| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Es öffnen sich in Chrome ständig neue Werbetabs von alleineWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
18.11.2014, 02:21
| #16 |
 |  Es öffnen sich in Chrome ständig neue Werbetabs von alleineCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-11-2014 02
Ran by Patrick at 2014-11-17 15:10:37 Run:2
Running from C:\Users\Patrick\Desktop
Loaded Profiles: UpdatusUser & Patrick (Available profiles: UpdatusUser & Patrick)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:61576;https=127.0.0.1:61576
S2 cae99edb; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll",ENT
*****************
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
cae99edb => Service deleted successfully.
==== End of Fixlog ====
also wenn es Hilft meistens öffnen sich die Werbetabs über t.cttsrv.com oder von da werde ich meist auf irgendwelche Werbeseiten geleitet, hab jetzt auch Adblock im chrome was aber auch nicht das meiste bringt. Diese Reimage und Stargame Tabs sind auch wieder nicht aus dem Verlauf zu bekommen und diese Superfish Adware hat der ADW Cleaner auch schon wieder gefunden... Echt ein Elend hier... FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-11-2014 02 Ran by Patrick (administrator) on PATRICK on 17-11-2014 15:31:13 Running from C:\Users\Patrick\Desktop Loaded Profiles: UpdatusUser & Patrick (Available profiles: UpdatusUser & Patrick) Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 10 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe (Dritek System INC.) C:\Windows\RfBtnSvc64.exe (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.17074_none_6233bc1f5106b696\TiWorker.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor) HKLM\...\Run: [BtPreLoad] => C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe [64640 2012-08-10] () HKLM-x32\...\Run: [LManager] => [X] HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.) HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.) HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2012-09-25] (Brother Industries, Ltd.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5223016 2014-11-13] (AVAST Software) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKU\S-1-5-21-2821158248-3669744390-145468304-1002\...\Run: [GoogleChromeAutoLaunch_133FC10A42EC311A0885C7B36F719938] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [854344 2014-11-06] (Google Inc.) HKU\S-1-5-21-2821158248-3669744390-145468304-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-23] (Piriform Ltd) HKU\S-1-5-21-2821158248-3669744390-145468304-1002\...\RunOnce: [Uninstall C:\Users\Patrick\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Patrick\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64" HKU\S-1-5-21-2821158248-3669744390-145468304-1002\...\MountPoints2: {673a04b3-2df8-11e4-bff2-7054d2863b06} - "E:\Startme.exe" HKU\S-1-5-21-2821158248-3669744390-145468304-1002\...\MountPoints2: {771bb313-1fcf-11e4-bfec-7054d2863b06} - "E:\HTC_Sync_Manager_PC.exe" HKU\S-1-5-21-2821158248-3669744390-145468304-1002\...\MountPoints2: {771bbe3b-1fcf-11e4-bfec-7054d2863b06} - "E:\HTC_Sync_Manager_PC.exe" HKU\S-1-5-21-2821158248-3669744390-145468304-1002\...\MountPoints2: {ac4227a2-0ce7-11e4-bfe5-7054d2863b06} - "E:\iLinker.exe" Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2821158248-3669744390-145468304-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKU\S-1-5-21-2821158248-3669744390-145468304-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com HKU\S-1-5-21-2821158248-3669744390-145468304-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 HKU\S-1-5-21-2821158248-3669744390-145468304-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com HKU\S-1-5-21-2821158248-3669744390-145468304-1002\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.msn.com/?pc=AV01 HKU\S-1-5-21-2821158248-3669744390-145468304-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.msn.com/?pc=AV01 SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {4F6A3542-CF75-4D44-B80F-09C32AC0C4AF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS SearchScopes: HKLM - {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = SearchScopes: HKLM-x32 - DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKLM-x32 - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {4F6A3542-CF75-4D44-B80F-09C32AC0C4AF} URL = SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {A25AC313-DD19-4238-ACA2-401D6BEE4321} URL = SearchScopes: HKCU - {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{1D220087-D5F2-4F68-9D64-442AA8EDA69A}: [NameServer] 31.168.224.100,5.135.12.56 Tcpip\..\Interfaces\{E46B6661-A1E5-4B12-AC8A-412CE4DE19AE}: [NameServer] 31.168.224.100,5.135.12.56 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll () FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-13] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK Chrome: ======= CHR HomePage: Default -> hxxp://google.de/ CHR StartupUrls: Default -> "hxxp://www.google.de/" CHR Profile: C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-15] CHR Extension: (Google Docs) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-15] CHR Extension: (Google Drive) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-15] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-15] CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-15] CHR Extension: (Google-Suche) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-15] CHR Extension: (Google Tabellen) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-15] CHR Extension: (AdBlock) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-16] CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-15] CHR Extension: (Google Mail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-15] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-13] (AVAST Software) R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-13] (Avast Software) S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed] S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated) R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated) R2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.) R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed] R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation) R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-12-25] (Dritek System INC.) