - 2013-06-23 15:20 - 00000000 ____D () C:\Poker 2014-08-19 03:03 - 2014-08-19 03:03 - 00332128 _____ (Playtech) C:\Users\Sedina K\Downloads\SetupPoker.exe 2014-08-18 07:33 - 2014-03-22 20:16 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-17 03:08 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-08-17 03:07 - 2014-08-17 03:07 - 00000000 ___HD () C:\$Windows.~BT 2014-08-16 17:29 - 2013-08-02 11:44 - 00002177 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-08-15 20:21 - 2013-06-16 12:18 - 00000000 ___HD () C:\Users\Sedina K\Desktop\.picasaoriginals 2014-08-15 20:11 - 2013-06-16 12:09 - 00057344 ____H () C:\Users\Sedina K\Desktop\photothumb.db 2014-08-15 18:03 - 2014-04-21 22:51 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\Windows Live 2014-08-10 22:19 - 2013-03-26 13:50 - 00000000 ___HD () C:\Program Files (x86)\Temp 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____H () C:\ProgramData\DP45977C.lfl 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Realtek 2014-08-10 22:17 - 2014-08-10 22:17 - 00000000 ____D () C:\Program Files\Realtek 2014-08-10 22:17 - 2012-07-26 09:21 - 00037162 _____ () C:\Windows\setupact.log 2014-08-10 22:16 - 2013-03-26 13:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-08-10 22:14 - 2014-08-10 22:13 - 124637134 _____ (Realtek Semiconductor Corp.) C:\Users\Sedina K\Downloads\64bit_Win7_Win8_Win81_R274.exe 2014-08-09 22:01 - 2014-08-09 22:01 - 00000219 _____ () C:\Users\Sedina K\Desktop\Counter-Strike Source.url 2014-08-09 14:40 - 2014-08-09 14:40 - 01141680 _____ () C:\Users\Sedina K\Downloads\SteamSetup_API_v015.exe 2014-08-09 14:40 - 2014-08-09 14:40 - 00000969 _____ () C:\Users\Public\Desktop\Steam.lnk 2014-08-09 14:40 - 2014-08-09 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam 2014-08-07 15:33 - 2014-08-07 15:32 - 00000000 ____D () C:\Users\Sedina K\AppData\Local\Spotify 2014-08-07 15:32 - 2014-08-07 15:32 - 00001822 _____ () C:\Users\Sedina K\Desktop\Spotify.lnk 2014-08-07 15:32 - 2014-08-07 15:32 - 00001808 _____ () C:\Users\Sedina K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2014-08-07 15:31 - 2014-08-07 15:31 - 00127136 _____ (Spotify Ltd) C:\Users\Sedina K\Downloads\SpotifySetup.exe 2014-08-07 15:31 - 2014-08-07 15:31 - 00127136 _____ (Spotify Ltd) C:\Users\Sedina K\Downloads\SpotifySetup (2).exe 2014-08-07 15:31 - 2014-08-07 15:31 - 00127136 _____ (Spotify Ltd) C:\Users\Sedina K\Downloads\SpotifySetup (1).exe 2014-08-07 08:33 - 2014-08-15 18:24 - 00712192 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-07 05:09 - 2014-08-15 18:24 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-06 18:43 - 2014-08-06 18:43 - 00002252 _____ () C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk 2014-08-06 18:33 - 2014-07-25 16:36 - 00000000 ____D () C:\Program Files (x86)\Origin Games 2014-08-06 10:50 - 2014-08-06 10:50 - 00123672 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys Files to move or delete: ==================== C:\ProgramData\SetStretch.exe C:\ProgramData\SetStretch.VBS Some content of TEMP: ==================== C:\Users\Sedina K\AppData\Local\Temp\avgnt.exe C:\Users\Sedina K\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpf7hfzr.dll C:\Users\Sedina K\AppData\Local\Temp\DseShExt-x64.dll C:\Users\Sedina K\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Sedina K\AppData\Local\Temp\Quarantine.exe C:\Users\Sedina K\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Sedina K\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\Sedina K\AppData\Local\Temp\swt-win32-3349.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-02 14:11 ==================== End Of Log ============================ --- --- --- --- --- --- So das wär dann alles |
| Themen zu Absturz des Laptops bei jedem Viren Scan |
| absturz, asus, avg, blue, blue screen, brauch, data, dringend, edition, eingefangen, erneut, eset, free, laptop, minute, nichts, online, plötzlich, sache, scan, screen, starte, trojaner, trojaner absturz blue screen laptop, viren, win |
Baum-Darstellung