Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 21.02.2015, 12:34   #1
fps
 
Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe - Standard

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe



Hallo,
vorgestern hat Malwarebytes folgenden Fund gemeldet (bei einem Routine-Scan):

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 19.02.2015
Scan Time: 18:26:00
Logfile: t.txt
Administrator: No

Version: 2.00.4.1028
Malware Database: v2015.02.19.07
Rootkit Database: v2015.02.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Anonymous

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 696648
Time Elapsed: 1 hr, 33 min, 2 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.IEPluginServices.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginService, Delete-on-Reboot, [2330f030f09ae0568c35217f996a06fa], 

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Backdoor.Bot.ED, D:\Spiele\Steam\Steam\SteamApps\common\Deus Ex Human Revolution Director's Cut\MakeAppXml.exe, Quarantined, [da79eb35761458de31d8a77e50b202fe], 

Physical Sectors: 0
(No malicious items detected)


(end)
         
Seitdem hatte Ich eigentlich keine weiteren Probleme.
War die Meldung falsch-positiv?
Danke schonmal für eure Hilfe.


Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by Anonymous (ATTENTION: The logged in user is not administrator) on XMG on 21-02-2015 12:48:50
Running from D:\Users\Anonymous\Desktop
Loaded Profiles: Anonymous & postgres (Available profiles: Admin & Anonymous & postgres)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> igfxCUIService.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> spoolsv.exe
Failed to access process -> svchost.exe
Failed to access process -> armsvc.exe
Failed to access process -> AppleMobileDeviceService.exe
Failed to access process -> officeclicktorun.exe
Failed to access process -> EMET_Service.exe
Failed to access process -> dasHost.exe
Failed to access process -> GMouseService.exe
Failed to access process -> GfExperienceService.exe
Failed to access process -> HeciServer.exe
Failed to access process -> mbbService.exe
Failed to access process -> NvNetworkService.exe
Failed to access process -> nvstreamsvc.exe
Failed to access process -> PnkBstrA.exe
Failed to access process -> pg_ctl.exe
Failed to access process -> PowerBiosServer.exe
Failed to access process -> postgres.exe
Failed to access process -> conhost.exe
Failed to access process -> psia.exe
Failed to access process -> svchost.exe
Failed to access process -> TeamViewer_Service.exe
Failed to access process -> postgres.exe
Failed to access process -> nvstreamsvc.exe
Failed to access process -> conhost.exe
Failed to access process -> ViakaraokeSrv.exe
Failed to access process -> MsMpEng.exe
Failed to access process -> postgres.exe
Failed to access process -> postgres.exe
Failed to access process -> postgres.exe
Failed to access process -> postgres.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> NisSrv.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> PresentationFontCache.exe
Failed to access process -> SearchIndexer.exe
Failed to access process -> GoogleCrashHandler.exe
Failed to access process -> GoogleCrashHandler64.exe
Failed to access process -> svchost.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> IntelMeFWService.exe
Failed to access process -> jhi_service.exe
Failed to access process -> LMS.exe
Failed to access process -> NASvc.exe
Failed to access process -> wmpnetwk.exe
Failed to access process -> csrss.exe
Failed to access process -> winlogon.exe
Failed to access process -> dwm.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> SearchProtocolHost.exe
(Microsoft Corporation) C:\Program Files (x86)\EMET 5.1\EMET_Agent.exe
Failed to access process -> nvstreamsvc.exe
Failed to access process -> conhost.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Spotify Ltd) D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Program Files (x86)\Hotkey\Hotkey.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe
(ArcSoft Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 6\TotalMedia Server\TM Server.exe
() C:\Genius\ioCentre\gTaskBar.exe
() C:\Genius\ioCentre\gMouseTask.exe
() C:\Genius\ioCentre\gKbdTask.exe
(ioCentre) C:\Genius\ioCentre\gIoCentreFunMgm.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
Failed to access process -> sua.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Failed to access process -> SearchFilterHost.exe
Failed to access process -> svchost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5672624 2013-03-27] (VIA)
HKLM\...\Run: [MBCfg64] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\MBCfg64.dll,RunDLLEntry MBCfg64
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050224 2013-04-02] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Sound Blaster Cinema] => C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe [711680 2012-11-29] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [ioCentre] => C:\Genius\ioCentre\gTaskBar.exe [60928 2009-09-03] ()
HKLM-x32\...\Run: [Setup Utility 12.0] => C:\Program Files (x86)\Navigator12\Setup Utility\clickertray.exe
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [465320 2014-10-29] (Microsoft Corporation)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [OpenDNS Updater] => C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe [839680 2010-06-16] ()
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify Web Helper] => D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-06] (Spotify Ltd)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify] => D:\Users\Anonymous\AppData\Roaming\Spotify\spotify.exe [6737976 2015-01-06] (Spotify Ltd)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {7f2a5a89-99a3-11e3-82c8-0090f5edbf18} - "E:\AutoRun.exe" 
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {90f2ab75-41ad-11e4-8319-582c80139263} - "E:\LGAutoRun.exe" 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [177624 2015-01-10] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [164568 2015-01-10] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mysn.de/
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mysn.de
URLSearchHook: [S-1-5-21-1788917750-2918846918-3832768059-1010] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default
FF SearchEngineOrder.1: Ask Search
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: DownloadHelper - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-21]
FF Extension: SoundCloud Downloader - Technowise - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2015-02-06]