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-13] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-13] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-13] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-13] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-13] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-13] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-13] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-13] () S3 BrSerIf; C:\Windows\system32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation) S3 ErrDev; C:\Windows\System32\drivers\errdev.sys [10240 2012-07-26] (Microsoft Corporation) [File not signed] R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-17] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation) R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-12-25] (Dritek System Inc.) S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-06-10] (Apple, Inc.) [File not signed] R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [270728 2014-11-13] (Avast Software) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-17 15:02 - 2014-11-17 15:02 - 00000197 _____ () C:\Windows\system32\2014-11-17-14-02-54.086-AvastVBoxSVC.exe-2988.log 2014-11-17 04:05 - 2014-11-17 04:05 - 00003732 _____ () C:\Windows\system32\.crusader 2014-11-17 03:47 - 2014-11-17 04:21 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-11-17 03:06 - 2014-11-17 03:06 - 00000748 _____ () C:\Users\Patrick\Desktop\JRT.txt 2014-11-17 02:58 - 2014-11-16 03:16 - 01707532 _____ (Thisisu) C:\Users\Patrick\Desktop\JRT_NEW.exe 2014-11-17 02:53 - 2014-11-17 02:53 - 00000197 _____ () C:\Windows\system32\2014-11-17-01-53-31.063-AvastVBoxSVC.exe-2712.log 2014-11-17 02:51 - 2014-11-17 15:30 - 00033851 _____ () C:\Windows\WindowsUpdate.log 2014-11-17 02:50 - 2014-11-17 02:50 - 00003592 ____N () C:\bootsqm.dat 2014-11-17 02:38 - 2014-11-17 02:38 - 00002259 _____ () C:\Windows\epplauncher.mif 2014-11-16 23:47 - 2014-11-16 23:47 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-PATRICK-Microsoft-Windows-8-(64-bit).dat 2014-11-16 23:47 - 2014-11-16 23:47 - 00000000 ____D () C:\RegBackup 2014-11-16 23:22 - 2014-11-16 23:38 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-11-16 23:19 - 2014-11-16 23:38 - 00000000 ____D () C:\Users\Patrick\Desktop\mbar 2014-11-16 23:07 - 2014-11-16 23:07 - 00000826 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-11-16 23:07 - 2014-11-16 23:07 - 00000000 ____D () C:\Program Files\CCleaner 2014-11-16 23:00 - 2014-11-16 23:00 - 04974864 _____ (Piriform Ltd) C:\Users\Patrick\Downloads\ccsetup419.exe 2014-11-16 21:34 - 2014-11-16 21:34 - 00023660 _____ () C:\Users\Patrick\Desktop\Addition.txt 2014-11-16 21:33 - 2014-11-17 15:31 - 00018749 _____ () C:\Users\Patrick\Desktop\FRST.txt 2014-11-16 21:26 - 2014-11-16 21:26 - 00000197 _____ () C:\Windows\system32\2014-11-16-20-26-17.021-AvastVBoxSVC.exe-2812.log 2014-11-16 21:09 - 2014-11-16 21:09 - 00000197 _____ () C:\Windows\system32\2014-11-16-20-09-07.081-AvastVBoxSVC.exe-3800.log 2014-11-16 17:31 - 2014-11-16 17:32 - 00000197 _____ () C:\Windows\system32\2014-11-16-16-31-17.042-AvastVBoxSVC.exe-3044.log 2014-11-15 23:08 - 2014-11-15 23:09 - 00000197 _____ () C:\Windows\system32\2014-11-15-22-08-04.095-AvastVBoxSVC.exe-3612.log 2014-11-15 22:57 - 2014-11-17 04:15 - 00000000 ____D () C:\AdwCleaner 2014-11-15 21:42 - 2014-11-15 21:42 - 00000197 _____ () C:\Windows\system32\2014-11-15-20-42-09.025-AvastVBoxSVC.exe-3684.log 2014-11-15 21:37 - 2014-11-17 15:31 - 00000000 ____D () C:\FRST 2014-11-15 21:24 - 2014-11-15 21:24 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-11-15 21:24 - 2014-11-15 21:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-11-15 21:22 - 2014-11-17 15:27 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-11-15 21:22 - 2014-11-17 15:03 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-11-15 21:22 - 2014-11-15 21:22 - 00004100 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-15 21:22 - 2014-11-15 21:22 - 00003864 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-15 21:05 - 2014-11-15 21:06 - 00000197 _____ () C:\Windows\system32\2014-11-15-20-05-34.053-AvastVBoxSVC.exe-2844.log 2014-11-15 17:16 - 2014-11-15 17:18 - 00000197 _____ () C:\Windows\system32\2014-11-15-16-16-42.050-AvastVBoxSVC.exe-2788.log 2014-11-15 14:54 - 2014-11-15 14:54 - 00000197 _____ () C:\Windows\system32\2014-11-15-13-54-19.014-AvastVBoxSVC.exe-3484.log 2014-11-15 03:25 - 2014-11-15 03:25 - 00230184 _____ () C:\Users\Patrick\Documents\ccregclean.reg 2014-11-15 02:04 - 2014-11-15 02:04 - 00000000 ____D () C:\ProgramData\Licenses 2014-11-15 02:04 - 2011-11-04 05:13 - 01070352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCTL.OCX 2014-11-15 02:04 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSSTDFMT.DLL 2014-11-14 23:37 - 2014-11-14 23:37 - 00854448 _____ () C:\Users\Patrick\Desktop\SecurityCheck.exe 2014-11-14 23:35 - 2014-11-14 23:36 - 02140160 _____ () C:\Users\Patrick\Desktop\AdwCleaner_4.101.exe 2014-11-14 22:12 - 2014-11-16 18:21 - 02117120 _____ (Farbar) C:\Users\Patrick\Desktop\FRST64.exe 2014-11-14 21:42 - 2014-11-14 21:42 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Secunia PSI 2014-11-14 20:49 - 2014-11-14 20:49 - 00000197 _____ () C:\Windows\system32\2014-11-14-19-49-21.043-AvastVBoxSVC.exe-3508.log 2014-11-14 18:43 - 2014-11-14 18:44 - 02347384 _____ (ESET) C:\Users\Patrick\Desktop\esetsmartinstaller_deu.exe 2014-11-14 12:16 - 2014-11-14 12:16 - 00000197 _____ () C:\Windows\system32\2014-11-14-11-16-31.041-AvastVBoxSVC.exe-3888.log 2014-11-13 18:34 - 2014-11-13 18:34 - 00000000 ____D () C:\Windows\ERUNT 2014-11-13 18:32 - 2014-11-13 18:32 - 00002249 _____ () C:\Users\Patrick\Desktop\AdwCleaner.txt 2014-11-13 18:29 - 2014-11-13 18:29 - 00000197 _____ () C:\Windows\system32\2014-11-13-17-29-08.027-AvastVBoxSVC.exe-3012.log 2014-11-13 18:16 - 2014-11-13 18:16 - 00012647 _____ () C:\Users\Patrick\Desktop\mbam.txt 2014-11-13 18:12 - 2014-11-13 18:13 - 00000197 _____ () C:\Windows\system32\2014-11-13-17-12-42.082-AvastVBoxSVC.exe-3848.log 2014-11-13 17:46 - 2014-11-17 15:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-11-13 17:46 - 2014-11-16 23:19 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-11-13 17:46 - 2014-11-13 17:46 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-11-13 17:46 - 2014-11-13 17:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-11-13 17:46 - 2014-11-13 17:46 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-11-13 17:46 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-11-13 17:46 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-11-13 17:29 - 2014-11-13 17:29 - 00001268 _____ () C:\Users\Patrick\Desktop\Revo Uninstaller.lnk 2014-11-13 17:29 - 2014-11-13 17:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-11-13 13:47 - 2014-11-13 13:48 - 00000197 _____ () C:\Windows\system32\2014-11-13-12-47-51.096-AvastVBoxSVC.exe-5476.log 