| |
| |||||||
Log-Analyse und Auswertung: Windows 7 Browser AbstürzeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
11.01.2015, 16:16
| #1 |
| |  Windows 7 Browser Abstürze Hallo, ich habe seit ein paar Wochen daS problem, dass meine Browser Chrome und Firefox des Öfteren sich aufhängene. Der PC bekommt keine Rückmeldung dann. Das passiert ca 5-6mal die Stunde. Vorallem Firefox ist davon betroffen. Ich gehe von Malware aus bin mir aber nicht sicher. Hier die Anhänge( hoffentlich nach Plan): FRST: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-01-2015 Ran by Marvin (administrator) on MARVIN-PC on 10-01-2015 19:36:47 Running from C:\Users\Marvin\Downloads Loaded Profiles: UpdatusUser & Marvin (Available profiles: UpdatusUser & Marvin & Mama) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Panicware, Inc.) C:\Program Files (x86)\Panicware\Pop-Up Stopper Free Edition\PSFree.exe (Spotify Ltd) C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\main.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Dropbox, Inc.) C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe (Spotify Ltd) C:\Users\Marvin\AppData\Roaming\Spotify\spotify.exe () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Google Inc.) C:\Users\Marvin\AppData\Local\Google\Chrome\Application\chrome.exe () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe () C:\Users\Marvin\Downloads\SoftonicDownloader_for_rainbow-six-vegas.exe (BitTorrent Inc.) C:\Users\Marvin\AppData\Roaming\uTorrent\uTorrent.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\plugin-hang-ui.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe () C:\Users\Marvin\Downloads\Defogger.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor) HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.) HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [617120 2011-03-13] (Atheros Communications) HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-13] (Atheros Commnucations) HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860040 2011-01-05] (Acer Incorporated) HKLM\...\Run: [OOTag] => C:\Program Files (x86)\Acer\OOBEOffer\ootag.exe [13856 2010-02-23] (Microsoft) HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.) HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [266496 2011-06-17] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [OOTag] => C:\Program Files (x86)\Acer\OOBEOffer\OOTag.exe [13856 2010-02-23] (Microsoft) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5223016 2014-11-18] (AVAST Software) HKLM-x32\...\Run: [RazerCortex] => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe [60640 2014-09-11] (Razer Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-21-2305757966-3810296173-1001282123-1000\...\RunOnce: [ScrSav] => C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-07-29] () HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [PopUpStopperFreeEdition] => C:\Program Files (x86)\Panicware\Pop-Up Stopper Free Edition\PSFree.exe [536576 2005-03-17] (Panicware, Inc.) HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [SCheck] => C:\Users\Marvin\AppData\Roaming\SCheck\SCheck.exe [37376 2013-12-09] () HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [Snoozer] => C:\Users\Marvin\AppData\Roaming\Snz\Snz.exe [1210387 2014-03-12] () HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [Spotify] => C:\Users\Marvin\AppData\Roaming\Spotify\spotify.exe [6737976 2014-12-15] (Spotify Ltd) HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [Spotify Web Helper] => C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-15] (Spotify Ltd) HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [Google Update] => C:\Users\Marvin\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-11-18] (Google Inc.) HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-23] (Piriform Ltd) HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Run: [SoftonicAssistant] => C:\Users\Marvin\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe [1829832 2014-11-11] () HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\RunOnce: [Adobe Speed Launcher] => 1420893508 HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\MountPoints2: F - F:\Autorun.exe HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\MountPoints2: {4ae7da01-94c4-11e3-8f51-1c75083d8045} - G:\Startme.exe HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\MountPoints2: {79ddcf1e-33cd-11e2-a950-806e6f6e6963} - E:\Start.exe HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\MountPoints2: {c773f546-fa2f-11e2-9d08-1c75083d8045} - F:\Autorun.exe HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA Corporation) IFEO\bitguard.exe: [Debugger] tasklist.exe IFEO\bprotect.exe: [Debugger] tasklist.exe IFEO\bpsvc.exe: [Debugger] tasklist.exe IFEO\browsemngr.exe: [Debugger] tasklist.exe IFEO\browserdefender.exe: [Debugger] tasklist.exe IFEO\browsermngr.exe: [Debugger] tasklist.exe IFEO\browserprotect.exe: [Debugger] tasklist.exe IFEO\browsersafeguard.exe: [Debugger] tasklist.exe IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe IFEO\cltmngsvc.exe: [Debugger] tasklist.exe IFEO\delta babylon.exe: [Debugger] tasklist.exe IFEO\delta tb.exe: [Debugger] tasklist.exe IFEO\delta2.exe: [Debugger] tasklist.exe IFEO\deltainstaller.exe: [Debugger] tasklist.exe IFEO\deltasetup.exe: [Debugger] tasklist.exe IFEO\deltatb.exe: [Debugger] tasklist.exe IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe IFEO\dprotectsvc.exe: [Debugger] tasklist.exe IFEO\iminentsetup.exe: [Debugger] tasklist.exe IFEO\jumpflip: [Debugger] tasklist.exe IFEO\protectedsearch.exe: [Debugger] tasklist.exe IFEO\rjatydimofu.exe: [Debugger] tasklist.exe IFEO\searchinstaller.exe: [Debugger] tasklist.exe IFEO\searchprotection.exe: [Debugger] tasklist.exe IFEO\searchprotector.exe: [Debugger] tasklist.exe IFEO\searchsettings.exe: [Debugger] tasklist.exe IFEO\searchsettings64.exe: [Debugger] tasklist.exe IFEO\snapdo.exe: [Debugger] tasklist.exe IFEO\stinst32.exe: [Debugger] tasklist.exe IFEO\stinst64.exe: [Debugger] tasklist.exe IFEO\sweetimsetup.exe: [Debugger] tasklist.exe IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe IFEO\umbrella.exe: [Debugger] tasklist.exe IFEO\utiljumpflip.exe: [Debugger] tasklist.exe IFEO\volaro: [Debugger] tasklist.exe IFEO\vonteera: [Debugger] tasklist.exe IFEO\websteroids.exe: [Debugger] tasklist.exe IFEO\websteroidsservice.exe: [Debugger] tasklist.