| |
| |||||||
Log-Analyse und Auswertung: Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.AWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
03.02.2015, 11:48
| #16 |
| /// the machine /// TB-Ausbilder    |  Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\ProgramData\hmuqQl
S2 csrcc; "C:\Program Files\shopperz\csrcc.exe" [X]
C:\Program Files\shopperz
Emptytemp:
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Frisches FRST log aus dem normalen Modus bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.02.2015, 22:56
| #17 |
 | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.ACode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-02-2015
Ran by SYSTEM at 2015-02-03 22:50:32 Run:3
Running from H:\
Boot Mode: Recovery
==============================================
Content of fixlist:
*****************
C:\ProgramData\hmuqQl
S2 csrcc; "C:\Program Files\shopperz\csrcc.exe" [X]
C:\Program Files\shopperz
Emptytemp:
*****************
"C:\ProgramData\hmuqQl" => File/Directory not found.
csrcc => Service deleted successfully.
"C:\Program Files\shopperz" => File/Directory not found.
Emptytemp: => Error: This directive works only outside recovery mode.
==== End of Fixlog 22:50:32 ====
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by Admin (administrator) on ADMIN-PC on 03-02-2015 22:54:30
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin (Available profiles: Admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\main.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7203032 2013-10-22] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [RazerCortex] => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe [60640 2014-12-06] (Razer Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKU\S-1-5-21-2266551883-2310591651-913177673-1000\...\MountPoints2: {ca063958-fc33-11e3-8100-806e6f6e6963} - D:\Bin\ASSETUP.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rgamlbrh.default-1422533396366
FF Homepage: hxxp://steinmonster.tumblr.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cljaoocoecflmhcdodmdmkcfjgoaccdk [2015-01-28]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-05-07] ()
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [186048 2014-12-09] ()
R2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [105448 2014-12-06] (Razer Inc.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()
R1 bsdriver; C:\Windows\system32\drivers\bsdriver.sys [35320 2015-01-28] ()
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2015-01-08] (Disc Soft Ltd)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [926824 2012-05-14] (Realtek Semiconductor Corporation )
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2014-12-09] (Razer, Inc.)
R3 Sftfs; C:\Windows\System32\DRIVERS\Sftfswin7.sys [768680 2013-06-26] (Microsoft Corporation)
R3 Sftplay; C:\Windows\System32\DRIVERS\Sftplaywin7.sys [273576 2013-06-26] (Microsoft Corporation)
R3 Sftredir; C:\Windows\System32\DRIVERS\Sftredirwin7.sys [29352 2013-06-26] (Microsoft Corporation)
R3 Sftvol; C:\Windows\System32\DRIVERS\Sftvolwin7.sys [23208 2013-06-26] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-02 21:38 - 2015-02-02 21:38 - 02131456 _____ (Farbar) C:\Users\Admin\Desktop\FRST64(1).exe
2015-02-01 17:05 - 2015-02-01 17:05 - 00003262 _____ () C:\Windows\System32\Tasks\{0DEBC4D0-6032-4947-B911-088530A42635}
2015-02-01 17:00 - 2015-02-01 17:00 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Admin\Desktop\revosetup95.exe
2015-02-01 17:00 - 2015-02-01 17:00 - 00001264 _____ () C:\Users\Admin\Desktop\Revo Uninstaller.lnk
2015-02-01 17:00 - 2015-02-01 17:00 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-02-01 16:59 - 2015-02-01 16:59 - 00002070 _____ () C:\Users\Admin\Desktop\regfix.reg
2015-02-01 12:17 - 2015-02-01 12:17 - 00010058 _____ () C:\Users\Admin\Desktop\SystemLook.txt
2015-02-01 12:02 - 2015-02-01 12:02 - 00165376 _____ () C:\Users\Admin\Desktop\SystemLook_x64.exe
2015-02-01 00:04 - 2006-07-28 07:32 - 00007005 ____N () C:\Users\Admin\Desktop\Eula.txt
2015-01-31 20:21 - 2015-01-31 20:21 - 00001395 _____ () C:\Users\Admin\Desktop\mwab.txt
2015-01-31 14:07 - 2015-02-01 20:17 - 00000000 ____D () C:\Users\Admin\Desktop\FRST-OlderVersion
2015-01-31 14:05 - 2015-01-31 14:05 - 00852573 _____ () C:\Users\Admin\Desktop\SecurityCheck.exe
2015-01-31 14:02 - 2015-01-31 14:02 - 00000857 _____ () C:\Users\Admin\Desktop\gf.txt
2015-01-31 12:40 - 2015-01-31 12:40 - 02347384 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_deu.exe
2015-01-30 18:51 - 2015-01-30 18:51 - 00000625 _____ () C:\Users\Admin\Desktop\JRT.txt
2015-01-30 18:48 - 2015-01-30 18:49 - 01707939 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2015-01-30 18:44 - 2015-01-30 18:45 - 00000000 ____D () C:\AdwCleaner
2015-01-30 18:43 - 2015-01-30 18:43 - 02194432 _____ () C:\Users\Admin\Desktop\AdwCleaner_4.109.exe
2015-01-30 16:51 - 2015-01-30 16:51 - 00001395 _____ () C:\Users\Admin\Desktop\mbam.txt
2015-01-30 16:05 - 2015-01-30 16:05 - 00010938 _____ () C:\Users\Admin\Desktop\Gmer.txt
2015-01-30 15:55 - 2015-01-30 15:55 - 00380416 _____ () C:\Users\Admin\Desktop\Gmer-19357.exe
2015-01-30 15:54 - 2015-02-03 22:54 - 00011837 _____ () C:\Users\Admin\Desktop\FRST.txt
2015-01-30 15:54 - 2015-01-30 15:54 - 00024462 _____ () C:\Users\Admin\Desktop\Addition.txt
2015-01-30 15:53 - 2015-02-03 22:54 - 00000000 ____D () C:\FRST
2015-01-30 15:53 - 2015-02-01 20:17 - 02131456 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2015-01-30 15:51 - 2015-01-30 15:51 - 00050477 _____ () C:\Users\Admin\Desktop\Defogger.exe
2015-01-30 15:51 - 2015-01-30 15:51 - 00000542 _____ () C:\Users\Admin\Desktop\defogger_disable.log
2015-01-30 15:51 - 2015-01-30 15:51 - 00000168 _____ () C:\Users\Admin\defogger_reenable
2015-01-30 14:22 - 2015-01-30 14:22 - 00000000 _____ () C:\autoexec.bat
2015-01-30 01:01 - 2015-01-31 15:23 - 00000132 _____ () C:\Users\Admin\AppData\Roaming\Adobe PNG Format CS5 Prefs
2015-01-30 00:56 - 2015-01-30 00:56 - 00003502 _____ () C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Admin-PC-Admin
2015-01-29 14:21 - 2015-01-31 20:28 - 00000000 ____D () C:\Windows\ERUNT