2014-11-13 02:06 - 2014-11-13 02:07 - 00000197 _____ () C:\Windows\system32\2014-11-13-01-06-53.050-AvastVBoxSVC.exe-2688.log 2014-11-13 01:51 - 2014-11-13 01:51 - 00000247 _____ () C:\Windows\system32\2014-11-13-00-51-00.015-aswFe.exe-4536.log 2014-11-13 01:38 - 2014-11-15 03:03 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Dropbox 2014-11-13 01:37 - 2014-11-13 01:50 - 00000247 _____ () C:\Windows\system32\2014-11-13-00-37-02.019-aswFe.exe-4480.log 2014-11-13 01:36 - 2014-11-13 01:36 - 00000197 _____ () C:\Windows\system32\2014-11-13-00-36-57.018-AvastVBoxSVC.exe-4180.log 2014-11-13 00:33 - 2014-11-17 04:24 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-11-13 00:33 - 2014-11-13 00:33 - 00001968 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2014-11-13 00:33 - 2014-11-13 00:33 - 00000000 ____D () C:\Windows\SysWOW64\vbox 2014-11-13 00:33 - 2014-11-13 00:33 - 00000000 ____D () C:\Windows\system32\vbox 2014-11-13 00:33 - 2014-11-13 00:33 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\AVAST Software 2014-11-13 00:33 - 2014-11-13 00:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2014-11-13 00:32 - 2014-11-13 00:33 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-11-13 00:32 - 2014-11-13 00:33 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys 2014-11-13 00:32 - 2014-11-13 00:32 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2014-11-13 00:32 - 2014-11-13 00:32 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-11-13 00:32 - 2014-11-13 00:32 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-11-13 00:32 - 2014-11-13 00:32 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2014-11-13 00:32 - 2014-11-13 00:32 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-11-13 00:32 - 2014-11-13 00:32 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-11-13 00:32 - 2014-11-13 00:32 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-11-13 00:32 - 2014-11-13 00:32 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-11-13 00:32 - 2014-11-13 00:32 - 00000000 ____D () C:\Program Files\AVAST Software 2014-11-13 00:29 - 2014-11-13 00:32 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-11-13 00:07 - 2014-11-13 00:18 - 131078000 _____ (AVAST Software) C:\Users\Patrick\Downloads\avast_free_antivirus_setup.exe 2014-11-12 21:05 - 2014-11-12 21:05 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-12 10:14 - 2014-11-12 10:16 - 00026624 ___SH () C:\Users\Patrick\Documents\Thumbs.db 2014-11-12 08:12 - 2014-11-05 07:40 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-11-12 08:12 - 2014-11-05 07:38 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-11-12 08:12 - 2014-11-05 04:16 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-11-12 08:12 - 2014-10-11 08:45 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2014-11-12 08:12 - 2014-10-11 08:44 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-11-12 08:12 - 2014-10-11 08:44 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-11-12 08:12 - 2014-10-11 08:43 - 02307072 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-11-12 08:12 - 2014-10-11 06:58 - 08858624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll 2014-11-12 08:12 - 2014-10-11 06:57 - 02416640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-11-12 08:12 - 2014-10-11 06:57 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-11-12 08:12 - 2014-10-11 06:56 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-11-12 08:12 - 2014-09-22 06:53 - 00035320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys 2014-11-12 08:12 - 2014-08-26 23:08 - 00270024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys 2014-11-12 02:40 - 2014-10-11 09:35 - 00171840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-11-12 02:40 - 2014-10-11 08:44 - 03248640 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2014-11-12 02:40 - 2014-10-11 08:44 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll 2014-11-12 02:40 - 2014-10-11 08:43 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-11-12 02:40 - 2014-10-11 06:57 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll 2014-11-12 02:40 - 2014-10-11 06:41 - 00713728 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2014-11-12 02:40 - 2014-10-11 06:41 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2014-11-12 02:40 - 2014-10-11 06:05 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2014-11-12 02:40 - 2014-10-11 06:04 - 00713728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2014-11-12 02:40 - 2014-10-03 02:21 - 00522728 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2014-11-12 02:40 - 2014-10-02 23:29 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-11-12 02:40 - 2014-10-02 23:29 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2014-11-12 02:40 - 2014-10-02 23:29 - 00169472 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll 2014-11-12 02:40 - 2014-10-02 00:05 - 04068864 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-11-12 02:40 - 2014-09-25 00:29 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-11-12 02:40 - 2014-09-25 00:29 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll 2014-11-12 02:40 - 2014-09-25 00:01 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-11-12 02:40 - 2014-09-25 00:01 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll 2014-11-12 02:40 - 2014-09-13 07:24 - 02233152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-11-12 02:40 - 2014-09-06 01:46 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml 2014-11-12 02:40 - 2014-09-03 03:48 - 00457728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll 2014-11-12 02:40 - 2014-09-03 03:48 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll 2014-11-12 02:40 - 2014-09-03 03:22 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll 2014-11-12 02:40 - 2014-09-03 03:21 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll 2014-11-12 02:40 - 2014-09-03 03:21 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll 2014-11-12 02:40 - 2014-08-29 05:17 - 02043392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-11-12 02:40 - 2014-08-29 05:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-11-12 02:40 - 2014-08-29 05:04 - 02837504 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-11-12 02:40 - 2014-08-29 05:04 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-11-12 02:40 - 2014-08-28 07:04 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSCOMEX.dll 2014-11-12 02:40 - 2014-08-28 07:04 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll 2014-11-12 02:40 - 2014-08-28 06:59 - 00616448 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll 2014-11-12 02:40 - 2014-08-28 06:59 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll 2014-11-12 02:40 - 2014-08-28 06:59 - 00432640 _____ (Microsoft Corporation) C:\Windows\system32\FXSTIFF.dll 2014-11-12 02:40 - 2014-08-28 06:59 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\FXST30.dll 2014-11-12 02:40 - 2014-07-24 14:12 - 00328512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys 2014-11-12 02:39 - 2014-10-26 02:56 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-11-12 02:39 - 2014-10-26 02:56 - 01409536 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-11-12 02:39 - 2014-10-26 02:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2014-11-12 02:39 - 2014-10-26 02:56 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll 2014-11-12 02:39 - 2014-10-26 02:56 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-11-12 02:39 - 2014-10-26 02:55 - 19284480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-11-12 02:39 - 2014-10-26 02:55 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-11-12 02:39 - 2014-10-26 02:55 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-11-12 02:39 - 2014-10-26 02:55 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-11-12 02:39 - 2014-10-26 02:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-11-12 02:39 - 2014-10-26 02:53 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-11-12 02:39 - 2014-10-26 01:36 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-11-12 02:39 - 2014-10-26 01:35 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-11-12 02:39 - 2014-10-26 01:35 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-11-12 02:39 - 2014-10-26 01:35 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-11-12 02:39 - 2014-10-26 01:35 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-11-12 02:39 - 2014-10-26 01:35 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-11-12 02:39 - 2014-10-26 01:35 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 13758464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-11-12 02:39 - 2014-10-26 01:34 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-11-12 02:39 - 2014-10-26 01:34 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-11-12 02:39 - 2014-10-26 01:19 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-11-12 02:39 - 2014-10-26 01:13 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-11-12 02:39 - 2014-10-25 22:48 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll 2014-11-12 02:39 - 2014-10-23 13:47 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-11-12 02:39 - 2014-10-23 12:04 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-11-12 02:39 - 2014-10-18 09:44 - 00778240 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2014-11-12 02:39 - 2014-10-18 08:05 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2014-11-12 02:39 - 2014-08-22 00:56 - 01418752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-11-12 02:39 - 2014-08-22 00:27 - 01845760 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-11-10 20:59 - 2014-11-12 23:51 - 00281784 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-10 20:35 - 2014-11-10 20:35 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-11-10 20:28 - 2014-11-10 20:35 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-11-10 20:28 - 2014-11-10 20:28 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-11-10 18:12 - 2014-11-13 17:36 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\1H1Q1V1N1N1S1R 2014-11-10 08:25 - 2014-11-10 08:25 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\AdvancedSystemProtector 2014-11-09 18:54 - 2014-11-09 18:54 - 00628448 _____ (CMI Limited) C:\Users\Patrick\AppData\Local\nsc8211.tmp 2014-11-09 18:11 - 2014-11-17 02:12 - 00000000 ____D () C:\Users\Patrick\AppData\Local\com 2014-11-09 17:51 - 2014-11-13 18:07 - 00000000 ____D () C:\Program Files (x86)\0ca45c95134d 2014-11-09 17:51 - 2014-11-09 17:51 - 00001836 _____ () C:\Windows\patsearch.bin 2014-11-09 17:51 - 2014-11-09 17:51 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrNew_01009.Wdf 2014-11-09 17:47 - 2014-11-13 18:07 - 00000000 ____D () C:\Program Files (x86)\8e56b95b-09ea-4da0-8fea-ba2f19f772ee 2014-11-09 17:42 - 2014-11-13 18:07 - 00000000 ____D () C:\Program Files (x86)\5c44387a-9322-44d2-80c4-9946798023d3 2014-11-07 09:59 - 2014-11-07 09:59 - 00000072 _____ () C:\Users\Patrick\Downloads\hellweg.m3u 2014-11-06 10:23 - 2014-11-06 11:22 - 180878522 _____ () C:\Users\Patrick\Downloads\c1iKH0T.rar 2014-11-06 09:27 - 2014-11-06 09:46 - 00000000 ____D () C:\Recovery 2014-11-06 07:40 - 2014-11-06 07:52 - 00032388 _____ () C:\Windows\diagwrn.xml 2014-11-06 07:40 - 2014-11-06 07:52 - 00032388 _____ () C:\Windows\diagerr.xml 2014-11-05 21:35 - 2014-11-05 21:35 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\DivX 2014-11-05 21:31 - 2014-11-05 23:57 - 00000000 ____D () C:\Program Files (x86)\DivX 2014-11-05 21:30 - 2014-11-05 23:57 - 00000000 ____D () C:\ProgramData\DivX 2014-11-05 18:16 - 2014-11-05 18:16 - 00860576 _____ ( ) C:\Users\Patrick\Downloads\OpenOfficeSetup.exe 2014-10-31 12:27 - 2014-10-30 01:53 - 00713672 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-10-31 12:27 - 2014-10-30 01:53 - 00106432 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-10-30 13:06 - 2014-10-31 12:35 - 00000000 ____D () C:\Windows\system32\AutoUpdateLicense 2014-10-30 13:00 - 2014-10-22 04:34 - 00010777 _____ () C:\Windows\system32\AutoconfigV2.cab 2014-10-30 13:00 - 2014-10-22 04:33 - 00581016 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe 2014-10-30 13:00 - 2014-10-22 04:33 - 00462760 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2014-10-30 13:00 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2014-10-30 13:00 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-30 13:00 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2014-10-30 13:00 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll 2014-10-30 13:00 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-30 13:00 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll 2014-10-30 13:00 - 2014-06-13 00:34 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll 2014-10-30 13:00 - 2014-06-13 00:29 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2014-10-30 11:58 - 2014-10-31 02:42 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\dlg 2014-10-30 11:55 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-10-30 11:47 - 2014-10-30 11:46 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-10-30 11:46 - 2014-10-30 11:46 - 00000000 ____D () C:\Program Files\Java 2014-10-30 11:39 - 2014-10-30 11:45 - 92658088 _____ (Oracle