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://native-search.com/?channel=deg SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12692&tm=272&src=ds&p={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope value is missing. SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12692&tm=272&src=ds&p={searchTerms} SearchScopes: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001 -> DefaultScope {37DC687A-A860-4909-AF61-628DFE94BCC6} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE662D20121231&p={SearchTerms} SearchScopes: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001 -> {3166EBA6-60C9-4505-BD0D-4368E1676DCC} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=b13071dc-a05d-4e4a-8778-3e8fce9f73fd&apn_sauid=FBBCB49D-B32B-4E22-B7BF-184DE8FFFF3B SearchScopes: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001 -> {37DC687A-A860-4909-AF61-628DFE94BCC6} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B011DE662D20121231&p={SearchTerms} SearchScopes: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://native-search.com/search.php?channel=deg&q={searchTerms} SearchScopes: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12692&tm=272&src=ds&p={searchTerms} BHO: No Name -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> No File BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: No Name -> {5C2DD58F-613F-4580-8AC0-F10D760AF938} -> No File BHO-x32: OfferMosquito -> {82B16A3D-F03E-4565-A532-666B219C9A53} -> C:\Users\Marvin\AppData\Local\ext_offermosquito\OfferMosquitoIEPlaceholder.dll (Bebo Media Ltd) BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default FF DefaultSearchUrl: hxxp://axisearch.com/search.php?channel=deg&q= FF Homepage: google.de FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1215155.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @ngm.nexoneu.com/NxGame -> C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2305757966-3810296173-1001282123-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Marvin\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-2305757966-3810296173-1001282123-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Marvin\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-2305757966-3810296173-1001282123-1001: bebomedia.com/OfferMosquitoIEHelper -> C:\Users\Marvin\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll (Bebo Media Ltd) FF user.js: detected! => C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\user.js FF SearchPlugin: C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\searchplugins\default-search.xml FF SearchPlugin: C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\searchplugins\google-maps.xml FF SearchPlugin: C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\searchplugins\search.xml FF SearchPlugin: C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\searchplugins\zonealarm.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\default-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml FF Extension: Avira Browser Safety - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\abs@avira.com [2014-09-30] FF Extension: Cliqz Beta - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\cliqz@cliqz.com [2014-12-26] FF Extension: Adblock Plus Pop-up Addon - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-02-27] FF Extension: OfferMosquito - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\om@offermosquito.com.xpi [2014-01-13] FF Extension: Simple New Tab - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\snt@dotlabs.co.xpi [2013-11-13] FF Extension: NoScript - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-11-18] FF Extension: Adblock Plus - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-18] FF Extension: Adblock Edge - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-11-18] FF Extension: Amazon Browser Bar - C:\Program Files (x86)\Mozilla Firefox\extensions\abb@amazon.com.xpi [2014-12-09] FF Extension: UITBAutoInstaller - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\{edd7fc99-d65c-4979-85c2-ddeed30c50c7} [2014-12-09] FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-18] FF HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\683s7iqv.default\extensions\cliqz@cliqz.com FF HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] Chrome: ======= CHR Profile: C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-18] CHR Extension: (Google Docs) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-18] CHR Extension: (Google Drive) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-18] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-18] CHR Extension: (YouTube) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-18] CHR Extension: (Google-Suche) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-18] CHR Extension: (Avast SafePrice) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2014-11-25] CHR Extension: (Google Tabellen) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-18] CHR Extension: (Avira Browserschutz) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-18] CHR Extension: (AdBlock) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-19] CHR Extension: (Avast Online Security) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-11-18] CHR Extension: (Google Wallet) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-18] CHR Extension: (Google Mail) - C:\Users\Marvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-18] CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2014-11-18] CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-18] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [74912 2011-03-13] (Atheros Commnucations) [File not signed] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-18] (AVAST Software) S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-18] (Avast Software) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation) R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [183488 2014-10-31] () S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.) R2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [105448 2014-09-11] (Razer Inc.) S2 0064161416341939mcinstcleanup; C:\Users\Marvin\AppData\Local\Temp\006416~1.EXE -cleanup -nolog [X] S2 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE" [X] S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X] S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-18] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-18] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-18] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-18] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-22] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-18] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-18] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-18] () R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2014-02-18] (AVG Technologies) U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-10-09] (Kaspersky Lab ZAO) R2 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.) R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2014-10-31] (Razer, Inc.) R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] () R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [270728 2014-11-18] (Avast Software) S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X] S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X] S3 X6va016; \??\C:\Windows\SysWOW64\Drivers\X6va016 [X] S3 X6va017; \??\C:\Windows\SysWOW64\Drivers\X6va017 [X] S3 X6va022; \??\C:\Windows\SysWOW64\Drivers\X6va022 [X] S3 X6va023; \??\C:\Windows\SysWOW64\Drivers\X6va023 [X] S3 X6va027; \??\C:\Windows\SysWOW64\Drivers\X6va027 [X] S3 X6va028; \??