Chrome: 
=======
CHR Profile: D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-09]
CHR Extension: (Google Drive) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-09]
CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-09]
CHR Extension: (Google Search) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-09]
CHR Extension: (Google Wallet) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-09]
CHR Extension: (Gmail) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-09]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [44064 2013-07-08] (ArcSoft, Inc.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 EMET_Service; C:\Program Files (x86)\EMET 5.1\EMET_Service.exe [31880 2014-11-09] (Microsoft Corporation)
R2 GeniusMouseService; C:\Genius\ioCentre\GMouseService.exe [16384 2010-03-11] () [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-17] ()
R2 postgresql-8.4; C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2014-04-09] (PostgreSQL Global Development Group) [File not signed]
R2 PowerBiosServer; C:\Program Files (x86)\Hotkey\PowerBiosServer.exe [46080 2013-07-09] () [File not signed]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AirplaneModeHid; C:\Windows\system32\DRIVERS\AirplaneModeHid.sys [26888 2013-06-28] (Insyde Corporation)
R1 ArcCtrl; C:\Windows\System32\drivers\ArcCtrl.sys [3315392 2013-08-21] ()
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 gHidPnp; C:\Windows\System32\Drivers\gHidPnp.Sys [25088 2009-11-02] ()
S3 gMouUsb16; C:\Windows\System32\drivers\gMouUsb16.sys [11776 2009-06-25] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R1 RrNetCapFilterDriver; C:\Windows\system32\DRIVERS\RrNetCapFilterDriver.sys [24744 2013-12-18] (Audials AG)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-02] (Synaptics Incorporated)
S1 SSHDRV76; C:\Windows\SysWOW64\drivers\SSHDRV76.sys [53760 2014-01-08] () [File not signed]
R3 VMfilt; C:\Windows\system32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-21 12:48 - 2015-02-21 12:48 - 00021929 _____ () D:\Users\Anonymous\Desktop\FRST.txt
2015-02-21 12:48 - 2015-02-21 12:48 - 00000000 ____D () C:\FRST
2015-02-21 12:46 - 2015-02-21 12:46 - 02086912 _____ (Farbar) D:\Users\Anonymous\Desktop\FRST64.exe
2015-02-21 11:46 - 2015-02-21 11:48 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (3)
2015-02-20 22:09 - 2015-02-20 22:09 - 00001314 _____ () D:\Users\Anonymous\Desktop\t.txt
2015-02-20 21:52 - 2015-02-20 21:52 - 00000023 _____ () D:\Users\postgres\postmaster.pid
2015-02-20 16:18 - 2015-02-20 16:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-20 16:18 - 2015-02-20 16:18 - 00000997 _____ () D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-20 16:18 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-20 16:18 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-20 16:18 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-19 16:38 - 2015-02-19 16:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\Steam
2015-02-19 01:02 - 2015-02-19 01:11 - 02001353 _____ (BOSS Development Team) D:\Users\Anonymous\Downloads\BOSS.Installer.exe.opdownload
2015-02-18 15:23 - 2015-02-18 15:23 - 00000000 ____D () D:\Users\Admin\AppData\Roaming\InstallShield
2015-02-12 09:55 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 09:55 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 14:38 - 2015-02-11 14:38 - 00001341 _____ () D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-02-11 07:42 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 07:42 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 07:42 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-11 07:42 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-11 07:42 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 07:42 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 07:42 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 07:42 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 07:41 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-11 07:41 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 07:41 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 07:41 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 07:41 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 07:41 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 07:41 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 07:41 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-11 07:41 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 07:41 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 07:41 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 07:41 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 07:41 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 07:41 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 07:41 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-11 07:41 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-11 07:41 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-11 07:41 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 07:41 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 07:41 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 07:41 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 07:41 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 07:41 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 07:41 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-11 07:41 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-11 07:41 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-11 07:41 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 07:41 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-11 07:41 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 07:41 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 07:41 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 07:41 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 07:41 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 07:41 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 07:41 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 07:41 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 07:41 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 07:41 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 07:41 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-11 07:41 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-11 07:41 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 07:41 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 07:41 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 07:41 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-04 16:59 - 2015-02-04 16:59 - 1117766084 _____ () D:\Users\Anonymous\Documents\w.pcapng
2015-01-31 14:03 - 2015-01-31 14:03 - 00094335 _____ () D:\Users\Anonymous\Downloads\1 R7OCp3d9b8QPRtvqrqCvGQ.jpeg
2015-01-30 17:20 - 2015-01-30 17:20 - 00210149 _____ () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis.zip
2015-01-30 17:20 - 2015-01-30 17:20 - 00000000 ____D () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis
2015-01-30 10:58 - 2015-01-30 10:58 - 556246770 _____ () C:\Windows\MEMORY.DMP
2015-01-27 10:43 - 2015-01-27 10:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\SysWOW64\NV
2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\system32\NV
2015-01-24 14:47 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 18566296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 16009120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-01-24 14:47 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 02902456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00031376 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2015-01-24 14:40 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-01-24 14:40 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll


==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-21 12:49 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_stat_tmp
2015-02-21 12:47 - 2014-09-07 13:29 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (2)
2015-02-21 12:38 - 2014-01-02 17:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-21 12:10 - 2013-12-13 21:12 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-21 12:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-21 11:52 - 2013-12-10 22:26 - 01423543 _____ () C:\Windows\WindowsUpdate.log
2015-02-21 11:27 - 2013-12-13 21:12 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-21 11:23 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_log
2015-02-20 21:59 - 2013-10-09 08:11 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-20 21:59 - 2013-08-23 00:24 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-02-20 21:59 - 2013-08-23 00:24 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-02-20 21:52 - 2014-02-22 16:14 - 00000080 _____ () D:\Users\postgres\postmaster.opts
2015-02-20 21:52 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\global
2015-02-20 21:52 - 2014-02-22 16:02 - 00000000 ____D () D:\Users\postgres
2015-02-20 21:52 - 2014-01-06 01:55 - 00033999 _____ () C:\Windows\setupact.log
2015-02-20 21:52 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-20 16:22 - 2014-01-05 01:13 - 00057090 _____ () C:\Windows\PFRO.log
2015-02-20 16:18 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-20 16:17 - 2013-12-20 08:47 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner
2015-02-20 16:15 - 2014-09-30 21:31 - 00000000 ____D () C:\AdwCleaner
2015-02-20 16:14 - 2014-12-05 20:36 - 00000110 _____ () C:\AdwCleanerDebug.txt
2015-02-20 14:23 - 2013-12-10 22:23 - 00000000 __SHD () C:\Recovery
2015-02-20 14:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-20 04:00 - 2014-05-09 14:53 - 00155136 ___SH () D:\Users\Anonymous\Desktop\Thumbs.db
2015-02-19 02:44 - 2014-02-05 01:54 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\CrashDumps
2015-02-19 01:54 - 2014-02-19 03:11 - 00000000 ____D () D:\Users\Anonymous\Documents\My Games
2015-02-18 21:22 - 2014-02-17 04:20 - 00005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-18 21:22 - 2014-01-19 09:43 - 00000000 ____D () D:\Users\Anonymous\Documents\Camtasia Studio
2015-02-18 16:49 - 2014-02-18 12:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\dxhr
2015-02-16 02:57 - 2013-12-13 21:58 - 00000000 ____D () D:\Users\Anonymous
2015-02-12 20:18 - 2014-01-12 23:31 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Spotify
2015-02-12 20:18 - 2014-01-12 23:20 - 00000000 ____D () D:\Users\Anonymous\AppData\Roaming\Spotify
2015-02-12 13:44 - 2015-01-21 16:23 - 00000000 ____D () D:\Users\Anonymous\dwhelper
2015-02-12 10:48 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-02-12 10:48 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-11 22:23 - 2013-12-15 17:56 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\PokerStars.FR
2015-02-11 13:58 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2015-02-11 10:12 - 2013-08-22 15:44 - 00484104 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 08:14 - 2013-12-13 23:54 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 08:06 - 2013-12-13 23:54 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-08 17:20 - 2014-02-10 09:52 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\eclipse
2015-02-06 23:11 - 2013-12-13 21:27 - 00002070 _____ () D:\Users\Public\Desktop\Google Chrome.lnk
2015-02-05 09:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-05 01:42 - 2014-02-02 01:10 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Audible
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-31 14:22 - 2014-06-25 16:17 - 00178688 ___SH () D:\Users\Anonymous\Downloads\Thumbs.db
2015-01-30 10:58 - 2014-01-02 15:32 - 00000000 ____D () C:\Windows\Minidump
2015-01-29 10:46 - 2013-12-22 00:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 00:44 - 2014-10-16 09:07 - 00000000 ____D () D:\Users\Anonymous\Downloads\Informatik
2015-01-27 22:53 - 2014-09-12 15:29 - 00000000 ____D () D:\Users\Admin\AppData\Local\Adobe
2015-01-25 12:46 - 2013-12-13 21:47 - 00000000 ____D () D:\Users\Admin
2015-01-24 14:48 - 2014-10-18 15:22 - 00000000 ____D () C:\Temp
2015-01-23 03:55 - 2015-01-03 17:14 - 00000000 ____D () D:\Users\Anonymous\workspace1

==================== Files in the root of some directories =======

2014-03-01 02:25 - 2014-03-01 02:25 - 2987391 _____ () D:\Users\Anonymous\AppData\Local\ASbs.ac
2014-02-17 04:20 - 2015-02-18 21:22 - 0005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-17 16:28 - 2014-04-17 16:28 - 0005037 _____ () C:\ProgramData\flwjycbm.bab