Corporation) C:\Users\Patrick\Downloads\jre-8u25-windows-x64.exe 2014-10-30 11:37 - 2014-10-30 11:37 - 00000000 ____D () C:\ProgramData\BlueStacks 2014-10-30 11:27 - 2014-10-30 11:27 - 00880272 _____ (Google Inc.) C:\Users\Patrick\Downloads\ChromeSetup.exe 2014-10-30 11:11 - 2014-07-12 05:41 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL 2014-10-30 11:11 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL 2014-10-30 11:11 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL 2014-10-30 11:11 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL 2014-10-30 11:11 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL 2014-10-30 11:11 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL 2014-10-30 11:11 - 2014-07-12 05:16 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL 2014-10-30 11:11 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL 2014-10-30 11:11 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL 2014-10-30 11:11 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL 2014-10-30 11:11 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL 2014-10-30 11:11 - 2014-07-12 05:15 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL 2014-10-30 11:11 - 2014-07-12 01:02 - 00478352 _____ () C:\Windows\SysWOW64\locale.nls 2014-10-30 11:11 - 2014-07-12 01:00 - 00478352 _____ () C:\Windows\system32\locale.nls 2014-10-30 11:11 - 2014-07-08 23:33 - 00181248 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe 2014-10-30 11:11 - 2014-07-08 23:32 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll 2014-10-30 11:11 - 2014-07-08 23:32 - 00340480 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll 2014-10-30 11:11 - 2014-07-08 23:30 - 01220608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll 2014-10-30 11:11 - 2014-07-07 06:52 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll 2014-10-30 11:11 - 2014-07-07 06:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll 2014-10-30 11:11 - 2014-07-04 11:52 - 00328000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys 2014-10-30 11:11 - 2014-07-03 02:59 - 01824784 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2014-10-30 11:11 - 2014-07-03 01:30 - 01408952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2014-10-30 11:11 - 2014-06-28 08:01 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll 2014-10-30 11:11 - 2014-06-28 07:57 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2014-10-30 11:11 - 2014-06-28 07:56 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll 2014-10-30 11:11 - 2014-06-25 08:09 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-10-30 11:11 - 2014-06-25 08:07 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2014-10-30 11:11 - 2014-06-18 00:27 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-10-30 11:11 - 2014-06-18 00:23 - 02238464 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-10-30 11:11 - 2014-06-11 15:47 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2014-10-30 11:11 - 2014-06-11 05:40 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2014-10-30 11:11 - 2014-06-10 23:44 - 01403896 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi 2014-10-30 11:11 - 2014-02-04 11:57 - 01271664 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe 2014-10-30 11:10 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll 2014-10-30 11:10 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2014-10-30 11:10 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-10-30 11:10 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2014-10-30 11:10 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll 2014-10-30 11:10 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-10-30 11:10 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2014-10-30 11:10 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll 2014-10-30 11:10 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-10-30 11:10 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2014-10-30 11:09 - 2014-07-24 14:50 - 00447296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS 2014-10-30 11:09 - 2014-07-17 00:28 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll 2014-10-30 11:09 - 2014-07-16 23:59 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll 2014-10-30 11:09 - 2014-07-16 23:59 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll 2014-10-30 11:09 - 2014-07-12 07:45 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll 2014-10-30 11:09 - 2014-07-12 05:36 - 00674304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys 2014-10-30 11:09 - 2014-07-12 05:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys 2014-10-30 11:09 - 2014-07-12 05:34 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys 2014-10-30 11:09 - 2014-07-12 05:34 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys 2014-10-30 11:09 - 2014-06-28 07:57 - 01341952 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll 2014-10-30 11:09 - 2014-06-28 03:23 - 01126400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll 2014-10-21 16:59 - 2014-10-21 16:59 - 00003584 _____ () C:\Users\Patrick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-17 15:22 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru 2014-11-17 15:08 - 2013-04-05 21:21 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2821158248-3669744390-145468304-1002 2014-11-17 15:02 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-17 04:33 - 2012-07-26 06:26 - 00524288 ___SH () C:\Windows\system32\config\BBI 2014-11-17 04:02 - 2013-04-06 17:15 - 00000000 ____D () C:\Users\Patrick\AppData\Local\CrashDumps 2014-11-17 03:37 - 2013-12-14 09:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-17 03:02 - 2013-04-18 07:46 - 00246784 ___SH () C:\Users\Patrick\Desktop\Thumbs.db 2014-11-17 01:30 - 2013-04-14 21:22 - 00148992 ___SH () C:\Users\Patrick\Downloads\Thumbs.db 2014-11-17 00:48 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp 2014-11-17 00:37 - 2013-05-16 14:34 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive 2014-11-16 20:33 - 2012-10-24 05:35 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-11-15 21:40 - 2014-10-01 15:08 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2014-11-15 21:37 - 2012-07-26 09:12 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-11-15 21:28 - 2013-04-08 12:05 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google 2014-11-15 21:27 - 2013-04-08 12:04 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Deployment 2014-11-15 21:24 - 2013-04-08 12:05 - 00000000 ____D () C:\Program Files (x86)\Google 2014-11-15 15:01 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-11-15 02:11 - 2012-10-24 06:15 - 00000000 ____D () C:\ProgramData\Temp 