\C:\Windows\SysWOW64\Drivers\X6va028 [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-10 19:39 - 2015-01-10 19:39 - 00000000 ____H () C:\Users\Marvin\AppData\Local\BIT54E7.tmp 2015-01-10 19:38 - 2015-01-10 19:38 - 00000000 _____ () C:\Users\Marvin\AppData\Local\{CA4F2A6F-0AAA-4AE8-B255-4C7B35E8F9E9} 2015-01-10 19:36 - 2015-01-10 19:39 - 00031532 _____ () C:\Users\Marvin\Downloads\FRST.txt 2015-01-10 19:36 - 2015-01-10 19:37 - 00000000 ____D () C:\FRST 2015-01-10 19:35 - 2015-01-10 19:35 - 02124288 _____ (Farbar) C:\Users\Marvin\Downloads\FRST64.exe 2015-01-10 19:32 - 2015-01-10 19:33 - 00000474 _____ () C:\Users\Marvin\Downloads\defogger_disable.log 2015-01-10 19:32 - 2015-01-10 19:32 - 00050477 _____ () C:\Users\Marvin\Downloads\Defogger.exe 2015-01-10 19:32 - 2015-01-10 19:32 - 00000000 _____ () C:\Users\Marvin\defogger_reenable 2015-01-10 19:26 - 2015-01-10 19:26 - 00000000 ____D () C:\Users\Marvin\Desktop\R6VegasMapsPack 2015-01-10 19:10 - 2007-07-09 09:33 - 00552214 _____ (Macrovision Corporation) C:\Users\Marvin\Desktop\ISSetup.dll 2015-01-10 19:03 - 2007-07-09 09:39 - 772145739 _____ () C:\Users\Marvin\Desktop\data2.cab 2015-01-10 19:03 - 2007-07-09 09:39 - 00000437 _____ () C:\Users\Marvin\Desktop\layout.bin 2015-01-10 19:03 - 2007-07-09 09:34 - 01210815 _____ () C:\Users\Marvin\Desktop\data1.cab 2015-01-10 19:03 - 2007-07-09 09:34 - 00042603 _____ () C:\Users\Marvin\Desktop\data1.hdr 2015-01-10 19:03 - 2007-07-09 09:33 - 00000585 _____ () C:\Users\Marvin\Desktop\setup.ini 2015-01-10 19:03 - 2006-05-24 11:10 - 00455600 _____ (Macrovision Corporation) C:\Users\Marvin\Desktop\setup.exe 2015-01-10 19:03 - 2006-05-17 10:21 - 00385968 _____ (Macrovision Corporation) C:\Users\Marvin\Desktop\_Setup.dll 2015-01-10 16:26 - 2015-01-10 16:26 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2015-01-10 16:24 - 2015-01-10 19:37 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\uTorrent 2015-01-10 16:23 - 2015-01-10 16:24 - 01678928 _____ (BitTorrent Inc.) C:\Users\Marvin\Downloads\uTorrent.exe 2015-01-10 16:23 - 2015-01-10 16:23 - 00016715 _____ () C:\Users\Marvin\Downloads\Tom.Clancy.s.Rainbow.Six.Vegas.2 - SKIDROW.torrent 2015-01-10 16:13 - 2015-01-10 16:13 - 00000000 ____D () C:\Users\Marvin\Downloads\R6VegasMapsPack 2015-01-10 15:47 - 2015-01-10 16:02 - 687386927 _____ () C:\Users\Marvin\Desktop\rainbow_six_vegas_maps_pack[1].exe 2015-01-10 15:21 - 2015-01-10 15:36 - 687386927 _____ () C:\Users\Marvin\Desktop\rainbow_six_vegas_maps_pack.exe 2015-01-10 15:10 - 2015-01-10 15:10 - 00000000 ____D () C:\Users\Marvin\AppData\Local\SoftonicAssistant 2015-01-10 15:09 - 2015-01-10 15:09 - 00373080 _____ () C:\Users\Marvin\Downloads\SoftonicDownloader_for_rainbow-six-vegas.exe 2015-01-07 14:53 - 2015-01-08 23:49 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\Gyazo 2015-01-07 14:52 - 2015-01-10 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gyazo 2015-01-07 14:52 - 2015-01-07 14:52 - 00003752 _____ () C:\Windows\System32\Tasks\GyazoUpdateTaskMachine 2015-01-07 14:49 - 2015-01-07 14:50 - 09698760 _____ (Nota Inc. ) C:\Users\Marvin\Downloads\Gyazo-2.3.0.exe 2015-01-04 16:11 - 2015-01-06 13:34 - 00000000 ____D () C:\Program Files (x86)\SpeedFan 2015-01-04 16:11 - 2015-01-04 16:11 - 00001015 _____ () C:\Users\UpdatusUser\Desktop\SpeedFan.lnk 2015-01-04 16:11 - 2015-01-04 16:11 - 00001015 _____ () C:\Users\Marvin\Desktop\SpeedFan.lnk 2015-01-04 16:11 - 2015-01-04 16:11 - 00001015 _____ () C:\Users\Mama\Desktop\SpeedFan.lnk 2015-01-04 16:11 - 2015-01-04 16:11 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo 2015-01-04 16:11 - 2015-01-04 16:11 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan 2015-01-04 16:11 - 2015-01-04 16:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan 2015-01-04 16:10 - 2015-01-04 16:11 - 02174848 _____ () C:\Users\Marvin\Downloads\instsf450.exe 2015-01-02 01:43 - 2015-01-02 01:43 - 00595480 _____ () C:\Users\Marvin\Downloads\Nicht bestätigt 293018.crdownload 2014-12-28 21:38 - 2014-12-28 21:38 - 00001935 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2014-12-28 21:38 - 2014-12-28 21:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2014-12-28 21:38 - 2014-12-28 21:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan 2014-12-26 21:37 - 2014-12-28 21:38 - 00000000 ____D () C:\ProgramData\McAfee Security Scan 2014-12-26 18:01 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2014-12-26 18:01 - 2014-05-08 10:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2014-12-26 18:00 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-12-26 18:00 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-12-26 16:49 - 2014-12-26 16:49 - 00000000 ____D () C:\Users\Marvin\Documents\Razer 2014-12-26 16:49 - 2014-12-26 16:49 - 00000000 ____D () C:\Users\Marvin\AppData\Local\Razer_Inc 2014-12-26 16:47 - 2014-12-26 16:47 - 00000000 ____D () C:\Users\Marvin\AppData\Local\Razer 2014-12-26 16:46 - 2014-12-26 16:46 - 00001260 _____ () C:\Users\Public\Desktop\Razer Cortex.lnk 2014-12-26 16:46 - 2014-12-26 16:46 - 00000000 ____D () C:\ProgramData\Razer 2014-12-26 16:46 - 2014-12-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer 2014-12-26 16:46 - 2014-12-26 16:46 - 00000000 ____D () C:\Program Files (x86)\Razer 2014-12-26 16:46 - 2014-10-31 23:27 - 00037184 _____ (Razer, Inc.) C:\Windows\system32\Drivers\rzpmgrk.sys 2014-12-26 16:44 - 2014-12-26 16:44 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\Cliqz 2014-12-26 16:44 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-12-26 16:44 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-12-26 16:42 - 2014-12-26 16:42 - 01174352 _____ () C:\Users\Marvin\Downloads\Razer Cortex Game Booster - CHIP-Installer.exe 2014-12-26 15:18 - 2014-12-26 15:18 - 00000000 ____D () C:\ProgramData\Intel 2014-12-26 14:56 - 2014-12-26 14:56 - 00000000 ____D () C:\Windows\SysWOW64\NV 2014-12-26 14:56 - 2014-12-26 14:56 - 00000000 ____D () C:\Windows\system32\NV 2014-12-26 14:53 - 2014-12-26 14:53 - 01065096 _____ (Download Manager) C:\Users\Marvin\Downloads\Nicht bestätigt 216355.crdownload 2014-12-26 13:51 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2014-12-26 13:50 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2014-12-26 13:50 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2014-12-26 13:50 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2014-12-26 13:50 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2014-12-26 13:50 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2014-12-26 13:50 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2014-12-26 13:50 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll 2014-12-26 13:50 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll 2014-12-26 13:50 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll 2014-12-26 13:50 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2014-12-26 13:50 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2014-12-26 13:50 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2014-12-26 13:50 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2014-12-26 13:50 