Some content of TEMP:
====================
D:\Users\Admin\AppData\Local\Temp\AskPIP_FF_.exe
D:\Users\Admin\AppData\Local\Temp\Quarantine.exe
D:\Users\Admin\AppData\Local\Temp\sfamcc00001.dll
D:\Users\Admin\AppData\Local\Temp\sfextra.dll
D:\Users\Admin\AppData\Local\Temp\SIInvoker.exe
D:\Users\Admin\AppData\Local\Temp\sqlite3.dll
D:\Users\Admin\AppData\Local\Temp\xmlUpdater.exe
D:\Users\Admin\AppData\Local\Temp\{0D87D2C5-67A7-407E-A3D9-268B0FB322F3}-34.0.1847.137_chrome_installer.exe
D:\Users\Admin\AppData\Local\Temp\{58DD2574-8B53-4D6A-BDE3-F14ACA9DBD5B}-34.0.1847.137_chrome_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
         







Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Anonymous at 2015-02-21 12:49:09
Running from D:\Users\Anonymous\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Airplane Mode Hid Installer (HKLM-x32\...\InstallShield_{5E5B067F-52A4-447E-A3F1-D6DD10565E73}) (Version: 2.0.0.6 - )
Airplane Mode Hid Installer (x32 Version: 2.0.0.6 - ) Hidden
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia Theatre 6 (HKLM-x32\...\InstallShield_{5232358C-7C23-4319-8271-E43F924196AC}) (Version: 6.5.1.150 - ArcSoft)
ArcSoft TotalMedia Theatre 6 (x32 Version: 6.5.1.150 - ArcSoft) Hidden
Assassin's Creed IV Black Flag (HKLM-x32\...\Uplay Install 273) (Version:  - Ubisoft)
Audials (HKLM-x32\...\{15FA1110-CA8E-43E4-BD79-A28A897CD563}) (Version: 11.0.48200.0 - Audials AG)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1694499172.4759644.48.2147344384 - Audible, Inc.)
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version:  - Rocksteady Studios)
BioShock (HKLM-x32\...\Steam App 7670) (Version:  - 2K Boston)
BlackChipPoker (HKLM-x32\...\FE4D6F94-B3D5-484b-94F7-8BC45DEB7A82) (Version: 16.6 - IGSoft)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Camtasia Studio 8 (HKLM-x32\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
CarbonPoker (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\CarbonPoker) (Version: 6.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
CREVbeta (HKLM-x32\...\{6B7961D1-A7A3-4F1A-927B-E1EFACB9AE4F}) (Version: 2.9.4 - CardRunnersEV)
Democracy 3 (HKLM-x32\...\Steam App 245470) (Version:  - Positech Games)
Deus Ex: Human Revolution - Director's Cut (HKLM-x32\...\Steam App 238010) (Version:  - Eidos Montreal)
EMET 5.1 (HKLM-x32\...\{72E7AE20-5B12-4F27-AF5E-DA03E3C09466}) (Version: 5.1 - Microsoft Corporation)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version:  - Bethesda Game Studios)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version:  - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
FormatFactory 3.3.4.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.4.0 - Format Factory)
Full Tilt Poker.Eu (HKLM-x32\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.4.1.WIN.FullTilt.EU - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version:  - )
Hotkey 8.0135 (HKLM-x32\...\InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}) (Version: 8.0135 - NoteBook)
Hotkey 8.0135 (x32 Version: 8.0135 - NoteBook) Hidden
Insyde Airplane Mode HID Mini-Driver (HKLM\...\AirplaneModeHid) (Version: 1.3.0.0 - Insyde Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
ioCentre (HKLM-x32\...\{A2B4621B-CEB9-4E44-95FD-3500D4DB3727}) (Version: 1.02.000 - KYE)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Knights Of Honor (HKLM-x32\...\{7911C404-9AFA-4BB2-B9B7-E47423D87528}) (Version: 1.00 - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nero 2014 (HKLM-x32\...\{0128492C-AB60-43BE-9D9A-8CA622CAF06E}) (Version: 15.0.07700 - Nero AG)
Nero BackItUp 12 Essentials (HKLM-x32\...\{0E3368AC-FB29-4C5E-938E-FA11C12D035E}) (Version: 12.0.01200 - Nero AG)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 12.0.4000 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 15.1.0030 - Nero AG)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenDNS Updater 2.2.1 (HKLM-x32\...\OpenDNS Updater) (Version: 2.2.1 - )
Opera Stable 27.0.1689.69 (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Opera 27.0.1689.69) (Version: 27.0.1689.69 - Opera Software ASA)
Oracle VM VirtualBox 4.3.20 (HKLM\...\{DD8F7A7A-852F-4648-8A73-B8FC1DF5F082}) (Version: 4.3.20 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Port Royale 2 (HKLM-x32\...\Steam App 12470) (Version:  - Ascaron Entertainment ltd.)
PostgreSQL 8.4 (HKLM-x32\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden
Pro Evolution Soccer 2013 (HKLM-x32\...\{C2523AE6-F335-4D0B-BC15-1C07E4ACE629}) (Version: 1.00.0000 - KONAMI)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.27040 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.49 - Piriform)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SMPlayer 0.8.6.0 (HKLM-x32\...\SMPlayer) (Version: 0.8.6.0 - Ricardo Villalba)
Sound Blaster Cinema (HKLM-x32\...\{8801CA65-921A-4CCC-9D63-879D1D0BAA97}) (Version: 1.00.03 - Creative Technology Limited)
Spotify (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.5.1.1 - Synaptics Incorporated)
TDM-GCC (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\TDM-GCC) (Version: 1.1309.0 - TDM)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version:  - The Creative Assembly)
Uplay (HKLM-x32\...\Uplay) (Version: 4.5 - Ubisoft)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
Video DVD Maker v3.30.0.75 (HKLM-x32\...\{1A3E23D7-7A1E-43EC-B35D-EB2A31BED943}) (Version:  - )
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Mobile Device Center Driver Update (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows-Treiberpaket - Insyde (AirplaneModeHid) HIDClass  (07/01/2013 1.3.0.0) (HKLM\...\E38E8D276444640BFCE21B5A73FD63C479B76259) (Version: 07/01/2013 1.3.0.0 - Insyde)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 1.12.3 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.3 - The Wireshark developer community, hxxp://www.wireshark.org)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2014-06-13 17:30 - 00002180 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com 
127.0.0.1 3dns-4.adobe.com 127.0.0.1 
127.0.0.1 activate.adobe.com 
127.0.0.1 adobe-dns.adobe.com 
127.0.0.1 adobe-dns-1.adobe.com 
127.0.0.1 adobe-dns-2.adobe.com 
127.0.0.1 adobe-dns-3.adobe.com 
127.0.0.1 adobe-dns-4.adobe.com 
127.0.0.1 activate-sea.adobe.com 
127.0.0.1 activate-sjc0.adobe.com 
127.0.0.1 activate.wip.adobe.com 
127.0.0.1 activate.wip1.adobe.com 
127.0.0.1 activate.wip2.adobe.com 
127.0.0.1 activate.wip3.adobe.com 
127.0.0.1 activate.wip4.adobe.com 
127.0.0.1 ereg.adobe.com 
127.0.0.1 ereg.wip.adobe.com 
127.0.0.1 ereg.wip1.adobe.com 
127.0.0.1 ereg.wip2.adobe.com 
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 hl2rcv.adobe.com 
127.0.0.1 ood.opsource.net 
127.0.0.1 preactivate.adobe.com 
127.0.0.1 practivate.adobe.com 
127.0.0.1 t3dns.adobe.com 
127.0.0.1 wip.adobe.com 
127.0.0.1 wip1.adobe.com 