2015-01-29 13:49 - 2015-02-03 22:52 - 00004827 _____ () C:\Windows\setupact.log
2015-01-29 13:49 - 2015-02-02 12:12 - 00004390 _____ () C:\Windows\PFRO.log
2015-01-29 13:49 - 2015-01-29 13:49 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-29 13:48 - 2015-01-29 13:48 - 00009650 _____ () C:\Windows\system32\.crusader
2015-01-29 13:40 - 2015-01-29 13:48 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-01-28 17:12 - 2015-02-01 20:25 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2015-01-28 16:44 - 2015-01-28 16:44 - 00000044 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG
2015-01-28 15:52 - 2015-01-28 15:52 - 00000000 ____D () C:\Windows\SysWOW64\Flash
2015-01-28 15:48 - 2015-01-28 15:56 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Opera Software
2015-01-28 15:48 - 2015-01-28 15:56 - 00000000 ____D () C:\Users\Admin\AppData\Local\Opera Software
2015-01-28 15:45 - 2015-01-28 15:45 - 00035320 _____ () C:\Windows\system32\Drivers\bsdriver.sys
2015-01-28 15:45 - 2015-01-28 15:45 - 00000000 ____D () C:\Program Files (x86)\download Manager
2015-01-28 15:44 - 2015-01-28 17:10 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro 3.31
2015-01-28 15:44 - 2015-01-28 15:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\Pirates
2015-01-28 15:44 - 2015-01-28 15:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Pirates854
2015-01-28 15:44 - 2015-01-28 15:44 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2015-01-28 15:10 - 2015-01-28 17:09 - 00000000 ____D () C:\Users\Admin\AppData\Local\10793
2015-01-28 14:57 - 2015-01-28 14:57 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2015-01-28 14:56 - 2015-01-28 14:56 - 00001101 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
2015-01-28 14:56 - 2015-01-28 14:56 - 00000969 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5 (64 Bit).lnk
2015-01-28 14:56 - 2015-01-28 14:56 - 00000000 __SHD () C:\Users\Admin\AppData\Local\EmieBrowserModeList
2015-01-28 14:56 - 2015-01-28 14:56 - 00000000 ____D () C:\Program Files\Adobe Photoshop CS5 (64 Bit)
2015-01-28 14:55 - 2015-01-28 14:56 - 00000000 ____D () C:\Program Files (x86)\Adobe Photoshop CS5
2015-01-28 14:54 - 2015-01-28 14:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-01-28 14:54 - 2015-01-28 14:54 - 00001156 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
2015-01-28 14:54 - 2015-01-28 14:54 - 00001063 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
2015-01-28 14:54 - 2015-01-28 14:54 - 00000000 ____D () C:\Program Files (x86)\Adobe Device Central CS5
2015-01-28 14:54 - 2015-01-28 14:54 - 00000000 ____D () C:\Program Files (x86)\Adobe Bridge CS5
2015-01-28 14:51 - 2015-01-29 23:46 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-28 14:51 - 2015-01-28 14:51 - 00001519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
2015-01-28 14:51 - 2015-01-28 14:51 - 00001247 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
2015-01-28 14:51 - 2015-01-28 14:51 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-28 14:51 - 2015-01-28 14:51 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-28 14:51 - 2015-01-28 14:51 - 00000000 ____D () C:\Program Files (x86)\Adobe Extension Manager CS5
2015-01-28 14:44 - 2015-01-30 13:18 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-28 14:44 - 2015-01-30 00:56 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2015-01-28 14:21 - 2015-01-30 00:56 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Adobe
2015-01-28 00:51 - 2015-02-01 20:46 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-27 20:08 - 2015-01-28 17:09 - 00000000 ____D () C:\Users\Admin\AppData\Local\avaxvyvax
2015-01-27 20:08 - 2015-01-27 20:08 - 00003462 _____ () C:\Windows\System32\Tasks\avaxvyvax
2015-01-27 20:07 - 2015-01-30 13:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\uTorrent
2015-01-27 01:00 - 2015-01-27 01:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 15:41 - 2015-01-26 15:50 - 00000000 ____D () C:\Program Files (x86)\EA GAMES
2015-01-26 15:33 - 2015-01-26 15:41 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts
2015-01-26 12:47 - 2015-01-27 12:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-01-25 23:39 - 2015-01-25 23:39 - 00002402 _____ () C:\Users\Public\Desktop\FINAL FANTASY XIV - A Realm Reborn.lnk
2015-01-25 23:20 - 2015-01-25 23:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SQUARE ENIX
2015-01-25 23:20 - 2015-01-25 23:20 - 00000000 ____D () C:\Program Files (x86)\SquareEnix
2015-01-25 19:34 - 2015-01-09 23:27 - 00621200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-01-25 19:32 - 2015-01-13 05:15 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 16009120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-01-25 19:32 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00994712 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00877488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-01-25 19:32 - 2015-01-10 09:07 - 00164568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-01-22 01:08 - 2015-01-24 12:44 - 00794624 _____ () C:\Users\Admin\Documents\FFXIV_ACT_Plugin.dll
2015-01-15 19:56 - 2015-01-15 19:56 - 00000000 ____D () C:\Windows\SysWOW64\DCS
2015-01-14 23:29 - 2015-01-14 23:29 - 00000000 ____D () C:\Users\Admin\Documents\Razer
2015-01-14 23:08 - 2015-01-14 23:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\Razer
2015-01-14 23:00 - 2015-01-14 23:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2015-01-14 23:00 - 2014-12-09 23:21 - 00037184 _____ (Razer, Inc.) C:\Windows\system32\Drivers\rzpmgrk.sys
2015-01-14 22:28 - 2015-02-03 22:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-14 22:28 - 2015-01-25 14:11 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-14 13:40 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 13:40 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 13:40 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 13:40 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 13:40 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 13:40 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 13:40 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 13:40 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 13:40 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 13:40 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 13:40 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 13:40 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 13:40 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-12 02:26 - 2015-01-12 02:26 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\SYSTEMAX Software Development