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll 2014-12-26 13:50 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2014-12-26 13:33 - 2015-01-09 19:49 - 00002856 _____ () C:\Windows\setupact.log 2014-12-26 13:33 - 2014-12-26 13:33 - 00000000 _____ () C:\Windows\setuperr.log 2014-12-26 13:31 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2014-12-26 13:31 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys 2014-12-26 13:31 - 2012-08-23 15:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys 2014-12-26 13:31 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll 2014-12-26 13:31 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll 2014-12-18 08:19 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-18 08:19 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-12 15:24 - 2014-12-12 15:25 - 00000000 ____D () C:\Users\Marvin\AppData\Local\MetaGeek,_LLC 2014-12-12 15:24 - 2014-12-12 15:24 - 00002489 _____ () C:\Users\Public\Desktop\inSSIDer Home.lnk 2014-12-12 15:24 - 2014-12-12 15:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MetaGeek 2014-12-12 15:24 - 2014-12-12 15:24 - 00000000 ____D () C:\Program Files (x86)\MetaGeek 2014-12-12 15:21 - 2014-12-12 15:21 - 01174352 _____ () C:\Users\Marvin\Downloads\inSSIDer Home letzte Freeware Version - CHIP-Installer.exe 2014-12-11 08:18 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-11 08:18 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-11 08:18 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-11 08:18 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-11 08:18 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-11 08:18 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-11 08:18 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-11 08:18 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-11 08:18 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-11 08:18 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-10 19:37 - 2014-02-18 16:36 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-10 19:37 - 2014-02-18 16:36 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-10 19:34 - 2012-07-17 15:02 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-10 19:32 - 2012-12-31 11:45 - 00000000 ____D () C:\Users\Marvin 2015-01-10 19:28 - 2014-10-14 16:54 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\Spotify 2015-01-10 18:41 - 2014-11-18 19:35 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2305757966-3810296173-1001282123-1001UA.job 2015-01-10 17:31 - 2012-11-21 11:48 - 01347541 _____ () C:\Windows\WindowsUpdate.log 2015-01-10 15:18 - 2014-11-18 19:54 - 00000000 ____D () C:\Program Files\CCleaner 2015-01-10 15:06 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2015-01-10 15:03 - 2012-07-17 14:40 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-01-09 19:40 - 2014-11-18 19:35 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2305757966-3810296173-1001282123-1001Core.job 2015-01-08 23:33 - 2012-12-31 12:09 - 00000000 ____D () C:\Users\Marvin\AppData\Local\CrashDumps 2015-01-08 13:48 - 2009-07-14 05:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-08 13:48 - 2009-07-14 05:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-08 13:42 - 2014-04-01 15:31 - 00000000 ___RD () C:\Users\Marvin\Dropbox 2015-01-08 13:42 - 2014-03-07 23:22 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\Dropbox 2015-01-08 13:41 - 2014-03-07 23:25 - 00008467 _____ () C:\Windows\wininit.ini 2015-01-08 13:39 - 2013-01-01 16:59 - 00000450 ____H () C:\Windows\Tasks\Norton Security Scan for Marvin.job 2015-01-08 13:39 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-07 16:38 - 2014-10-14 16:55 - 00000000 ____D () C:\Users\Marvin\AppData\Local\Spotify 2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-01-03 21:00 - 2013-01-01 14:57 - 00000000 ____D () C:\Windows\SysWOW64\Adobe 2015-01-01 17:51 - 2013-03-07 21:32 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\TS3Client 2014-12-30 00:51 - 2014-11-18 22:14 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-12-27 14:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-26 21:50 - 2013-01-27 19:35 - 00000000 ____D () C:\Users\Marvin\AppData\Local\Adobe 2014-12-26 21:37 - 2012-07-17 15:02 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-26 21:37 - 2012-07-17 15:02 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-26 21:37 - 2012-07-17 15:02 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-26 21:37 - 2012-07-17 14:38 - 00000000 ____D () C:\ProgramData\McAfee 2014-12-26 18:40 - 2014-02-18 16:37 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\Fifth 2014-12-26 18:36 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-26 14:56 - 2012-11-21 11:57 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-12-26 14:56 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2014-12-26 14:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-26 13:50 - 2012-11-21 11:49 - 00000000 ____D () C:\Program Files (x86)\Intel 2014-12-26 13:47 - 2013-09-10 17:41 - 00000000 ____D () C:\TEMP 2014-12-26 13:38 - 2012-11-21 11:56 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-12-26 13:38 - 2012-11-21 11:56 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-12-21 20:27 - 2014-03-07 23:25 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-12-16 00:06 - 2012-07-17 14:58 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-12-11 08:56 - 2012-12-31 12:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-11 08:51 - 2013-02-04 18:19 - 00000000 ____D () C:\Users\Marvin\AppData\Roaming\SoftGrid Client 2014-12-11 08:50 - 2014-11-18 19:39 - 00002331 _____ () C:\Users\Marvin\Desktop\Google Chrome.lnk 2014-12-11 08:34 - 2013-08-15 10:58 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-11 08:20 - 2013-01-31 17:39 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe Some content of TEMP: ==================== C:\Users\Mama\AppData\Local\Temp\avgnt.exe C:\Users\Marvin\AppData\Local\Temp\drm_dialogs.dll C:\Users\Marvin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpluov6c.dll C:\Users\Marvin\AppData\Local\Temp\sfamcc00001.dll C:\Users\Marvin\AppData\Local\Temp\sfareca00001.dll C:\Users\Marvin\AppData\Local\Temp\sfextra.dll C:\Users\Marvin\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe C:\Users\Marvin\AppData\Local\Temp\utt9A77.tmp.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-05 20:21 ==================== End Of Log ============================ ADDITION: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-01-2015 Ran by Marvin at 2015-01-10 19:39:46 Running from C:\Users\Marvin\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) µTorrent (HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\uTorrent) (Version: 3.4.2.37951 - BitTorrent Inc.) 888casino (HKLM-x32\...