There are 9 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

==================== Loaded Modules (whitelisted) ==============

2014-11-09 16:10 - 2014-11-09 16:10 - 00166536 _____ () C:\Program Files (x86)\EMET 5.1\HelperLib.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045192 _____ () C:\Program Files (x86)\EMET 5.1\TrayIconSubsystem.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045704 _____ () C:\Program Files (x86)\EMET 5.1\TelemetrySubsystem.dll
2014-02-08 18:19 - 2014-02-08 18:19 - 00348160 _____ () C:\Program Files (x86)\EMET 5.1\DevExpress.UserSkins.HighContrast.dll
2014-01-25 02:22 - 2014-10-03 16:36 - 00457616 _____ () C:\Windows\system32\igfxTray.exe
2013-12-10 22:30 - 2012-11-14 14:22 - 00078456 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2013-12-10 22:30 - 2012-11-14 14:22 - 00386168 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-12-10 22:33 - 2012-11-01 11:23 - 00089600 _____ () C:\Windows\SYSTEM32\CmdRtr64.DLL
2013-12-10 22:33 - 2012-11-01 11:21 - 00325120 _____ () C:\Windows\SYSTEM32\APOMgr64.DLL
2013-09-27 12:02 - 2013-09-27 12:02 - 04903424 _____ () C:\Program Files (x86)\Hotkey\Hotkey.exe
2013-12-12 13:38 - 2009-09-03 11:30 - 00060928 _____ () C:\Genius\ioCentre\gTaskBar.exe
2013-12-12 13:38 - 2009-09-03 10:45 - 00161280 _____ () C:\Genius\ioCentre\GenXML.dll
2013-12-12 13:38 - 2011-08-05 10:01 - 00961536 _____ () C:\Genius\ioCentre\gMouseTask.exe
2013-12-12 13:38 - 2009-09-03 11:22 - 00063488 _____ () C:\Genius\ioCentre\gfMedia.dll
2013-12-12 13:38 - 2011-06-09 14:26 - 00052224 _____ () C:\Genius\ioCentre\gfBrowser.dll
2013-12-12 13:38 - 2009-09-03 11:23 - 00020992 _____ () C:\Genius\ioCentre\gfOffice.dll
2013-12-12 13:38 - 2009-09-03 11:24 - 00027648 _____ () C:\Genius\ioCentre\gfSystem.dll
2013-12-12 13:38 - 2009-09-03 11:18 - 00040960 _____ () C:\Genius\ioCentre\gfEmail.dll
2013-12-12 13:38 - 2011-08-04 16:45 - 00266752 _____ () C:\Genius\ioCentre\gDevMgm.dll
2013-12-12 13:38 - 2011-08-04 16:48 - 00758784 _____ () C:\Genius\ioCentre\gKbdTask.exe
2013-12-12 13:38 - 2009-09-03 10:55 - 00069120 _____ () C:\Genius\ioCentre\gAutoScroll.dll
2013-12-12 13:38 - 2009-09-03 10:54 - 00249344 _____ () C:\Genius\ioCentre\gAutoPan.dll
2013-12-12 13:38 - 2009-09-03 11:06 - 00259072 _____ () C:\Genius\ioCentre\gZoom.dll
2013-12-12 13:38 - 2009-09-03 11:25 - 00025088 _____ () C:\Genius\ioCentre\gIoCentreHook.dll
2013-12-12 13:38 - 2009-09-03 11:05 - 00048640 _____ () C:\Genius\ioCentre\gTaskSwitch.dll
2013-12-12 13:38 - 2010-04-07 18:05 - 00258560 _____ () C:\Genius\ioCentre\gDeskMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00246784 _____ () C:\Genius\ioCentre\gKbStatus.dll
2013-12-12 13:38 - 2009-09-03 10:59 - 00053760 _____ () C:\Genius\ioCentre\gIMMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00143360 _____ () C:\Genius\ioCentre\gPreset.dll
2013-12-12 13:38 - 2009-09-03 10:58 - 00044544 _____ () C:\Genius\ioCentre\gIMHook.dll
2013-12-12 13:38 - 2009-09-03 11:04 - 00056832 _____ () C:\Genius\ioCentre\gTabSwitch.dll
2013-12-10 22:29 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: D:\Users\Anonymous\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Control Panel\Desktop\\Wallpaper -> D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: ADExchange => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
HKLM\...\StartupApproved\StartupFolder: => "Secunia PSI Tray.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\StartupApproved\Run: => "AudialsNotifier"
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\StartupApproved\Run: => "Spotify"

==================== Accounts: =============================

Admin (S-1-5-21-1788917750-2918846918-3832768059-1007 - Administrator - Enabled) => D:\Users\Admin
Administrator (S-1-5-21-1788917750-2918846918-3832768059-500 - Administrator - Disabled)
Anonymous (S-1-5-21-1788917750-2918846918-3832768059-1008 - Limited - Enabled) => D:\Users\Anonymous
Gast (S-1-5-21-1788917750-2918846918-3832768059-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1788917750-2918846918-3832768059-1012 - Limited - Enabled)
postgres (S-1-5-21-1788917750-2918846918-3832768059-1010 - Limited - Enabled) => D:\Users\postgres

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools (T:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable).

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable).

Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.


System errors:
=============
Error: (02/20/2015 11:09:42 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}

Error: (02/20/2015 09:52:05 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Windows\SysWow64\drivers\SSHDRV76.sys

Error: (02/20/2015 09:52:04 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x12

Error: (02/20/2015 09:51:52 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084WSearchNicht verfügbar{9E175B68-F52A-11D8-B9A5-505054503030}

Error: (02/20/2015 09:51:52 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (02/20/2015 09:51:21 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1068netprofmNicht verfügbar{A47979D2-C419-11D9-A5B4-001185AD2B89}

Error: (02/20/2015 09:51:21 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (02/20/2015 09:51:21 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (02/20/2015 09:51:21 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (02/20/2015 06:27:19 PM) (Source: DCOM) (EventID: 10005) (User: XMG)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}


Microsoft Office Sessions:
=========================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE tools (T:)Falscher Parameter. (0x80070057)

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable)

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable)

Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.


CodeIntegrity Errors:
===================================
  Date: 2015-02-20 17:44:23.753
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-15 13:39:06.049
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.897
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.635
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.479
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.204
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.045
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:04.745
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:04.590
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:04.319
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Percentage of memory in use: 40%
Total physical RAM: 8111.55 MB
Available physical RAM: 4794.08 MB
Total Pagefile: 16303.55 MB
Available Pagefile: 11464.72 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:435.72 GB) (Free:348.12 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.39 GB) (Free:412.05 GB) NTFS
Drive r: (Recovery Image) (Fixed) (Total:10.74 GB) (Free:10.66 GB) NTFS
Drive t: (Windows RE tools) (Fixed) (Total:0.29 GB) (Free:0.27 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================
         

Alt 21.02.2015, 13:32   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe - Standard

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe



hi,

Zitat:
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com 127.0.0.1
127.0.0.1 activate.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-1.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 adobe-dns-4.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 activate.wip.adobe.com
127.0.0.1 activate.wip1.adobe.com
127.0.0.1 activate.wip2.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 activate.wip4.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 ereg.wip.adobe.com
127.0.0.1 ereg.wip1.adobe.com
127.0.0.1 ereg.wip2.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 hl2rcv.adobe.com
127.0.0.1 ood.opsource.net
127.0.0.1 preactivate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 t3dns.adobe.com
127.0.0.1 wip.adobe.com
127.0.0.1 wip1.adobe.com
Was is nur los? Warum muss jeder zweite denken er brauch unbedingt nen Tool für Lau was 3000 Euro kostet...