2015-01-12 02:26 - 2015-01-12 02:26 - 00000000 ____D () C:\ProgramData\SYSTEMAX Software Development
2015-01-12 00:52 - 2015-01-12 00:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\NVIDIA
2015-01-09 14:41 - 2015-01-09 14:41 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-08 23:59 - 2015-01-08 23:59 - 00000000 ____D () C:\Program Files (x86)\Activision
2015-01-08 23:56 - 2015-01-29 13:45 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\DAEMON Tools Lite
2015-01-08 23:56 - 2015-01-08 23:56 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2015-01-08 23:56 - 2015-01-08 23:56 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2015-01-08 23:54 - 2015-01-08 23:57 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2015-01-07 16:56 - 2015-01-07 16:56 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Macromedia
2015-01-07 16:56 - 2015-01-07 16:56 - 00000000 ____D () C:\Users\Admin\AppData\Local\Macromedia
2015-01-07 16:55 - 2015-01-25 14:11 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-07 16:55 - 2015-01-25 14:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-07 16:55 - 2015-01-07 16:55 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2015-01-07 16:55 - 2015-01-07 16:55 - 00000000 ____D () C:\Windows\system32\Macromed
2015-01-07 16:28 - 2015-01-07 16:28 - 00000000 ____D () C:\Prototype
2015-01-05 16:28 - 2015-01-05 16:28 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\WinRAR
2015-01-05 16:28 - 2015-01-05 16:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-05 16:28 - 2015-01-05 16:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-05 16:28 - 2015-01-05 16:28 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-05 16:28 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-05 16:28 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-05 16:28 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-05 16:27 - 2015-01-05 16:27 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-05 16:27 - 2015-01-05 16:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-01-05 16:27 - 2015-01-05 16:27 - 00000000 ____D () C:\Program Files\WinRAR
2015-01-05 16:16 - 2015-01-05 16:16 - 00000000 ____D () C:\Users\Admin\Documents\ICQ
2015-01-05 16:15 - 2015-01-05 16:15 - 00000000 ____D () C:\Users\Admin\Documents\Electronic Arts
2015-01-05 16:13 - 2015-01-05 16:13 - 00000000 ____D () C:\Users\Admin\Documents\EA Games
2015-01-05 16:13 - 2015-01-05 16:13 - 00000000 ____D () C:\Users\Admin\Documents\Camtasia Studio
2015-01-05 16:13 - 2015-01-05 16:13 - 00000000 ____D () C:\Users\Admin\Documents\Adobe Photoshop CS5
2015-01-05 16:13 - 2010-08-26 08:29 - 00000000 ____D () C:\Users\Admin\Documents\AnyDVDHD
2015-01-05 16:12 - 2015-01-05 16:13 - 00000000 ____D () C:\Users\Admin\Documents\[Fuwanovel] Ever 17 -English-
2015-01-05 16:12 - 2015-01-05 16:12 - 00000000 ____D () C:\Users\Admin\Documents\zsnesw151
2015-01-05 16:12 - 2015-01-05 16:12 - 00000000 ____D () C:\Users\Admin\Documents\tradelist
2015-01-05 16:12 - 2015-01-05 16:12 - 00000000 ____D () C:\Users\Admin\Documents\Notenblätter
2015-01-05 16:12 - 2015-01-05 16:12 - 00000000 ____D () C:\Users\Admin\Documents\Leatrix_Latency_Fix_3.00
2015-01-04 01:32 - 2015-01-04 01:32 - 00000000 ____D () C:\Users\Admin\Documents\Telltale Games
2015-01-04 00:21 - 2015-01-14 23:29 - 00000000 ____D () C:\Users\Admin\AppData\Local\Razer_Inc
2015-01-04 00:20 - 2015-01-14 23:00 - 00000000 ____D () C:\ProgramData\Razer
2015-01-04 00:20 - 2015-01-14 23:00 - 00000000 ____D () C:\Program Files (x86)\Razer
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-03 22:52 - 2014-06-25 08:12 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-03 22:52 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-03 22:45 - 2014-06-25 07:47 - 01278592 _____ () C:\Windows\WindowsUpdate.log
2015-02-03 20:55 - 2015-01-02 22:18 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\TS3Client
2015-02-03 18:44 - 2009-07-14 05:45 - 00026240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 18:44 - 2009-07-14 05:45 - 00026240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 11:49 - 2014-06-25 17:40 - 00700906 _____ () C:\Windows\system32\perfh007.dat
2015-02-03 11:49 - 2014-06-25 17:40 - 00150286 _____ () C:\Windows\system32\perfc007.dat
2015-02-03 11:49 - 2009-07-14 06:13 - 01625650 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-01 20:25 - 2009-07-14 06:08 - 00030114 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-01 20:24 - 2014-06-25 08:23 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\SoftGrid Client
2015-02-01 20:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\GroupPolicy
2015-02-01 18:16 - 2014-12-31 16:25 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Advanced Combat Tracker
2015-02-01 17:07 - 2015-01-03 22:05 - 00000000 ___RD () C:\Users\Admin\FanFics
2015-01-30 16:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-30 15:51 - 2014-06-25 07:47 - 00000000 ____D () C:\Users\Admin
2015-01-29 13:45 - 2015-01-03 19:36 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-29 13:44 - 2014-06-25 17:41 - 00000000 ____D () C:\Windows\Panther
2015-01-29 13:33 - 2009-07-14 05:45 - 00000000 ____D () C:\Windows\Setup
2015-01-28 17:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\L2Schemas
2015-01-28 17:12 - 2014-06-25 07:59 - 00058016 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-28 17:12 - 2009-07-14 05:45 - 04823912 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-28 17:09 - 2009-07-14 03:34 - 00000505 _____ () C:\Windows\win.ini