\888casino) (Version: - ) Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.72 - NewTech Infosystems) Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1904 - CyberLink Corp.) Acer Crystal Eye Webcam (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3009 - Acer Incorporated) Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3500 - Acer) Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3506 - Acer Incorporated) Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0517.2011 - Acer Incorporated) Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3501 - Acer Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated) Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated) Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated) Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.5.155 - Adobe Systems, Inc.) Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2206 - AVAST Software) Backup Manager Basic (x32 Version: 2.0.0.72 - NewTech Infosystems) Hidden Bing Bar (HKLM-x32\...\{C28D96C0-6A90-459E-A077-A6706F4EC0FC}) (Version: 7.0.765.0 - Microsoft Corporation) Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.65 - Atheros Communications) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Broadcom Gigabit NetLink Controller (HKLM\...\{A84DB02B-9C2B-4272-9D2D-A80E00A56513}) (Version: 14.0.2.3 - Broadcom Corporation) CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform) Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.53 - Cliqz.com) Combat Arms EU (HKLM-x32\...\Combat Arms EU) (Version: - ) Counter-Strike (HKLM-x32\...\Counter-Strike) (Version: - ) Crossfire Europe (HKLM-x32\...\Crossfire Europe) (Version: 1181 - SG INTERACTIVE) CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.3817.50 - CyberLink Corp.) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Dropbox (HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.) eBay Worldwide (HKLM-x32\...\{D3E5A972-9A15-427D-AE78-8181A5FD943C}) (Version: 2.2.0409 - OEM) ETDWare PS/2-x64 7.0.6.5_WHQL (HKLM\...\Elantech) (Version: 7.0.6.5 - ELAN Microelectronics Corp.) Evernote v. 4.5.2 (HKLM-x32\...\{F77EF646-19EB-11E1-9A9E-984BE15F174E}) (Version: 4.5.2.5866 - Evernote Corp.) Fooz Kids (HKLM-x32\...\FoozKids) (Version: 3.1.2 - FUHU, Inc.) Fooz Kids (x32 Version: 3.1.2 - FUHU, Inc.) Hidden Fooz Kids Platform (HKLM-x32\...\{8D68CE08-9A14-4B7B-9857-3C646A2F34C7}) (Version: 2.1 - FUHU, Inc.) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Fraps (HKLM-x32\...\Fraps) (Version: - ) Free YouTube Download version 3.2.0.128 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.0.128 - DVDVideoSoft Ltd.) Free YouTube to MP3 Converter version 3.12.41.623 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.41.623 - DVDVideoSoft Ltd.) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Google Chrome (HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.) Google Chrome Frame (HKLM-x32\...\{8618AE04-1210-3C32-A8C3-45A5E44CD340}) (Version: 65.169.107 - Google, Inc.) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Gyazo 2.3 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version: - Nota Inc.) Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated) inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2182 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation) iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Kobo (HKLM-x32\...\Kobo) (Version: 2.1.5 - Kobo Inc.) Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Acer Inc.) League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games) LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.6 - www.leaguereplays.com) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5128.5002 - Microsoft Corporation) Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) myMixrechner 1.3.5 (HKLM-x32\...\{C3C834CF-5262-42AA-8CD8-3A158676597E}_is1) (Version: - hr) MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.19 - Egis Technology Inc.) MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.) newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation) NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9006 - NTI Corporation) NTI Media Maker 9 (x32 Version: 9.0.2.9006 - NTI Corporation) Hidden NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation) NVIDIA PhysX (HKLM-x32\...\{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}) (Version: 9.10.0514 - NVIDIA Corporation) NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation) PlayStation(R)Store (HKLM-x32\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.18.0.15698 - Sony Computer Entertainment Inc.) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Pop-Up Stopper Free Edition (HKLM-x32\...\Pop-Up Stopper Free Edition) (Version: 3.1.1014 - Panicware, Inc.) Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Python 3.3.0 (HKLM-x32\...\{526B1417-92C1-3737-8247-4ABC49CCC8E4}) (Version: 3.3.150 - Python Software Foundation) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Razer Cortex (HKLM-x32\...\Razer Cortex_is1) (Version: 5.1.38.0 - Razer Inc.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6141 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30124 - Realtek Semiconductor Corp.) RollerCoaster Tycoon Deluxe (HKLM-x32\...\{924EAD66-F854-4605-8493-696DD59A113B}) (Version: 1.00.000 - ) Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee) Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) Softonic Assistant (HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\SoftonicAssistant) (Version: 0.1.6 - Softonic International S.A.) <==== ATTENTION SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - ) Spotify (HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB) Star Wars Battlefront II (HKLM-x32\...\{3D374523-CFDE-461A-827E-2A102E2AB365}) (Version: 1.0 - LucasArts) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden TeamSpeak 3 Client (HKU\S-1-5-21-2305757966-3810296173-1001282123-1001\...\TeamSpeak 3 Client) (Version: 3.0.15.1 - TeamSpeak Systems GmbH) Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel) Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden WEB.DE MailCheck für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 2.10.1.1735 - 1&1 Mail & Media GmbH) Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3507 - Acer Incorporated) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation) WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies) WinRAR 5.11 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH) Wireshark 1.8.6 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.8.6 - The Wireshark developer community, hxxp://www.wireshark.org) Wisdom-soft AutoScreenRecorder 3.1 Pro (HKLM-x32\...\Wisdom-soft AutoScreenRecorder 3.1 Pro) (Version: - Wisdom Software Inc.) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Marvin\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Marvin\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2305757966-3810296173-1001282123-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.) ==================== Restore Points ========================= 14-12-2014 10:35:57 Windows Update 19-12-2014 07:25:41 Windows Update 23-12-2014 11:25:52 Windows Update 26-12-2014 13:28:56 Windows Update 26-12-2014 15:26:28 Windows Update 26-12-2014 18:01:50 Windows Update 26-12-2014 19:44:01 Windows Update 30-12-2014 13:06:26 Windows Update 02-01-2015 16:01:07 Windows Update 06-01-2015 09:46:35 Windows Update 09-01-2015 13:33:01 Windows Update 10-01-2015 14:58:49 Installiert Tom Clancy's Rainbow Six: Lockdown ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {09E257D0-5A21-498A-AE35-BE4D619E585D} - System32\Tasks\Fifth => C:\Users\Marvin\AppData\Roaming\Fifth\Fifth.exe [2014-03-12] () <==== ATTENTION Task: {14303EF1-DAE1-45F9-975A-2C25F7AB1ED5} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe Task: {1AD0D93A-5AEE-4CEA-8B0F-98BCEF05DE03} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.) Task: {1D0BAE22-273C-43E3-BA22-2575F5BD73A6} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.) Task: {2625AFAC-3DE2-4513-81A4-594E92BDDA40} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-26] (Adobe Systems Incorporated) Task: {368FF118-2A4F-4A46-990B-9630DAB1AF41} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2305757966-3810296173-1001282123-1001Core => C:\Users\Marvin\AppData\Local\Google\Update\GoogleUpdate.exe [2014-11-18] (Google Inc.) Task: {42E07AEB-29A0-47AE-86EF-20F48A74C5C0} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION Task: {5AF89CD6-0EC7-4B6D-9A8B-9CB1E75B3C17} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe Task: {6347FAF5-235F-4777-9780-7B6C860777D3} - System32\Tasks\Norton Security Scan for Marvin => C:\PROGRA~2\NORTON~2\Engine\372~1.5\Nss.exe Task: {70598207-4B68-4717-AE9F-64195BA3A5BB} - \SidebarExecute No Task File <==== ATTENTION Task: {8D18759A-C306-47CF-922D-D4A75BEEBC9C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {BF833759-1924-4932-834B-012F11309E98} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-07] (Acer Incorporated) Task: {C9BA1AF5-29BA-44F3-A294-C931DF7AA272} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2305757966-3810296173-1001282123-1001UA => C:\Users\Marvin\AppData\Local\Google\Update\GoogleUpdate.exe [2014-11-18] (Google Inc.) Task: {DBE3C1FA-B818-4CA6-909D-2A0017660657} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-18] (AVAST Software) Task: {E6EB9B7D-8B81-420B-B29A-975AA54BEFF3} - System32\Tasks\{21E6E793-A20C-41D8-BF3C-6EA85A49DD4A} => pcalua.exe -a C:\Users\Marvin\Downloads\dotNetFx35setup(1).exe -d C:\Users\Marvin\Downloads Task: {E8A5C78A-B35A-400F-8E91-128082B6AA87} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-18] (Google Inc.) Task: {EE2160F2-2D63-468F-8E09-F418443263CB} - System32\Tasks\OMESupervisor => C:\Users\Marvin\AppData\Local\omesuperv.exe <==== ATTENTION Task: {F7B7B53B-0C6F-4E23-A531-871EC8CFB742} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-18] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2305757966-3810296173-1001282123-1001Core.job => C:\Users\Marvin\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2305757966-3810296173-1001282123-1001UA.job => C:\Users\Marvin\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\Norton Security Scan for Marvin.job => C:\PROGRA~2\NORTON~2\Engine\372~1.5\Nss.exe ==================== Loaded Modules (whitelisted) ============= 2012-11-21 11:57 - 2013-08-29 23:43 - 00097568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2013-09-05 02:36 - 2013-09-05 02:36 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll 2014-10-31 23:27 - 2014-10-31 23:27 - 00183488 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe 2012-01-10 21:12 - 2012-01-10 21:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2014-10-14 16:55 - 2014-12-15 20:22 - 00374840 _____ () C:\Users\Marvin\AppData\Roaming\Spotify\Data\SpotifyHelper.exe 2015-01-10 15:09 - 2015-01-10 15:09 - 00373080 _____ () C:\Users\Marvin\Downloads\SoftonicDownloader_for_rainbow-six-vegas.exe 2015-01-10 19:32 - 2015-01-10 19:32 - 00050477 _____ () C:\Users\Marvin\Downloads\Defogger.exe 2015-01-08 10:36 - 2015-01-08 10:36 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010800\algo.dll 2015-01-10 13:30 - 2015-01-10 13:30 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15011000\algo.dll 2014-04-23 15:05 - 2014-04-23 15:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-04-23 15:04 - 2014-04-23 15:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2010-12-22 18:22 - 2010-12-22 18:22 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll 2010-12-22 18:10 - 2010-12-22 18:10 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll 2014-11-18 22:13 - 2014-11-18 22:13 - 38561576 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-12-26 16:46 - 2012-11-20 16:13 - 00264192 _____ () C:\Program Files (x86)\Razer\Razer Cortex\D3DX8Wrapper.dll 2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\libGLESv2.dll 2015-01-08 13:41 - 2015-01-08 13:41 - 00043008 _____ () c:\users\marvin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpluov6c.dll 2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\libEGL.dll 2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll 2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll 2014-10-18 17:55 - 2014-10-18 17:55 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\89753abff3827095ec7f3d3fb79f744a\IsdiInterop.ni.dll 2012-11-21 11:59 - 2010-04-13 09:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2014-12-11 08:50 - 2014-12-06 02:50 - 01077064 _____ () C:\Users\Marvin\AppData\Local\Google\Chrome\Application\39.0.2171.95\libglesv2.dll 2014-12-11 08:50 - 2014-12-06 02:50 - 00211272 _____ () C:\Users\Marvin\AppData\Local\Google\Chrome\Application\39.0.2171.95\libegl.dll 2014-12-11 08:50 - 2014-12-06 02:50 - 09009480 _____ () C:\Users\Marvin\AppData\Local\Google\Chrome\Application\39.0.2171.95\pdf.dll 2014-12-11 08:50 - 2014-12-06 02:50 - 01677128 _____ () C:\Users\Marvin\AppData\Local\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll 2014-10-14 16:55 - 2014-12-15 20:22 - 36966968 _____ () C:\Users\Marvin\AppData\Roaming\Spotify\Data\libcef.dll 2014-10-14 16:55 - 2014-12-15 20:22 - 00867896 _____ () C:\Users\Marvin\AppData\Roaming\Spotify\Data\ffmpegsumo.dll 2014-10-14 16:55 - 2014-12-15 20:22 - 00886840 _____ () C:\Users\Marvin\AppData\Roaming\Spotify\Data\libglesv2.dll 2014-10-14 16:55 - 2014-12-15 20:22 - 00108600 _____ () C:\Users\Marvin\AppData\Roaming\Spotify\Data\libegl.dll 2014-12-09 18:02 - 2014-12-09 18:02 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2014-12-26 21:37 - 2014-12-26 21:37 - 16843952 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-2305757966-3810296173-1001282123-500 - Administrator - Disabled) Gast (S-1-5-21-2305757966-3810296173-1001282123-501 - Limited - Disabled) Mama (S-1-5-21-2305757966-3810296173-1001282123-1002 - Limited - Enabled) => C:\Users\Mama Marvin (S-1-5-21-2305757966-3810296173-1001282123-1001 - Administrator - Enabled) => C:\Users\Marvin UpdatusUser (S-1-5-21-2305757966-3810296173-1001282123-1000 - Limited - Enabled) => C:\Users\UpdatusUser ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (01/10/2015 05:31:28 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 61059 Error: (01/10/2015 05:31:28 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 61059 Error: (01/10/2015 05:31:28 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (01/10/2015 