2014-11-13 21:18 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache 2014-11-13 18:08 - 2012-07-26 09:12 - 00000000 __RSD () C:\Windows\Media 2014-11-13 18:07 - 2013-07-21 21:46 - 00000000 ____D () C:\Program Files (x86)\ASIO4ALL v2 2014-11-13 02:05 - 2013-04-05 21:12 - 00000000 ____D () C:\Users\Patrick 2014-11-13 01:54 - 2013-12-25 23:19 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk 2014-11-13 01:52 - 2013-04-07 20:07 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-11-13 01:52 - 2013-04-07 20:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-11-13 01:52 - 2013-04-07 20:06 - 00000000 ____D () C:\Program Files\WinRAR 2014-11-12 23:48 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-12 23:48 - 2012-07-26 09:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-12 23:47 - 2014-08-08 21:42 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-11-12 23:47 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ToastData 2014-11-12 23:47 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files\Windows Defender 2014-11-12 23:47 - 2012-07-26 09:12 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-11-12 10:20 - 2012-12-25 23:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-11-12 10:19 - 2014-08-23 18:33 - 00000000 ____D () C:\Program Files (x86)\MSECache 2014-11-12 09:47 - 2013-04-06 14:49 - 00000000 ___RD () C:\Users\Patrick\Documents\Sarahs Bewerbung 2014-11-12 09:44 - 2012-12-26 04:22 - 00753134 _____ () C:\Windows\system32\perfh007.dat 2014-11-12 09:44 - 2012-12-26 04:22 - 00155826 _____ () C:\Windows\system32\perfc007.dat 2014-11-12 09:44 - 2012-07-26 08:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-11 20:38 - 2013-12-14 09:16 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-10 13:00 - 2012-10-24 05:33 - 00000000 ____D () C:\Program Files (x86)\Intel 2014-11-09 23:40 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-06 09:51 - 2014-09-24 16:19 - 00000000 ___HD () C:\$Windows.~BT 2014-11-06 07:52 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2014-11-06 07:47 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\Registration 2014-10-31 03:06 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2014-10-30 13:12 - 2013-08-15 14:52 - 00000000 ____D () C:\Windows\system32\MRT 2014-10-30 13:08 - 2013-04-07 01:12 - 103265616 ____N (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-10-30 13:06 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore 2014-10-30 12:57 - 2014-09-08 10:54 - 00000000 ____D () C:\ProgramData\Apple 2014-10-30 12:44 - 2014-09-08 10:59 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-10-30 12:25 - 2014-06-29 09:21 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-10-30 11:47 - 2013-04-07 20:23 - 00000000 ____D () C:\Program Files (x86)\Java 2014-10-30 11:46 - 2014-01-04 14:45 - 00000000 ____D () C:\ProgramData\Oracle 2014-10-30 11:46 - 2014-01-04 14:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-10-30 08:43 - 2013-04-06 14:42 - 00000000 ____D () C:\Users\Patrick\Documents\Dokumente ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-11 03:17 ==================== End Of Log ============================ --- --- --- --- --- --- ja immernoch leider, ich bin echt am verzweifeln hier... sonst setze ich einfach mal mein System auf einen früheren Zeitpunkt zurück, meinst du das könnte helfen? |
|
18.11.2014, 12:58
| #17 |
| /// the machine /// TB-Ausbilder    | Es öffnen sich in Chrome ständig neue Werbetabs von alleine Nope, wird nicht helfen. FRST öffnen, Haken setzen bei Addition und scannen, poste bitte nur die neue Addition.txt, die fehlt noch
__________________
__________________ |
|
18.11.2014, 16:34
| #18 |
| | Es öffnen sich in Chrome ständig neue Werbetabs von alleine Hab heute auch noch mal n´Scan mit Emsisoft laufen lassen
__________________Code:
ATTFilter Emsisoft Emergency Kit - Version 9.0
Letztes Update: 18.11.2014 12:42:33
Benutzerkonto: PATRICK\Patrick
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
PUPs-Erkennung: An
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus
Scan Beginn: 18.11.2014 12:43:52
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613} gefunden: Application.AdGenie (A)
Key: HKEY_USERS\.DEFAULT\SOFTWARE\ANYPROTECT gefunden: Application.AdProtect (A)
Key: HKEY_USERS\S-1-5-18\SOFTWARE\ANYPROTECT gefunden: Application.AdProtect (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR gefunden: Setting.DisableTaskMgr (A)
Value: HKEY_USERS\S-1-5-21-2821158248-3669744390-145468304-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR gefunden: Setting.DisableTaskMgr (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS gefunden: Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-2821158248-3669744390-145468304-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS gefunden: Setting.DisableRegistryTools (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER -> NORUN gefunden: Setting.NoRun (A)
C:\Users\Patrick\AppData\Roaming\CKGJGC -> content/overlay.js gefunden: Adware.JS.Mplug.A (B)
C:\Users\Patrick\AppData\Roaming\RTYTL -> content/overlay.js gefunden: Adware.JS.Mplug.A (B)
Gescannt 343398
Gefunden 10
Scan Ende: 18.11.2014 14:55:39
Scan Zeit: 2:11:47
und einmal Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-11-2014 02
Ran by Patrick at 2014-11-18 16:31:22
Running from C:\Users\Patrick\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
"Englisch in der Grundschule mit Ponky 1.+2. Kl." (HKLM-x32\...\"Englisch in der Grundschule mit Ponky 1.+2. Kl.") (Version: 2.00 - Engel Edition)
Acer Backup Manager (HKLM-x32\...\InstallShield_{9DDDF20E-9FD1-4434-A43E-E7889DBC9420}) (Version: 4.0.0.0059 - NTI Corporation)
Acer Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3007 - Acer Incorporated)
Acer Instant Update Service (HKLM\...\{8215A318-CC27-435E-B3EA-2E3443C8998C}) (Version: 1.00.3013 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3006 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3011 - Acer Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Angry Birds Breakfast 1 (HKLM-x32\...\{BFB47E83-404F-49CC-B9E5-6CDCA53932C8}) (Version: 1.0.16 - Rovio Entertainment Ltd.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.4 - Atheros Communications Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2206 - AVAST Software)
Backup Manager v4 (x32 Version: 4.0.0.0059 - NTI Corporation) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Cool Edit Pro 2.1 (HKLM-x32\...\Cool Edit Pro 2.1) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.16 - Dolby Laboratories Inc)
ETDWare PS/2-X64 11.6.8.001_WHQL (HKLM\...\Elantech) (Version: 11.6.8.001 - ELAN Microelectronic Corp.)