2015-01-28 15:56 - 2014-06-25 07:48 - 00001421 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-28 15:55 - 2014-12-31 22:51 - 00001159 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-28 15:55 - 2014-12-31 22:51 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-28 12:04 - 2014-12-31 22:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-25 23:20 - 2014-06-25 07:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-25 19:34 - 2014-06-25 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-25 19:34 - 2014-06-25 08:04 - 00000000 ____D () C:\Temp
2015-01-22 01:12 - 2015-01-02 23:03 - 00000000 ____D () C:\Program Files (x86)\Advanced Combat Tracker
2015-01-16 07:41 - 2014-12-12 06:54 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-01-16 07:41 - 2014-12-12 06:54 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-01-16 07:41 - 2014-06-25 08:13 - 01514528 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-01-16 07:41 - 2014-06-25 08:13 - 01278920 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-01-14 22:24 - 2014-06-25 11:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 22:23 - 2014-06-25 11:37 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-10 09:07 - 2014-12-31 15:46 - 02902456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-01-10 09:07 - 2014-12-31 15:46 - 00027441 _____ () C:\Windows\system32\nvinfo.pb
2015-01-10 09:07 - 2014-12-12 06:52 - 18566296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-01-10 09:07 - 2014-12-12 06:52 - 14115944 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-01-10 09:07 - 2014-12-12 06:52 - 03298816 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-01-10 09:07 - 2014-06-25 08:11 - 00073872 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-01-10 09:07 - 2014-06-25 08:11 - 00060744 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-01-10 00:30 - 2014-06-25 08:12 - 06860432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-01-10 00:30 - 2014-06-25 08:12 - 03517256 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-01-10 00:29 - 2014-06-25 08:12 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-01-10 00:29 - 2014-06-25 08:12 - 00935056 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-01-10 00:29 - 2014-06-25 08:12 - 00385352 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-01-10 00:29 - 2014-06-25 08:12 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-01-09 20:47 - 2014-06-25 08:12 - 04173527 _____ () C:\Windows\system32\nvcoproc.bin
2015-01-09 14:41 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2015-01-09 00:09 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-05 17:08 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-01-05 16:06 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
==================== Files in the root of some directories =======
2015-01-30 01:01 - 2015-01-31 15:23 - 0000132 _____ () C:\Users\Admin\AppData\Roaming\Adobe PNG Format CS5 Prefs
2015-01-28 16:44 - 2015-01-28 16:44 - 0000044 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG
2014-06-25 07:54 - 2014-06-25 07:54 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-03 21:24
==================== End Of Log ============================
|
|
04.02.2015, 18:56
| #18 |
| /// the machine /// TB-Ausbilder | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Perfekt. Was besteht jetzt noch an Problemen?
__________________
__________________ |
|
04.02.2015, 22:13
| #19 |
| | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.ACode:
ATTFilter Suchlauf Datum: 04.02.2015
Suchlauf-Zeit: 20:04:54
Logdatei: mwabbb.txt
Administrator: Ja
Version: 2.00.4.1028
Malware Datenbank: v2015.01.31.06
Rootkit Datenbank: v2015.01.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Admin
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 332498
Verstrichene Zeit: 6 Min, 40 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(Keine schädliche Elemente erkannt)
Module: 0
(Keine schädliche Elemente erkannt)
Registrierungsschlüssel: 2
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\shopperz, Löschen bei Neustart, [f8fac23b7217b58141e94b37af54b14f],
PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\shopperz, Löschen bei Neustart, [37bb5aa3078256e09298b7cbcf3451af],
Registrierungswerte: 0
(Keine schädliche Elemente erkannt)
Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)
Ordner: 0
(Keine schädliche Elemente erkannt)
Dateien: 0
(Keine schädliche Elemente erkannt)
Physische Sektoren: 0
(Keine schädliche Elemente erkannt)
(end)
|
|
05.02.2015, 08:34
| #20 |
| /// the machine /// TB-Ausbilder | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Reboot, nochmal mit MBAM scannen, das sind nur Registry Einträge. Kommen die Funde wieder?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.02.2015, 12:35
| #21 |
| | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Hallo, hab PC nun neugestartet und es sieht immer noch so aus wie vorher. Log bleibt identisch wie mein Beitrag zuvor, habe diesmal auch mal Screenshots von den Funden gemacht und im Anhang getan (falls erlaubt). Liebe Grüße, |
|
05.02.2015, 14:57
| #22 |
| /// the machine /// TB-Ausbilder | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Mach bitte nochmal nen Systemlook-Suchlauf wie weiter oben schon.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.02.2015, 15:26
| #23 |
| | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.ACode:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 15:25 on 05/02/2015 by Admin
Administrator - Elevation successful
========== regfind ==========
Searching for "shopperz"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2266551883-2310591651-913177673-1000\Software\shopperz]
[HKEY_CURRENT_USER\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_CURRENT_USER\Software\Classes\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\shopperz]
[HKEY_LOCAL_MACHINE\SOFTWARE\shopperz]
"product_name"="shopperz"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\shopperz]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\shopperz]
"product_name"="shopperz"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\shopperz]
[HKEY_USERS\.DEFAULT\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_USERS\S-1-5-19\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_USERS\S-1-5-20\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_USERS\S-1-5-21-2266551883-2310591651-913177673-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2266551883-2310591651-913177673-1000\Software\shopperz]