Gecrackte Software deinstallieren, vorher gibt es keinen Support.
__________________

__________________

Alt 21.02.2015, 14:49   #3
fps
 
Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe - Standard

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe



Danke für den Hinweis.

[CODE
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by Anonymous (ATTENTION: The logged in user is not administrator) on XMG on 21-02-2015 15:19:18
Running from D:\Users\Anonymous\Desktop
Loaded Profiles: Admin & Anonymous & postgres (Available profiles: Admin & Anonymous & postgres)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> igfxCUIService.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> spoolsv.exe
Failed to access process -> svchost.exe
Failed to access process -> armsvc.exe
Failed to access process -> AppleMobileDeviceService.exe
Failed to access process -> officeclicktorun.exe
Failed to access process -> EMET_Service.exe
Failed to access process -> dasHost.exe
Failed to access process -> GMouseService.exe
Failed to access process -> GfExperienceService.exe
Failed to access process -> HeciServer.exe
Failed to access process -> mbbService.exe
Failed to access process -> NvNetworkService.exe
Failed to access process -> nvstreamsvc.exe
Failed to access process -> PnkBstrA.exe
Failed to access process -> pg_ctl.exe
Failed to access process -> PowerBiosServer.exe
Failed to access process -> postgres.exe
Failed to access process -> conhost.exe
Failed to access process -> psia.exe
Failed to access process -> svchost.exe
Failed to access process -> TeamViewer_Service.exe
Failed to access process -> postgres.exe
Failed to access process -> nvstreamsvc.exe
Failed to access process -> conhost.exe
Failed to access process -> ViakaraokeSrv.exe
Failed to access process -> MsMpEng.exe
Failed to access process -> postgres.exe
Failed to access process -> postgres.exe
Failed to access process -> postgres.exe
Failed to access process -> postgres.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> NisSrv.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> PresentationFontCache.exe
Failed to access process -> SearchIndexer.exe
Failed to access process -> GoogleCrashHandler.exe
Failed to access process -> GoogleCrashHandler64.exe
Failed to access process -> svchost.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> IntelMeFWService.exe
Failed to access process -> jhi_service.exe
Failed to access process -> LMS.exe
Failed to access process -> NASvc.exe
Failed to access process -> wmpnetwk.exe
Failed to access process -> csrss.exe
Failed to access process -> winlogon.exe
Failed to access process -> dwm.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> SearchProtocolHost.exe
(Microsoft Corporation) C:\Program Files (x86)\EMET 5.1\EMET_Agent.exe
Failed to access process -> nvstreamsvc.exe
Failed to access process -> conhost.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Spotify Ltd) D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Program Files (x86)\Hotkey\Hotkey.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe
() C:\Genius\ioCentre\gTaskBar.exe
() C:\Genius\ioCentre\gMouseTask.exe
() C:\Genius\ioCentre\gKbdTask.exe
(ioCentre) C:\Genius\ioCentre\gIoCentreFunMgm.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
Failed to access process -> sua.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5672624 2013-03-27] (VIA)
HKLM\...\Run: [MBCfg64] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\MBCfg64.dll,RunDLLEntry MBCfg64
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3050224 2013-04-02] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [Sound Blaster Cinema] => C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe [711680 2012-11-29] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [ioCentre] => C:\Genius\ioCentre\gTaskBar.exe [60928 2009-09-03] ()
HKLM-x32\...\Run: [Setup Utility 12.0] => C:\Program Files (x86)\Navigator12\Setup Utility\clickertray.exe
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [465320 2014-10-29] (Microsoft Corporation)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [479744 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [OpenDNS Updater] => C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe [839680 2010-06-16] ()
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify Web Helper] => D:\Users\Anonymous\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-06] (Spotify Ltd)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Run: [Spotify] => D:\Users\Anonymous\AppData\Roaming\Spotify\spotify.exe [6737976 2015-01-06] (Spotify Ltd)
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {7f2a5a89-99a3-11e3-82c8-0090f5edbf18} - "E:\AutoRun.exe" 
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\MountPoints2: {90f2ab75-41ad-11e4-8319-582c80139263} - "E:\LGAutoRun.exe" 
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [177624 2015-01-10] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [164568 2015-01-10] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mysn.de/
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mysn.de
URLSearchHook: [S-1-5-21-1788917750-2918846918-3832768059-1007] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: [S-1-5-21-1788917750-2918846918-3832768059-1010] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSBTDF&pc=MASB&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1788917750-2918846918-3832768059-1008 -> {46ED32A9-5BC5-4A78-A09A-E1E320D88FBE} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default
FF SearchEngineOrder.1: Ask Search
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: DownloadHelper - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-21]
FF Extension: SoundCloud Downloader - Technowise - D:\Users\Anonymous\AppData\Roaming\Mozilla\Firefox\Profiles\i7snv1kq.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2015-02-06]