FL Studio 10 (HKLM-x32\...\FL Studio 10) (Version: - Image-Line)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free MP3 Cutter and Editor 2.6 (HKLM-x32\...\Free MP3 Cutter and Editor_is1) (Version: - musetips.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.122 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3004 - Acer Incorporated)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version: - Image-Line)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2867 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Launch Manager (HKLM-x32\...\LManager) (Version: 7.0.4 - Acer Inc.)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.3004 - Acer Incorporated)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
NVIDIA Grafiktreiber 306.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 306.97 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.01.3200 - Acer)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.206 - Ihr Firmenname)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.31 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.28123 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
02-11-2014 17:14:47 Windows Update
05-11-2014 18:04:05 Windows Update
09-11-2014 11:24:07 Windows Update
10-11-2014 19:05:29 Removed Bonjour
12-11-2014 09:19:37 Compatibility Pack für 2007 Office System wird installiert
13-11-2014 16:30:48 Revo Uninstaller's restore point - Open Office Packages
15-11-2014 01:22:12 Revo Uninstaller's restore point - Google Chrome
16-11-2014 19:31:59 Revo Uninstaller's restore point - WildTangent Games
18-11-2014 00:29:41 Revo Uninstaller's restore point - Adobe Flash Player 15 Plugin
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1076514D-DBC6-4676-80AB-836D8C157999} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] ()
Task: {12F6F9AB-07F5-461F-BED9-0D28F53822F2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-15] (Google Inc.)
Task: {13342F80-9699-4DFC-8ECC-E762B1B7452A} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {1BBBE8A5-CB06-4485-97C6-02468B524A86} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] ()
Task: {27040EA4-2BCB-4D23-A06E-2BEBD33BA1D8} - System32\Tasks\iuBrowserIEAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe [2012-08-22] ()
Task: {4A41762A-E822-4BD1-968A-97DE186C3A5B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-11] (Adobe Systems Incorporated)
Task: {6D3A76AE-9F99-4288-B9C7-63F03C403981} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated)
Task: {721C9D56-1694-4B35-BDC9-51B2818CAA1E} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {80C34CEA-B084-4F62-A419-6E752B0C3ECE} - System32\Tasks\iuEmailOutlookAgent => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe [2012-08-22] ()
Task: {98B57BD1-F007-431E-9218-432440F24BA0} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-30] (Microsoft Corporation)
Task: {A6F20B34-F8AD-44CA-8760-D83529E70CFA} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-13] (AVAST Software)
Task: {A713CE03-D183-43B8-8096-94AA73D1870A} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2012-07-31] (Acer Incorporated)
Task: {E4C5CE95-4DB2-4930-BAB8-EA556B4A0302} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-15] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-11-13 00:32 - 2014-11-13 00:32 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-11-13 00:32 - 2014-11-13 00:32 - 05846160 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2012-10-29 05:16 - 2012-10-23 04:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-10-23 20:19 - 2014-10-23 20:19 - 00053248 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2012-08-10 18:28 - 2012-08-10 18:28 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-08-10 18:23 - 2012-08-10 18:23 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2012-08-22 23:04 - 2012-08-22 23:04 - 00044176 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
2012-08-22 23:04 - 2012-08-22 23:04 - 00025232 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
2014-11-18 09:21 - 2014-11-18 09:21 - 02902528 _____ () C:\Program Files\AVAST Software\Avast\defs\14111800\algo.dll
2014-11-13 00:32 - 2014-11-13 00:32 - 04491192 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00465384 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00125504 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00155712 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\VolumeSnapshot.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00118336 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\Online.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 01081408 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-08-23 07:25 - 2012-08-23 07:25 - 00052288 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OsSettingPort.dll
2012-08-23 07:26 - 2012-08-23 07:26 - 00727616 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\OutlookShadow.dll
2013-04-18 15:40 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-11-13 00:32 - 2014-11-13 00:32 - 38561576 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2012-12-25 23:24 - 2012-06-25 03:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-11-15 21:24 - 2014-11-06 00:56 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.122\libglesv2.dll
2014-11-15 21:24 - 2014-11-06 00:56 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.122\libegl.dll
2014-11-15 21:24 - 2014-11-06 00:57 - 08911176 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.122\pdf.dll
2014-11-15 21:24 - 2014-11-06 00:56 - 01681224 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.122\ffmpegsumo.dll
2014-11-15 21:24 - 2014-11-06 00:57 - 14910280 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.122\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "Zune Launcher"
========================= Accounts: ==========================
Administrator (S-1-5-21-2821158248-3669744390-145468304-500 - Administrator - Disabled)
Gast (S-1-5-21-2821158248-3669744390-145468304-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2821158248-3669744390-145468304-1004 - Limited - Enabled)
Patrick (S-1-5-21-2821158248-3669744390-145468304-1002 - Administrator - Enabled) => C:\Users\Patrick
UpdatusUser (S-1-5-21-2821158248-3669744390-145468304-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
Name: Bluetooth USB Module
Description: Bluetooth USB Module
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/18/2014 01:35:27 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Error: (11/18/2014 11:39:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x1608
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Vollständiger Name des fehlerhaften Pakets: RootkitRevealer.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: RootkitRevealer.exe5
Error: (11/18/2014 09:56:06 AM) (Source: ETDService) (EventID: 0) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (11/18/2014 09:21:20 AM) (Source: ETDService) (EventID: 0) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (11/18/2014 02:18:17 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SystemSettings.exe, Version 6.2.9200.16420 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: bc0
Startzeit: 01d002cd76c6cfe3
Endzeit: 10
Anwendungspfad: C:\Windows\ImmersiveControlPanel\SystemSettings.exe
Berichts-ID: c510d4ea-6ec0-11e4-802d-7054d2863b06
Vollständiger Name des fehlerhaften Pakets: windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: microsoft.windows.immersivecontrolpanel
Error: (11/18/2014 01:54:40 AM) (Source: ETDService) (EventID: 0) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (11/18/2014 01:29:55 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddWin32ServiceFiles: Unable to back up image of service Super Optimizer since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (11/17/2014 03:42:56 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Die Liste der eingeschlossenen und ausgeschlossenen Adressen konnte vvon Windows Search nicht verarbeitet werden. Fehler: <30, 0x80040d07, "iehistory://{S-1-5-21-2821158248-3669744390-145468304-1002}/">.