[HKEY_USERS\S-1-5-21-2266551883-2310591651-913177673-1000\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_USERS\S-1-5-21-2266551883-2310591651-913177673-1000\Software\Classes\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_USERS\S-1-5-21-2266551883-2310591651-913177673-1000_Classes\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\shopperz]
[HKEY_USERS\S-1-5-18\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}]
"Name"="C:\Program Files\shopperz\wrex.exe"
Searching for " "
[HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0]
"SerialNumber"=" Z240M6CA"
[HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 1\Target Id 0\Logical Unit Id 0]
"SerialNumber"=" X4O07M2NS"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{1E6C8FD5-4860-4F58-AA9D-CACFEE412CBA}]
"RatingsInfo"="<Ratings xmlns="urn:schemas-microsoft-com:GameDescription.v1">
<Rating ratingSystemID="{768BD93D-63BE-46A9-8994-0B53C4B5248F}" ratingID="{78D8CC82-372F-44e4-B70C-8944DB7BCC24}">
<Descriptor descriptorID="{ABE23B46-7F9F-495b-B4A9-87F41743727F}"/>
<Descriptor descriptorID="{4BDB9E0D-53CF-4a28-865F-B315818E7627}"/>
<Descriptor descriptorID="{D49A8F0C-B183-4a34-8D86-33F2DC0E2D6C}"/>
</Rating>
<Rating ratingSystemID="{36798944-B235-48ac-BF21-E25671F597EE}" ratingID="{E2681CD6-318A-4935-8275-AF657045C333}">
<Descriptor descriptorID="{6AB00271-515B-4a4d-8A6E-9E66BF96A437}"/>
<Descriptor descriptorID="{F110F831-9412-40c9-860A-B489407ED374}"/>
</Rating>
<Rating ratingSystemID="{5B39D1B8-ED49-4055-8A47-04B29A579AD6}" ratingID="{11F7079A-563B-4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>
-= EOF =-
|
|
05.02.2015, 18:11
| #24 |
| /// the machine /// TB-Ausbilder | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Hast du den Regfix aus diesem Post gemacht? http://www.trojaner-board.de/163385-...ml#post1418600
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.02.2015, 19:48
| #25 |
| | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Ja, hab ich damals gemacht. |
|
06.02.2015, 07:52
| #26 |
| /// the machine /// TB-Ausbilder | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Boote bitte in den safe Mode und lass MBAM nochmal laufen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.02.2015, 15:27
| #27 |
| | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Das gleiche Ergebnis wie auch im Normalen Modus. Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 06.02.2015 Suchlauf-Zeit: 14:26:24 Logdatei: mwab.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.06.04 Rootkit Datenbank: v2015.02.03.01 Lizenz: Testversion Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Admin Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 330067 Verstrichene Zeit: 5 Min, 45 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 2 PUP.Optional.Shopperz.A, HKLM\SOFTWARE\shopperz, Löschen bei Neustart, [70cc0c0fe0aa7db9442c4d3b966d3fc1], PUP.Optional.Shopperz.A, HKLM\SOFTWARE\WOW6432NODE\shopperz, Löschen bei Neustart, [8eae20fb58320e287ff175139b68956b], Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) |
|
06.02.2015, 21:33
| #28 |
| /// the machine /// TB-Ausbilder | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Merkwürdig. Bitte nochmal ein frisches FRST log aus der Recovery.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.02.2015, 11:44
| #29 |
| | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Bitteschön FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015 Ran by SYSTEM on MININT-AA8JTEB on 07-02-2015 11:40:16 Running from H:\ Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Englisch (USA) Internet Explorer Version 11 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log. Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7203032 2013-10-22] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-15] (NVIDIA Corporation) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-05] (Adobe Systems Incorporated) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-25] (Intel Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-14] (Apple Inc.) HKLM-x32\...\Run: [RazerCortex] => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe [60640 2014-12-06] (Razer Inc.) HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-20] (Malwarebytes Corporation) ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-05-06] () S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-15] (NVIDIA Corporation) S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation) S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation) S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-20] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-20] (Malwarebytes Corporation) S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-15] (NVIDIA Corporation) S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-15] (NVIDIA Corporation) S2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [186048 2014-12-09] () S2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [105448 2014-12-06] (Razer Inc.) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] () S1 bsdriver; C:\Windows\system32\drivers\bsdriver.sys [35320 2015-01-28] () S3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2015-01-08] (Disc Soft Ltd) S0 hxofjxmm; C:\Windows\System32\drivers\algl.sys [79064 2015-02-06] (Malwarebytes Corporation) S0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation) S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-20] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-06] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-20] (Malwarebytes Corporation) S3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation) S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-15] (NVIDIA Corporation) S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [926824 2012-05-14] (Realtek Semiconductor Corporation ) S2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2014-12-09] (Razer, Inc.) S3 Sftfs; C:\Windows\System32\DRIVERS\Sftfswin7.sys [768680 2013-06-26] (Microsoft Corporation) S3 