05:31:27 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 59733 Error: (01/10/2015 05:31:27 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 59733 Error: (01/10/2015 05:31:27 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (01/10/2015 05:31:26 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 58703 Error: (01/10/2015 05:31:26 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 58703 Error: (01/10/2015 05:31:26 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (01/10/2015 05:31:25 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 57673 System errors: ============= Error: (01/10/2015 03:03:12 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:03:05 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:54 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:49 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:44 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:38 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:33 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:28 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:23 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Error: (01/10/2015 03:02:18 PM) (Source: cdrom) (EventID: 7) (User: ) Description: Fehlerhafter Block bei Gerät \Device\CdRom0. Microsoft Office Sessions: ========================= Error: (01/10/2015 05:31:28 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 61059 Error: (01/10/2015 05:31:28 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 61059 Error: (01/10/2015 05:31:28 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (01/10/2015 05:31:27 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 59733 Error: (01/10/2015 05:31:27 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 59733 Error: (01/10/2015 05:31:27 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (01/10/2015 05:31:26 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 58703 Error: (01/10/2015 05:31:26 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 58703 Error: (01/10/2015 05:31:26 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (01/10/2015 05:31:25 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 57673 ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5 CPU M 480 @ 2.67GHz Percentage of memory in use: 73% Total physical RAM: 3766.71 MB Available physical RAM: 998.95 MB Total Pagefile: 7912.73 MB Available Pagefile: 2761.92 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:338.47 GB) (Free:3.24 GB) NTFS Drive d: (DATA) (Fixed) (Total:338.58 GB) (Free:319.17 GB) NTFS Drive e: (Disk1) (CDROM) (Total:7.31 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 4465FBED) Partition 1: (Not Active) - (Size=21.5 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=338.5 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=338.6 GB) - (Type=07 NTFS) ==================== End Of Log ============================ GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-01-11 15:47:06 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE4O 698,64GB Running: Gmer-19357.exe; Driver: C:\Users\Marvin\AppData\Local\Temp\agdiypob.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800035b3000 45 bytes [01, 00, 00, 00, 00, 00, 00, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800035b302f 16 bytes [00, 01, 30, 9C, 12, A0, F8, ...] ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\Dwm.exe[2176] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd1f2db0 5 bytes JMP 000007fffd1e0180 .text C:\Windows\system32\Dwm.exe[2176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd1f37d0 7 bytes JMP 000007fffd1e00d8 .text C:\Windows\system32\Dwm.exe[2176] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd1f8ef0 6 bytes JMP 000007fffd1e0148 .text C:\Windows\system32\Dwm.exe[2176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd20af60 5 bytes JMP 000007fffd1e0110 .text C:\Windows\system32\Dwm.exe[2176] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff0989f0 8 bytes JMP 000007fffd1e01f0 .text C:\Windows\system32\Dwm.exe[2176] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff09be50 8 bytes JMP 000007fffd1e01b8 .text C:\Program Files (x86)\Launch Manager\LMworker.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000758a1465 2 bytes [8A, 75] .text C:\Program Files (x86)\Launch Manager\LMworker.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758a14bb 2 bytes [8A, 75] .text ... * 2 .text C:\Program Files (x86)\Launch Manager\LManager.exe[4132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000758a1465 2 bytes [8A, 75] .text C:\Program Files (x86)\Launch Manager\LManager.exe[4132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758a14bb 2 bytes [8A, 75] .text ... * 2 .text C:\Program Files\AVAST Software\Avast\avastui.exe[2984] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075f98791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files\Internet Explorer\iexplore.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000771b3b10 6 bytes {NOP ; JMP 0x8e3cc4c} .text C:\Program Files\Internet Explorer\iexplore.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000771b7ac0 6 bytes {NOP ; JMP 0x8e388e4} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[15800] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000773ac4dd 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[15800] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000773b1287 5 bytes JMP 00000001000303fc .text C:\Users\Marvin\Downloads\Gmer-19357.exe[18304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000758a1465 2 bytes [8A, 75] .text C:\Users\Marvin\Downloads\Gmer-19357.exe[18304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758a14bb 2 bytes [8A, 75] .text ... * 2 ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\services.exe [816:940] 000007fefc2a94c4 Thread C:\Windows\System32\svchost.exe [688:1248] 000007fefafd59a0 Thread C:\Windows\System32\svchost.exe [688:1564] 000007fefc931a70 Thread C:\Windows\System32\svchost.exe [688:3644] 000007fef4dd20c0 Thread C:\Windows\System32\svchost.exe [688:3652] 000007fef4dd26a8 Thread C:\Windows\System32\svchost.exe [688:8972] 000007fef56488f8 Thread C:\Windows\System32\svchost.exe [688:17764] 000007fef4dd29dc Thread C:\Windows\System32\svchost.exe [688:2976] 000007fef4dd29dc Thread C:\Windows\system32\svchost.exe [708:14160] 000007fef1b4034c Thread C:\Windows\system32\svchost.exe [708:14256] 000007fef1b3fb90 Thread C:\Windows\system32\svchost.exe [900:6716] 000007fef95c4164 Thread C:\Windows\system32\svchost.exe [900:17640] 000007fef4db1ab0 Thread C:\Windows\system32\svchost.exe [1180:2968] 000007fef618bd88 Thread C:\Windows\system32\svchost.exe [1180:13144] 000007fef7785170 Thread C:\Windows\system32\svchost.exe [1180:17536] 000007fef66b341c Thread C:\Windows\system32\svchost.exe [1180:19944] 000007fef66b3a2c Thread C:\Windows\system32\svchost.exe [1180:7964] 000007fef66b3768 Thread C:\Windows\system32\svchost.exe [1180:19788] 000007fef66b5c20 Thread C:\Windows\system32\svchost.exe [1180:7124] 000007fefeee52e0 Thread