Chrome: 
=======
CHR Profile: D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-09]
CHR Extension: (Google Drive) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-09]
CHR Extension: (Google Voice Search Hotword (Beta)) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-06]
CHR Extension: (YouTube) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-09]
CHR Extension: (Google Search) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-09]
CHR Extension: (Google Wallet) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-09]
CHR Extension: (Gmail) - D:\Users\Anonymous\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-09]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 EMET_Service; C:\Program Files (x86)\EMET 5.1\EMET_Service.exe [31880 2014-11-09] (Microsoft Corporation)
R2 GeniusMouseService; C:\Genius\ioCentre\GMouseService.exe [16384 2010-03-11] () [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-17] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [38792 2014-10-29] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-17] ()
R2 postgresql-8.4; C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2014-04-09] (PostgreSQL Global Development Group) [File not signed]
R2 PowerBiosServer; C:\Program Files (x86)\Hotkey\PowerBiosServer.exe [46080 2013-07-09] () [File not signed]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AirplaneModeHid; C:\Windows\system32\DRIVERS\AirplaneModeHid.sys [26888 2013-06-28] (Insyde Corporation)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 gHidPnp; C:\Windows\System32\Drivers\gHidPnp.Sys [25088 2009-11-02] ()
S3 gMouUsb16; C:\Windows\System32\drivers\gMouUsb16.sys [11776 2009-06-25] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-17] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-04-02] (Synaptics Incorporated)
S1 SSHDRV76; C:\Windows\SysWOW64\drivers\SSHDRV76.sys [53760 2014-01-08] () [File not signed]
R3 VMfilt; C:\Windows\system32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation)
R1 ArcCtrl; system32\drivers\ArcCtrl.sys [X]
U3 pgldipow; \??\D:\Users\Admin\AppData\Local\Temp\pgldipow.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-21 15:19 - 2015-02-21 15:19 - 00021877 _____ () D:\Users\Anonymous\Desktop\FRST.txt
2015-02-21 13:12 - 2015-02-21 13:13 - 00064633 _____ () D:\Users\Admin\Desktop\gmer.txt
2015-02-21 13:10 - 2015-02-21 13:10 - 00064633 _____ () D:\Users\Admin\Desktop\save.log
2015-02-21 12:48 - 2015-02-21 15:19 - 00000000 ____D () C:\FRST
2015-02-21 12:46 - 2015-02-21 12:46 - 02086912 _____ (Farbar) D:\Users\Anonymous\Desktop\FRST64.exe
2015-02-21 11:46 - 2015-02-21 11:48 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (3)
2015-02-20 22:09 - 2015-02-20 22:09 - 00001314 _____ () D:\Users\Anonymous\Desktop\t.txt
2015-02-20 21:52 - 2015-02-20 21:52 - 00000023 _____ () D:\Users\postgres\postmaster.pid
2015-02-20 16:18 - 2015-02-20 16:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-20 16:18 - 2015-02-20 16:18 - 00000997 _____ () D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-20 16:18 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-20 16:18 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-20 16:18 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-19 16:38 - 2015-02-19 16:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\Steam
2015-02-19 01:02 - 2015-02-19 01:11 - 02001353 _____ (BOSS Development Team) D:\Users\Anonymous\Downloads\BOSS.Installer.exe.opdownload
2015-02-18 15:23 - 2015-02-18 15:23 - 00000000 ____D () D:\Users\Admin\AppData\Roaming\InstallShield
2015-02-12 09:55 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 09:55 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 14:38 - 2015-02-11 14:38 - 00001341 _____ () D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-02-11 07:42 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 07:42 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 07:42 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-11 07:42 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-11 07:42 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 07:42 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 07:42 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 07:42 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 07:41 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-11 07:41 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 07:41 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 07:41 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 07:41 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 07:41 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 07:41 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 07:41 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-11 07:41 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 07:41 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 07:41 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 07:41 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 07:41 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 07:41 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 07:41 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-11 07:41 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-11 07:41 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-11 07:41 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 07:41 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 07:41 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 07:41 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 07:41 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 07:41 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 07:41 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-11 07:41 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-11 07:41 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-11 07:41 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 07:41 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-11 07:41 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 07:41 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 07:41 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 07:41 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 07:41 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 07:41 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 07:41 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 07:41 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 07:41 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 07:41 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 07:41 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-11 07:41 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-11 07:41 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 07:41 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 07:41 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 07:41 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-04 16:59 - 2015-02-04 16:59 - 1117766084 _____ () D:\Users\Anonymous\Documents\w.pcapng
2015-01-31 14:03 - 2015-01-31 14:03 - 00094335 _____ () D:\Users\Anonymous\Downloads\1 R7OCp3d9b8QPRtvqrqCvGQ.jpeg
2015-01-30 17:20 - 2015-01-30 17:20 - 00210149 _____ () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis.zip
2015-01-30 17:20 - 2015-01-30 17:20 - 00000000 ____D () D:\Users\Anonymous\Downloads\ERP-Gr.10-Ergebnis
2015-01-30 10:58 - 2015-01-30 10:58 - 556246770 _____ () C:\Windows\MEMORY.DMP
2015-01-27 10:43 - 2015-01-27 10:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\SysWOW64\NV
2015-01-24 14:48 - 2015-01-24 14:48 - 00000000 ____D () C:\Windows\system32\NV
2015-01-24 14:47 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 18566296 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 16009120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-01-24 14:47 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 02902456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-01-24 14:47 - 2015-01-10 09:07 - 00031376 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2015-01-24 14:40 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-01-24 14:40 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-21 15:19 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_stat_tmp
2015-02-21 15:10 - 2013-12-13 21:12 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-21 15:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-02-21 14:57 - 2014-05-09 14:53 - 00155136 ___SH () D:\Users\Anonymous\Desktop\Thumbs.db
2015-02-21 14:57 - 2013-12-10 22:30 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-21 14:38 - 2014-01-02 17:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-21 14:36 - 2014-09-12 15:29 - 00000000 ____D () D:\Users\Admin\AppData\Local\Adobe
2015-02-21 14:30 - 2013-12-10 22:26 - 01429806 _____ () C:\Windows\WindowsUpdate.log
2015-02-21 14:11 - 2013-12-13 21:27 - 00002070 _____ () D:\Users\Public\Desktop\Google Chrome.lnk
2015-02-21 12:47 - 2014-09-07 13:29 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner (2)
2015-02-21 11:27 - 2013-12-13 21:12 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-21 11:23 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\pg_log
2015-02-20 21:59 - 2013-10-09 08:11 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-20 21:59 - 2013-08-23 00:24 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-02-20 21:59 - 2013-08-23 00:24 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-02-20 21:52 - 2014-02-22 16:14 - 00000080 _____ () D:\Users\postgres\postmaster.opts
2015-02-20 21:52 - 2014-02-22 16:14 - 00000000 ____D () D:\Users\postgres\global
2015-02-20 21:52 - 2014-02-22 16:02 - 00000000 ____D () D:\Users\postgres
2015-02-20 21:52 - 2014-01-06 01:55 - 00033999 _____ () C:\Windows\setupact.log
2015-02-20 21:52 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-20 16:22 - 2014-01-05 01:13 - 00057090 _____ () C:\Windows\PFRO.log
2015-02-20 16:18 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-20 16:17 - 2013-12-20 08:47 - 00000000 ____D () D:\Users\Anonymous\Desktop\Neuer Ordner
2015-02-20 16:15 - 2014-09-30 21:31 - 00000000 ____D () C:\AdwCleaner
2015-02-20 16:14 - 2014-12-05 20:36 - 00000110 _____ () C:\AdwCleanerDebug.txt
2015-02-20 14:23 - 2013-12-10 22:23 - 00000000 __SHD () C:\Recovery
2015-02-20 14:22 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-02-19 02:44 - 2014-02-05 01:54 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\CrashDumps
2015-02-19 01:54 - 2014-02-19 03:11 - 00000000 ____D () D:\Users\Anonymous\Documents\My Games
2015-02-18 21:22 - 2014-02-17 04:20 - 00005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-18 21:22 - 2014-01-19 09:43 - 00000000 ____D () D:\Users\Anonymous\Documents\Camtasia Studio
2015-02-18 16:49 - 2014-02-18 12:38 - 00000000 ____D () D:\Users\Admin\AppData\Local\dxhr
2015-02-16 02:57 - 2013-12-13 21:58 - 00000000 ____D () D:\Users\Anonymous
2015-02-12 20:18 - 2014-01-12 23:31 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Spotify
2015-02-12 20:18 - 2014-01-12 23:20 - 00000000 ____D () D:\Users\Anonymous\AppData\Roaming\Spotify
2015-02-12 13:44 - 2015-01-21 16:23 - 00000000 ____D () D:\Users\Anonymous\dwhelper
2015-02-12 10:48 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2015-02-12 10:48 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-11 22:23 - 2013-12-15 17:56 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\PokerStars.FR
2015-02-11 13:58 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2015-02-11 10:12 - 2013-08-22 15:44 - 00484104 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 08:14 - 2013-12-13 23:54 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 08:06 - 2013-12-13 23:54 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-08 17:20 - 2014-02-10 09:52 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\eclipse
2015-02-05 09:21 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-05 01:42 - 2014-02-02 01:10 - 00000000 ____D () D:\Users\Anonymous\AppData\Local\Audible
2015-02-03 20:31 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-31 14:22 - 2014-06-25 16:17 - 00178688 ___SH () D:\Users\Anonymous\Downloads\Thumbs.db
2015-01-30 10:58 - 2014-01-02 15:32 - 00000000 ____D () C:\Windows\Minidump
2015-01-29 10:46 - 2013-12-22 00:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 00:44 - 2014-10-16 09:07 - 00000000 ____D () D:\Users\Anonymous\Downloads\Informatik
2015-01-25 12:46 - 2013-12-13 21:47 - 00000000 ____D () D:\Users\Admin
2015-01-24 14:48 - 2014-10-18 15:22 - 00000000 ____D () C:\Temp
2015-01-23 03:55 - 2015-01-03 17:14 - 00000000 ____D () D:\Users\Anonymous\workspace1