Sftplay; C:\Windows\System32\DRIVERS\Sftplaywin7.sys [273576 2013-06-26] (Microsoft Corporation) S3 Sftredir; C:\Windows\System32\DRIVERS\Sftredirwin7.sys [29352 2013-06-26] (Microsoft Corporation) S3 Sftvol; C:\Windows\System32\DRIVERS\Sftvolwin7.sys [23208 2013-06-26] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-06 06:16 - 2015-02-06 06:16 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\algl.sys 2015-02-04 13:09 - 2015-02-05 03:32 - 00002604 _____ () C:\Users\Admin\Desktop\mwabbb.txt 2015-02-02 12:38 - 2015-02-02 12:38 - 02131456 _____ (Farbar) C:\Users\Admin\Desktop\FRST64(1).exe 2015-02-01 08:05 - 2015-02-01 08:05 - 00003262 _____ () C:\Windows\System32\Tasks\{0DEBC4D0-6032-4947-B911-088530A42635} 2015-02-01 08:00 - 2015-02-01 08:00 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Admin\Desktop\revosetup95.exe 2015-02-01 08:00 - 2015-02-01 08:00 - 00001264 _____ () C:\Users\Admin\Desktop\Revo Uninstaller.lnk 2015-02-01 08:00 - 2015-02-01 08:00 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-02-01 07:59 - 2015-02-01 07:59 - 00002070 _____ () C:\Users\Admin\Desktop\regfix.reg 2015-02-01 03:17 - 2015-02-05 06:25 - 00011174 _____ () C:\Users\Admin\Desktop\SystemLook.txt 2015-02-01 03:02 - 2015-02-01 03:02 - 00165376 _____ () C:\Users\Admin\Desktop\SystemLook_x64.exe 2015-01-31 15:04 - 2006-07-27 22:32 - 00007005 ____N () C:\Users\Admin\Desktop\Eula.txt 2015-01-31 11:21 - 2015-02-06 05:35 - 00001397 _____ () C:\Users\Admin\Desktop\mwab.txt 2015-01-31 05:07 - 2015-02-01 11:17 - 00000000 ____D () C:\Users\Admin\Desktop\FRST-OlderVersion 2015-01-31 05:05 - 2015-01-31 05:05 - 00852573 _____ () C:\Users\Admin\Desktop\SecurityCheck.exe 2015-01-31 05:02 - 2015-01-31 05:02 - 00000857 _____ () C:\Users\Admin\Desktop\gf.txt 2015-01-31 03:40 - 2015-01-31 03:40 - 02347384 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_deu.exe 2015-01-30 09:51 - 2015-01-30 09:51 - 00000625 _____ () C:\Users\Admin\Desktop\JRT.txt 2015-01-30 09:48 - 2015-01-30 09:49 - 01707939 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe 2015-01-30 09:44 - 2015-01-30 09:45 - 00000000 ____D () C:\AdwCleaner 2015-01-30 09:43 - 2015-01-30 09:43 - 02194432 _____ () C:\Users\Admin\Desktop\AdwCleaner_4.109.exe 2015-01-30 07:51 - 2015-01-30 07:51 - 00001395 _____ () C:\Users\Admin\Desktop\mbam.txt 2015-01-30 07:05 - 2015-01-30 07:05 - 00010938 _____ () C:\Users\Admin\Desktop\Gmer.txt 2015-01-30 06:55 - 2015-01-30 06:55 - 00380416 _____ () C:\Users\Admin\Desktop\Gmer-19357.exe 2015-01-30 06:54 - 2015-02-03 13:55 - 00036728 _____ () C:\Users\Admin\Desktop\FRST.txt 2015-01-30 06:54 - 2015-01-30 06:54 - 00024462 _____ () C:\Users\Admin\Desktop\Addition.txt 2015-01-30 06:53 - 2015-02-07 11:40 - 00000000 ____D () C:\FRST 2015-01-30 06:53 - 2015-02-01 11:17 - 02131456 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe 2015-01-30 06:51 - 2015-01-30 06:51 - 00050477 _____ () C:\Users\Admin\Desktop\Defogger.exe 2015-01-30 06:51 - 2015-01-30 06:51 - 00000542 _____ () C:\Users\Admin\Desktop\defogger_disable.log 2015-01-30 06:51 - 2015-01-30 06:51 - 00000168 _____ () C:\Users\Admin\defogger_reenable 2015-01-30 05:22 - 2015-01-30 05:22 - 00000000 _____ () C:\autoexec.bat 2015-01-29 16:01 - 2015-02-04 15:55 - 00000132 _____ () C:\Users\Admin\AppData\Roaming\Adobe PNG Format CS5 Prefs 2015-01-29 15:56 - 2015-01-29 15:56 - 00003502 _____ () C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Admin-PC-Admin 2015-01-29 05:21 - 2015-01-31 11:28 - 00000000 ____D () C:\Windows\ERUNT 2015-01-29 04:49 - 2015-02-06 06:09 - 00006227 _____ () C:\Windows\setupact.log 2015-01-29 04:49 - 2015-02-06 05:24 - 00007892 _____ () C:\Windows\PFRO.log 2015-01-29 04:49 - 2015-01-29 04:49 - 00000000 _____ () C:\Windows\setuperr.log 2015-01-29 04:48 - 2015-01-29 04:48 - 00009650 _____ () C:\Windows\System32\.crusader 2015-01-29 04:40 - 2015-01-29 04:48 - 00000000 ____D () C:\ProgramData\HitmanPro 2015-01-28 08:12 - 2015-02-01 11:25 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2015-01-28 07:44 - 2015-01-28 07:44 - 00000044 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG 2015-01-28 06:52 - 2015-01-28 06:52 - 00000000 ____D () C:\Windows\SysWOW64\Flash 2015-01-28 06:48 - 2015-01-28 06:56 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Opera Software 2015-01-28 06:48 - 2015-01-28 06:56 - 00000000 ____D () C:\Users\Admin\AppData\Local\Opera Software 2015-01-28 06:45 - 2015-01-28 06:45 - 00035320 _____ () C:\Windows\System32\Drivers\bsdriver.sys 2015-01-28 06:45 - 2015-01-28 06:45 - 00000000 ____D () C:\Program Files (x86)\download Manager 2015-01-28 06:44 - 2015-01-28 08:10 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro 3.31 2015-01-28 06:44 - 2015-01-28 06:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\Pirates 2015-01-28 06:44 - 2015-01-28 06:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Pirates854 2015-01-28 06:44 - 2015-01-28 06:44 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google 2015-01-28 06:10 - 2015-01-28 08:09 - 00000000 ____D () C:\Users\Admin\AppData\Local\10793 2015-01-28 05:57 - 2015-01-28 05:57 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2015-01-28 05:56 - 2015-01-28 05:56 - 00000000 __SHD () C:\Users\Admin\AppData\Local\EmieBrowserModeList 2015-01-28 05:56 - 2015-01-28 05:56 - 00000000 ____D () C:\Program Files\Adobe Photoshop CS5 (64 Bit) 2015-01-28 05:55 - 2015-01-28 05:56 - 00000000 ____D () C:\Program Files (x86)\Adobe Photoshop CS5 2015-01-28 05:54 - 2015-01-28 05:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-01-28 05:54 - 2015-01-28 05:54 - 00000000 ____D () C:\Program Files (x86)\Adobe Device Central CS5 2015-01-28 05:54 - 2015-01-28 05:54 - 00000000 ____D () C:\Program Files (x86)\Adobe Bridge CS5 2015-01-28 05:51 - 2015-01-29 14:46 - 00000000 ____D () C:\Program Files (x86)\Adobe 2015-01-28 05:51 - 2015-01-28 05:51 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia 2015-01-28 05:51 - 2015-01-28 05:51 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia 2015-01-28 05:51 - 2015-01-28 05:51 - 00000000 ____D () C:\Program Files (x86)\Adobe Extension Manager CS5 2015-01-28 05:44 - 2015-01-30 04:18 - 00000000 ____D () C:\ProgramData\Adobe 2015-01-28 05:44 - 2015-01-29 15:56 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe 2015-01-28 05:21 - 2015-01-29 15:56 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Adobe 2015-01-27 15:51 - 2015-02-06 11:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys 2015-01-27 11:07 - 2015-01-30 04:34 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\uTorrent 2015-01-26 16:00 - 2015-01-26 16:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-26 06:41 - 2015-01-26 06:50 - 00000000 ____D () C:\Program Files (x86)\EA GAMES 2015-01-26 06:33 - 2015-01-26 06:41 - 00000000 ____D () C:\Program Files (x86)\Electronic Arts 2015-01-26 03:47 - 2015-01-27 03:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2015-01-25 14:39 - 2015-01-25 14:39 - 00002402 _____ () C:\Users\Public\Desktop\FINAL FANTASY XIV - A Realm Reborn.lnk 2015-01-25 14:20 - 2015-01-25 14:20 - 00000000 ____D () C:\Program Files (x86)\SquareEnix 2015-01-25 10:34 - 2015-01-09 14:27 - 00621200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2015-01-25 10:32 - 2015-01-12 20:15 - 01540240 _____ (NVIDIA Corporation) C:\Windows\System32\nvhdagenco6420103.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\System32\nvoglv64.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\System32\nvd3dumx.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 16009120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\System32\nvopencl.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys 2015-01-25 10:32 - 2015-01-10 00:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\System32\nvdispco6434725.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\System32\nvdispgenco6434725.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00994712 _____ (NVIDIA Corporation) C:\Windows\System32\nvumdshimx.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\System32\NvIFR64.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\System32\NvFBC64.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00877488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\System32\nvEncodeAPI64.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\System32\NvIFROpenGL.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\System32\nvoglshim64.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00177624 _____ (NVIDIA Corporation) C:\Windows\System32\nvinitx.dll 2015-01-25 10:32 - 2015-01-10 00:07 - 00164568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2015-01-21 16:08 - 2015-01-24 03:44 - 00794624 _____ () C:\Users\Admin\Documents\FFXIV_ACT_Plugin.dll 2015-01-15 10:56 - 2015-02-06 05:18 - 00000000 ____D () C:\Windows\SysWOW64\DCS 2015-01-14 14:29 - 2015-01-14 14:29 - 00000000 ____D () C:\Users\Admin\Documents\Razer 2015-01-14 14:08 - 2015-01-14 14:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\Razer 2015-01-14 14:00 - 2014-12-09 14:21 - 00037184 _____ (Razer, Inc.) C:\Windows\System32\Drivers\rzpmgrk.sys 2015-01-14 13:28 - 2015-02-06 11:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-14 13:28 - 2015-02-06 06:11 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-14 04:40 - 2014-12-18 19:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\System32\profsvc.dll 2015-01-14 04:40 - 2014-12-18 17:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxdav.sys 2015-01-14 04:40 - 2014-12-11 21:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2015-01-14 04:40 - 2014-12-11 21:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\System32\srcore.dll 2015-01-14 04:40 - 2014-12-11 21:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\rstrui.exe 2015-01-14 04:40 - 2014-12-11 21:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\System32\srclient.dll 2015-01-14 04:40 - 2014-12-11 21:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-01-14 04:40 - 2014-12-11 21:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-01-14 04:40 - 2014-12-11 21:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-01-14 04:40 - 2014-12-11 09:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\TSWbPrxy.exe 2015-01-14 04:40 - 2014-12-05 20:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\System32\nlasvc.dll 2015-01-14 04:40 - 2014-12-05 19:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-01-14 04:40 - 2014-12-05 19:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-11 17:26 - 2015-01-11 17:26 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\SYSTEMAX Software Development 2015-01-11 17:26 - 2015-01-11 17:26 - 00000000 ____D () C:\ProgramData\SYSTEMAX Software Development 2015-01-11 15:52 - 2015-01-11 15:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\NVIDIA 2015-01-09 05:41 - 2015-01-09 05:41 - 00000000 ____D () C:\ProgramData\Package Cache 2015-01-08 14:59 - 2015-01-08 14:59 - 00000000 ____D () C:\Program Files (x86)\Activision 2015-01-08 14:56 - 2015-01-29 04:45 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\DAEMON Tools Lite 2015-01-08 14:56 - 2015-01-08 14:56 - 00283064 _____ (Disc Soft Ltd) C:\Windows\System32\Drivers\dtsoftbus01.sys 2015-01-08 14:56 - 2015-01-08 14:56 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite 2015-01-08 14:54 - 2015-01-08 14:57 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-06 11:21 - 2015-01-02 13:18 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\TS3Client 2015-02-06 11:21 - 2014-06-24 22:47 - 01678523 _____ () C:\Windows\WindowsUpdate.log 2015-02-06 10:58 - 2014-12-31 07:25 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Advanced Combat Tracker 2015-02-06 06:16 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\Globalization 2015-02-06 06:11 - 2015-01-07 07:55 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-06 06:11 - 2015-01-07 07:55 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-02-06 06:11 - 2009-07-13 20:45 - 00026240 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-06 06:11 - 2009-07-13 20:45 - 00026240 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-06 05:48 - 2014-06-24 23:12 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-02-06 05:48 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-05 03:21 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\LiveKernelReports 