C:\Windows\system32\Dwm.exe [2176:19624] 000007fef69dabf0 Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3324:3448] 000000006850f71d Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3324:3504] 000000006850f71d Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3324:3508] 0000000068505b1a Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3324:3868] 000000006850f71d Thread C:\Windows\System32\svchost.exe [4100:4520] 000007fef0c89688 Thread C:\Windows\system32\AUDIODG.EXE [5860:6984] 00000000728db278 Thread C:\Windows\system32\AUDIODG.EXE [5860:8540] 00000000728db3f8 Thread C:\Windows\system32\AUDIODG.EXE [5860:17360] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:11616] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:9760] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:10344] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:14264] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:8732] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10888] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:5992] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:17052] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:17380] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:9816] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:14064] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:15032] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:5164] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:4276] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:13928] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:9180] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:12088] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:6724] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:4656] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10968] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:8312] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:17252] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:7488] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10544] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:12608] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:17136] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:14228] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:16740] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:10568] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:13584] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:9856] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:16764] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:16912] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:16768] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:1668] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10832] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:9984] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:14268] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:16748] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:15860] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:14648] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10312] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:2872] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:14712] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:17088] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:15516] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:5096] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:4336] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:12996] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:16052] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:14020] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:16232] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:13088] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10848] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:16528] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:444] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:8088] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:6772] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:7208] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:17160] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:16568] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10784] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:13232] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:8484] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:10908] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:2120] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:10964] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:13456] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:6856] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:10192] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:15868] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:6252] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:16992] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:15736] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:9904] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:8016] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:9396] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:7072] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:8408] 00000000728ea38c Thread C:\Windows\system32\AUDIODG.EXE [5860:16816] 00000000728ea228 Thread C:\Windows\system32\AUDIODG.EXE [5860:9640] 00000000728ea38c Thread C:\Program Files\Internet Explorer\iexplore.exe [7944:2224] 000007fefec085a0 Thread C:\Program Files\Internet Explorer\iexplore.exe [7944:13468] 000007fef37f2960 Thread C:\Program Files\Internet Explorer\iexplore.exe [7944:17352] 000007fefe9e6e60 Thread C:\Program Files\Internet Explorer\iexplore.exe [7944:15040] 000007fefec07e50 Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [15800:11660] 000000005fe53900 Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [15800:10304] 000000005fe53900 Thread C:\Windows\system32\mmc.exe [19220:18124] 000007fefa902bf8 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46ac423e3 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46ac423e3@8400d28b1f8e 0x51 0x96 0x86 0xFA ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46ac423e3@0c14205ada7b 0xBE 0x26 0x2A 0x5A ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46ac423e3 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46ac423e3@8400d28b1f8e 0x51 0x96 0x86 0xFA ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46ac423e3@0c14205ada7b 0xBE 0x26 0x2A 0x5A ... ---- EOF - GMER 2.1 ---- Hoffentlich könnt ihr mir helfen. LG porkmarv |
| Themen zu Windows 7 Browser Abstürze |
| abstürze, antivirus, avira, bingbar, bonjour, browser, chrome, computer, converter, desktop, dvdvideosoft ltd., firefox, flash player, google, home, homepage, iexplore.exe, kaspersky, keine reaktion, langsam, launch, malware, mp3, msiexec.exe, problem, realtek, registry, security, software, svchost.exe, symantec, system, vonteera, windows |
Baum-Darstellung