==================== Files in the root of some directories =======

2014-03-01 02:25 - 2014-03-01 02:25 - 2987391 _____ () D:\Users\Anonymous\AppData\Local\ASbs.ac
2014-02-17 04:20 - 2015-02-18 21:22 - 0005120 _____ () D:\Users\Anonymous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-17 16:28 - 2014-04-17 16:28 - 0005037 _____ () C:\ProgramData\flwjycbm.bab

Some content of TEMP:
====================
D:\Users\Admin\AppData\Local\Temp\AskPIP_FF_.exe
D:\Users\Admin\AppData\Local\Temp\Quarantine.exe
D:\Users\Admin\AppData\Local\Temp\sfamcc00001.dll
D:\Users\Admin\AppData\Local\Temp\sfextra.dll
D:\Users\Admin\AppData\Local\Temp\SIInvoker.exe
D:\Users\Admin\AppData\Local\Temp\sqlite3.dll
D:\Users\Admin\AppData\Local\Temp\xmlUpdater.exe
D:\Users\Admin\AppData\Local\Temp\{0D87D2C5-67A7-407E-A3D9-268B0FB322F3}-34.0.1847.137_chrome_installer.exe
D:\Users\Admin\AppData\Local\Temp\{58DD2574-8B53-4D6A-BDE3-F14ACA9DBD5B}-34.0.1847.137_chrome_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================
         
--- --- ---
CODE]


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Anonymous at 2015-02-21 15:19:34
Running from D:\Users\Anonymous\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.356 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Airplane Mode Hid Installer (HKLM-x32\...\InstallShield_{5E5B067F-52A4-447E-A3F1-D6DD10565E73}) (Version: 2.0.0.6 - )
Airplane Mode Hid Installer (x32 Version: 2.0.0.6 - ) Hidden
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Assassin's Creed IV Black Flag (HKLM-x32\...\Uplay Install 273) (Version:  - Ubisoft)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1694499172.4759644.48.2147344384 - Audible, Inc.)
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version:  - Rocksteady Studios)
BioShock (HKLM-x32\...\Steam App 7670) (Version:  - 2K Boston)
BlackChipPoker (HKLM-x32\...\FE4D6F94-B3D5-484b-94F7-8BC45DEB7A82) (Version: 16.6 - IGSoft)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Camtasia Studio 8 (HKLM-x32\...\{F5C9BE9A-04C3-4A72-8CD0-BB67C722D608}) (Version: 8.1.2.1344 - TechSmith Corporation)
CarbonPoker (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\CarbonPoker) (Version: 6.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version:  - Relic Entertainment)
CREVbeta (HKLM-x32\...\{6B7961D1-A7A3-4F1A-927B-E1EFACB9AE4F}) (Version: 2.9.4 - CardRunnersEV)
Democracy 3 (HKLM-x32\...\Steam App 245470) (Version:  - Positech Games)
Deus Ex: Human Revolution - Director's Cut (HKLM-x32\...\Steam App 238010) (Version:  - Eidos Montreal)
EMET 5.1 (HKLM-x32\...\{72E7AE20-5B12-4F27-AF5E-DA03E3C09466}) (Version: 5.1 - Microsoft Corporation)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version:  - Bethesda Game Studios)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version:  - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
FormatFactory 3.3.4.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.4.0 - Format Factory)
Full Tilt Poker.Eu (HKLM-x32\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.4.1.WIN.FullTilt.EU - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version:  - )
Hotkey 8.0135 (HKLM-x32\...\InstallShield_{164714B6-46BC-4649-9A30-A6ED32F03B5A}) (Version: 8.0135 - NoteBook)
Hotkey 8.0135 (x32 Version: 8.0135 - NoteBook) Hidden
Insyde Airplane Mode HID Mini-Driver (HKLM\...\AirplaneModeHid) (Version: 1.3.0.0 - Insyde Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
ioCentre (HKLM-x32\...\{A2B4621B-CEB9-4E44-95FD-3500D4DB3727}) (Version: 1.02.000 - KYE)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Knights Of Honor (HKLM-x32\...\{7911C404-9AFA-4BB2-B9B7-E47423D87528}) (Version: 1.00 - )
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nero 2014 (HKLM-x32\...\{0128492C-AB60-43BE-9D9A-8CA622CAF06E}) (Version: 15.0.07700 - Nero AG)
Nero BackItUp 12 Essentials (HKLM-x32\...\{0E3368AC-FB29-4C5E-938E-FA11C12D035E}) (Version: 12.0.01200 - Nero AG)
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 12.0.4000 - Nero AG)
Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 15.1.0030 - Nero AG)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenDNS Updater 2.2.1 (HKLM-x32\...\OpenDNS Updater) (Version: 2.2.1 - )
Opera Stable 27.0.1689.69 (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Opera 27.0.1689.69) (Version: 27.0.1689.69 - Opera Software ASA)
Oracle VM VirtualBox 4.3.20 (HKLM\...\{DD8F7A7A-852F-4648-8A73-B8FC1DF5F082}) (Version: 4.3.20 - Oracle Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
Port Royale 2 (HKLM-x32\...\Steam App 12470) (Version:  - Ascaron Entertainment ltd.)
PostgreSQL 8.4 (HKLM-x32\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden
Pro Evolution Soccer 2013 (HKLM-x32\...\{C2523AE6-F335-4D0B-BC15-1C07E4ACE629}) (Version: 1.00.0000 - KONAMI)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.27040 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.49 - Piriform)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SMPlayer 0.8.6.0 (HKLM-x32\...\SMPlayer) (Version: 0.8.6.0 - Ricardo Villalba)
Sound Blaster Cinema (HKLM-x32\...\{8801CA65-921A-4CCC-9D63-879D1D0BAA97}) (Version: 1.00.03 - Creative Technology Limited)
Spotify (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Stronghold Crusader Extreme (HKLM-x32\...\{8C3727F2-8E37-49E4-820C-03B1677F53B6}) (Version: 1.20.0000 - Firefly Studios)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.5.1.1 - Synaptics Incorporated)
TDM-GCC (HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\TDM-GCC) (Version: 1.1309.0 - TDM)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.26297 - TeamViewer)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version:  - The Creative Assembly)
Uplay (HKLM-x32\...\Uplay) (Version: 4.5 - Ubisoft)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
Video DVD Maker v3.30.0.75 (HKLM-x32\...\{1A3E23D7-7A1E-43EC-B35D-EB2A31BED943}) (Version:  - )
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Mobile Device Center Driver Update (HKLM\...\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows-Treiberpaket - Insyde (AirplaneModeHid) HIDClass  (07/01/2013 1.3.0.0) (HKLM\...\E38E8D276444640BFCE21B5A73FD63C479B76259) (Version: 07/01/2013 1.3.0.0 - Insyde)
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
Wireshark 1.12.3 (64-bit) (HKLM-x32\...\Wireshark) (Version: 1.12.3 - The Wireshark developer community, hxxp://www.wireshark.org)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