2015-02-04 15:43 - 2010-11-20 23:17 - 00000000 ____D () C:\Windows\ShellNew 2015-02-04 09:56 - 2009-07-13 21:08 - 00032634 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-02-03 13:57 - 2014-06-25 08:40 - 00700906 _____ () C:\Windows\System32\perfh007.dat 2015-02-03 13:57 - 2014-06-25 08:40 - 00150286 _____ () C:\Windows\System32\perfc007.dat 2015-02-03 13:57 - 2009-07-13 21:13 - 01625650 _____ () C:\Windows\System32\PerfStringBackup.INI 2015-02-01 11:24 - 2014-06-24 23:23 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\SoftGrid Client 2015-02-01 11:18 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\GroupPolicy 2015-02-01 08:07 - 2015-01-03 13:05 - 00000000 ___RD () C:\Users\Admin\FanFics 2015-01-30 07:06 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\NDF 2015-01-30 06:51 - 2014-06-24 22:47 - 00000000 ____D () C:\users\Admin 2015-01-29 04:45 - 2015-01-03 10:36 - 00000000 ____D () C:\Program Files (x86)\Steam 2015-01-29 04:44 - 2014-06-25 08:41 - 00000000 ____D () C:\Windows\Panther 2015-01-29 04:33 - 2009-07-13 20:45 - 00000000 ____D () C:\Windows\Setup 2015-01-28 08:56 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\L2Schemas 2015-01-28 08:12 - 2014-06-24 22:59 - 00058016 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT 2015-01-28 08:12 - 2009-07-13 20:45 - 04823912 _____ () C:\Windows\System32\FNTCACHE.DAT 2015-01-28 08:09 - 2009-07-13 18:34 - 00000505 _____ () C:\Windows\win.ini 2015-01-28 06:55 - 2014-12-31 13:51 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-01-28 03:04 - 2014-12-31 13:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-25 14:20 - 2014-06-24 22:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-01-25 10:34 - 2014-06-24 23:04 - 00000000 ____D () C:\Temp 2015-01-21 16:12 - 2015-01-02 14:03 - 00000000 ____D () C:\Program Files (x86)\Advanced Combat Tracker 2015-01-15 22:41 - 2014-12-11 21:54 - 01756424 _____ (NVIDIA Corporation) C:\Windows\System32\nvspbridge64.dll 2015-01-15 22:41 - 2014-12-11 21:54 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll 2015-01-15 22:41 - 2014-06-24 23:13 - 01514528 _____ (NVIDIA Corporation) C:\Windows\System32\nvspcap64.dll 2015-01-15 22:41 - 2014-06-24 23:13 - 01278920 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2015-01-14 14:29 - 2015-01-03 15:21 - 00000000 ____D () C:\Users\Admin\AppData\Local\Razer_Inc 2015-01-14 14:00 - 2015-01-03 15:20 - 00000000 ____D () C:\ProgramData\Razer 2015-01-14 14:00 - 2015-01-03 15:20 - 00000000 ____D () C:\Program Files (x86)\Razer 2015-01-14 13:24 - 2014-06-25 02:37 - 00000000 ____D () C:\Windows\System32\MRT 2015-01-14 13:23 - 2014-06-25 02:37 - 113365784 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2015-01-10 00:07 - 2014-12-31 06:46 - 02902456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2015-01-10 00:07 - 2014-12-31 06:46 - 00027441 _____ () C:\Windows\System32\nvinfo.pb 2015-01-10 00:07 - 2014-12-11 21:52 - 18566296 _____ (NVIDIA Corporation) C:\Windows\System32\nvwgf2umx.dll 2015-01-10 00:07 - 2014-12-11 21:52 - 14115944 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2015-01-10 00:07 - 2014-12-11 21:52 - 03298816 _____ (NVIDIA Corporation) C:\Windows\System32\nvapi64.dll 2015-01-10 00:07 - 2014-06-24 23:11 - 00073872 _____ (Khronos Group) C:\Windows\System32\OpenCL.dll 2015-01-10 00:07 - 2014-06-24 23:11 - 00060744 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2015-01-09 15:30 - 2014-06-24 23:12 - 06860432 _____ (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll 2015-01-09 15:30 - 2014-06-24 23:12 - 03517256 _____ (NVIDIA Corporation) C:\Windows\System32\nvsvc64.dll 2015-01-09 15:29 - 2014-06-24 23:12 - 02558608 _____ (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll 2015-01-09 15:29 - 2014-06-24 23:12 - 00935056 _____ (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe 2015-01-09 15:29 - 2014-06-24 23:12 - 00385352 _____ (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll 2015-01-09 15:29 - 2014-06-24 23:12 - 00062608 _____ (NVIDIA Corporation) C:\Windows\System32\nvshext.dll 2015-01-09 11:47 - 2014-06-24 23:12 - 04173527 _____ () C:\Windows\System32\nvcoproc.bin 2015-01-09 05:41 - 2009-07-13 21:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== Restore Points ========================= Restore point made on: 2015-01-29 05:21:32 Restore point made on: 2015-01-29 05:29:21 Restore point made on: 2015-01-29 14:46:24 Restore point made on: 2015-01-29 14:47:16 Restore point made on: 2015-01-30 04:11:28 Restore point made on: 2015-02-01 10:00:16 Restore point made on: 2015-02-01 11:56:09 Restore point made on: 2015-02-02 03:55:09 Restore point made on: 2015-02-06 05:19:14 ==================== Memory info =========================== Percentage of memory in use: 9% Total physical RAM: 10175.9 MB Available physical RAM: 9166.97 MB Total Pagefile: 10174.1 MB Available Pagefile: 9156.2 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:931.41 GB) (Free:546.91 GB) NTFS Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive e: () (Fixed) (Total:1862.92 GB) (Free:1221.07 GB) NTFS Drive h: () (Removable) (Total:3.73 GB) (Free:1.52 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 66438849) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=1862.9 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 781C3BBC) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (Size: 3.7 GB) (Disk ID: 6E652072) No partition Table on disk 2. LastRegBack: 2015-02-03 12:24 ==================== End Of Log ============================ |
|
07.02.2015, 15:49
| #30 |
| /// the machine /// TB-Ausbilder | Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter reg: reg delete "HKLM\SOFTWARE\shopperz" /f
reg: reg delete "HKLM\SOFTWARE\WOW6432NODE\shopperz" /f
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: MWAB findet immer wieder PUP.Optional.Shopperz.A |
| benachrichtigungsdienst, bsdriver.sys, flash player, homepage, iexplore.exe, installation, msil/adware.pullupdate.k.gen, programm, pup.optional.shopperz.a, registry, security, software, svchost.exe, systemereignisse, teamspeak, win32/adware.convertad.q, win32/installcore.oz |
Linear-Darstellung