Error: (11/17/2014 03:42:43 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Die Liste der eingeschlossenen und ausgeschlossenen Adressen konnte vvon Windows Search nicht verarbeitet werden. Fehler: <30, 0x80040d07, "iehistory://{S-1-5-21-2821158248-3669744390-145468304-1002}/">.
Error: (11/17/2014 03:38:26 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: Die Liste der eingeschlossenen und ausgeschlossenen Adressen konnte vvon Windows Search nicht verarbeitet werden. Fehler: <30, 0x80040d07, "iehistory://{S-1-5-21-2821158248-3669744390-145468304-1002}/">.
System errors:
=============
Error: (11/18/2014 09:56:00 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
Modulpfad: C:\Program Files (x86)\Qualcomm Atheros\AthIhvWlanExt.dll
Fehlercode: 126
Error: (11/18/2014 09:55:40 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0
Error: (11/18/2014 09:21:12 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
Modulpfad: C:\Program Files (x86)\Qualcomm Atheros\AthIhvWlanExt.dll
Fehlercode: 126
Error: (11/18/2014 09:20:52 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0
Error: (11/18/2014 02:19:01 AM) (Source: DCOM) (EventID: 10000) (User: PATRICK)
Description: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}31{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (11/18/2014 02:17:45 AM) (Source: DCOM) (EventID: 10010) (User: PATRICK)
Description: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
Error: (11/18/2014 01:54:30 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.
Modulpfad: C:\Program Files (x86)\Qualcomm Atheros\AthIhvWlanExt.dll
Fehlercode: 126
Error: (11/18/2014 01:54:08 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 6) (User: NT-AUTORITÄT)
Description: 0xc000014d0
Error: (11/17/2014 09:21:27 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070490 fehlgeschlagen: Brother - Printers - Brother DCP-J125 Printer
Error: (11/17/2014 09:21:16 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Windows-Tool zum Entfernen bösartiger Software für Windows 8, 8.1 und Windows Server 2012, 2012 R2 x64 Edition - November 2014 (KB890830)
Microsoft Office Sessions:
=========================
Error: (11/18/2014 01:35:27 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Patrick\Desktop\esetsmartinstaller_deu.exe
Error: (11/18/2014 11:39:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: RootkitRevealer.exe1.71.0.044e255aaRootkitRevealer.exe1.71.0.044e255aac0000005000040cd160801d0031bfc8056e5C:\Users\Patrick\AppData\Local\Temp\Rar$EXa0.404\RootkitRevealer.exeC:\Users\Patrick\AppData\Local\Temp\Rar$EXa0.404\RootkitRevealer.exe3d2a4144-6f0f-11e4-802f-7054d2863b06
Error: (11/18/2014 09:56:06 AM) (Source: ETDService) (EventID: 0) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (11/18/2014 09:21:20 AM) (Source: ETDService) (EventID: 0) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (11/18/2014 02:18:17 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: SystemSettings.exe6.2.9200.16420bc001d002cd76c6cfe310C:\Windows\ImmersiveControlPanel\SystemSettings.exec510d4ea-6ec0-11e4-802d-7054d2863b06windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewymicrosoft.windows.immersivecontrolpanel
Error: (11/18/2014 01:54:40 AM) (Source: ETDService) (EventID: 0) (User: )
Description: ETDServiceCreateInteractiveProcess failed w/err 0x000003f0
Error: (11/18/2014 01:29:55 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service Super Optimizer since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (11/17/2014 03:42:56 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: 300x80040d07iehistory://{S-1-5-21-2821158248-3669744390-145468304-1002}/
Error: (11/17/2014 03:42:43 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: 300x80040d07iehistory://{S-1-5-21-2821158248-3669744390-145468304-1002}/
Error: (11/17/2014 03:38:26 PM) (Source: Windows Search Service) (EventID: 1019) (User: )
Description: 300x80040d07iehistory://{S-1-5-21-2821158248-3669744390-145468304-1002}/
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 40%
Total physical RAM: 5962.27 MB
Available physical RAM: 3534.96 MB
Total Pagefile: 6922.27 MB
Available Pagefile: 4499.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:680.83 GB) (Free:470.25 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: B532C118)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
19.11.2014, 15:51
| #19 |
| /// the machine /// TB-Ausbilder | Es öffnen sich in Chrome ständig neue Werbetabs von alleine Ok, jetzt nochmal: Verbindest Du Chrome mit einem Google Konto?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.11.2014, 20:20
| #20 |
| | Es öffnen sich in Chrome ständig neue Werbetabs von alleine ja ist verknüpft. Die Werbeumleitungen laufen jetzt über terdir.com. |
|
22.11.2014, 13:54
| #21 |
| /// the machine /// TB-Ausbilder | Es öffnen sich in Chrome ständig neue Werbetabs von alleine Dann synct das Konto die Malware immer wieder in den Browser. Chrome mit dem Konto verknüpfen, dann von Hand alle EInstellungen in Chrome, auch Experteneinstellungen, durchsuchen und alles raus löschen, dann den Browser zurücksetzen.
__________________ --> Es öffnen sich in Chrome ständig neue Werbetabs von alleine |
|
24.11.2014, 14:16
| #22 |
| | Es öffnen sich in Chrome ständig neue Werbetabs von alleine Hab ich versucht, hat nicht geholfen. Hab jetzt Testweise alles von google von der Festplatte gelöscht, Chrome runtergehauen und den Explorer ausgestellt. Hab jetzt Firefox drauf, aber auch noch keine Ruhe. |
|
25.11.2014, 09:39
| #23 |
| /// the machine /// TB-Ausbilder | Es öffnen sich in Chrome ständig neue Werbetabs von alleine In Firefox auch? Router auf Werkseinstellungen zurücksetzen, Verbindungsdaten neu eingeben. Alle Browser zurücksetzen. dann bitte frische FRST Logs.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