ATTENTION: System Restore is disabled.
Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2015-02-21 14:49 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

==================== Loaded Modules (whitelisted) ==============

2014-11-09 16:10 - 2014-11-09 16:10 - 00166536 _____ () C:\Program Files (x86)\EMET 5.1\HelperLib.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045192 _____ () C:\Program Files (x86)\EMET 5.1\TrayIconSubsystem.dll
2014-11-09 16:10 - 2014-11-09 16:10 - 00045704 _____ () C:\Program Files (x86)\EMET 5.1\TelemetrySubsystem.dll
2014-02-08 18:19 - 2014-02-08 18:19 - 00348160 _____ () C:\Program Files (x86)\EMET 5.1\DevExpress.UserSkins.HighContrast.dll
2014-01-25 02:22 - 2014-10-03 16:36 - 00457616 _____ () C:\Windows\system32\igfxTray.exe
2013-12-10 22:30 - 2012-11-14 14:22 - 00078456 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2013-12-10 22:30 - 2012-11-14 14:22 - 00386168 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-12-10 22:33 - 2012-11-01 11:23 - 00089600 _____ () C:\Windows\SYSTEM32\CmdRtr64.DLL
2013-12-10 22:33 - 2012-11-01 11:21 - 00325120 _____ () C:\Windows\SYSTEM32\APOMgr64.DLL
2013-09-27 12:02 - 2013-09-27 12:02 - 04903424 _____ () C:\Program Files (x86)\Hotkey\Hotkey.exe
2013-12-12 13:38 - 2009-09-03 11:30 - 00060928 _____ () C:\Genius\ioCentre\gTaskBar.exe
2013-12-12 13:38 - 2009-09-03 10:45 - 00161280 _____ () C:\Genius\ioCentre\GenXML.dll
2013-12-12 13:38 - 2011-08-05 10:01 - 00961536 _____ () C:\Genius\ioCentre\gMouseTask.exe
2013-12-12 13:38 - 2009-09-03 11:22 - 00063488 _____ () C:\Genius\ioCentre\gfMedia.dll
2013-12-12 13:38 - 2011-06-09 14:26 - 00052224 _____ () C:\Genius\ioCentre\gfBrowser.dll
2013-12-12 13:38 - 2009-09-03 11:23 - 00020992 _____ () C:\Genius\ioCentre\gfOffice.dll
2013-12-12 13:38 - 2009-09-03 11:24 - 00027648 _____ () C:\Genius\ioCentre\gfSystem.dll
2013-12-12 13:38 - 2009-09-03 11:18 - 00040960 _____ () C:\Genius\ioCentre\gfEmail.dll
2013-12-12 13:38 - 2011-08-04 16:45 - 00266752 _____ () C:\Genius\ioCentre\gDevMgm.dll
2013-12-12 13:38 - 2011-08-04 16:48 - 00758784 _____ () C:\Genius\ioCentre\gKbdTask.exe
2013-12-12 13:38 - 2009-09-03 10:55 - 00069120 _____ () C:\Genius\ioCentre\gAutoScroll.dll
2013-12-12 13:38 - 2009-09-03 10:54 - 00249344 _____ () C:\Genius\ioCentre\gAutoPan.dll
2013-12-12 13:38 - 2009-09-03 11:06 - 00259072 _____ () C:\Genius\ioCentre\gZoom.dll
2013-12-12 13:38 - 2009-09-03 11:25 - 00025088 _____ () C:\Genius\ioCentre\gIoCentreHook.dll
2013-12-12 13:38 - 2009-09-03 11:05 - 00048640 _____ () C:\Genius\ioCentre\gTaskSwitch.dll
2013-12-12 13:38 - 2010-04-07 18:05 - 00258560 _____ () C:\Genius\ioCentre\gDeskMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00246784 _____ () C:\Genius\ioCentre\gKbStatus.dll
2013-12-12 13:38 - 2009-09-03 10:59 - 00053760 _____ () C:\Genius\ioCentre\gIMMgm.dll
2013-12-12 13:38 - 2009-09-03 11:02 - 00143360 _____ () C:\Genius\ioCentre\gPreset.dll
2013-12-12 13:38 - 2009-09-03 10:58 - 00044544 _____ () C:\Genius\ioCentre\gIMHook.dll
2013-12-12 13:38 - 2009-09-03 11:04 - 00056832 _____ () C:\Genius\ioCentre\gTabSwitch.dll
2013-12-10 22:29 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: D:\Users\Anonymous\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\Control Panel\Desktop\\Wallpaper -> D:\Users\Anonymous\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: ADExchange => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Bonjour Service => 2
HKLM\...\StartupApproved\StartupFolder: => "Secunia PSI Tray.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKU\S-1-5-21-1788917750-2918846918-3832768059-1008\...\StartupApproved\Run: => "Spotify"

==================== Accounts: =============================

Admin (S-1-5-21-1788917750-2918846918-3832768059-1007 - Administrator - Enabled) => D:\Users\Admin
Administrator (S-1-5-21-1788917750-2918846918-3832768059-500 - Administrator - Disabled)
Anonymous (S-1-5-21-1788917750-2918846918-3832768059-1008 - Limited - Enabled) => D:\Users\Anonymous
Gast (S-1-5-21-1788917750-2918846918-3832768059-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1788917750-2918846918-3832768059-1012 - Limited - Enabled)
postgres (S-1-5-21-1788917750-2918846918-3832768059-1010 - Limited - Enabled) => D:\Users\postgres

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Windows RE tools (T:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable).

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable).

Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Die Klassenregistrierungsdatei kann nicht geladen werden.
 DETAIL - Das System kann die angegebene Datei nicht finden.


System errors:
=============
Error: (02/21/2015 02:22:32 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (02/21/2015 02:22:02 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (02/21/2015 02:17:19 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (02/21/2015 02:16:49 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (02/21/2015 01:51:50 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (02/21/2015 01:51:20 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (02/21/2015 01:46:37 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}

Error: (02/21/2015 01:46:07 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}

Error: (02/20/2015 11:09:42 PM) (Source: DCOM) (EventID: 10010) (User: XMG)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}

Error: (02/20/2015 09:52:05 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Windows\SysWow64\drivers\SSHDRV76.sys


Microsoft Office Sessions:
=========================
Error: (02/21/2015 11:33:25 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161

Error: (02/20/2015 09:52:10 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:44:19 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 05:24:45 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Windows RE tools (T:)Falscher Parameter. (0x80070057)

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable)

Error: (02/20/2015 04:59:12 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddCoreCsiFiles : RtlConvertNtFilePathToWin32Path() failed.

System Error:
0xC0000039 (unresolvable)

Error: (02/20/2015 04:22:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 04:16:05 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 02:24:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.

Error: (02/20/2015 00:18:56 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT-AUTORITÄT)
Description: Das System kann die angegebene Datei nicht finden.


CodeIntegrity Errors:
===================================
  Date: 2015-02-20 17:44:23.753
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2015-02-15 13:39:06.049
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.897
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.635
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.479
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.204
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:05.045
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:04.745
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:04.590
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-02-15 13:39:04.319
  Description: Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Percentage of memory in use: 45%
Total physical RAM: 8111.55 MB
Available physical RAM: 4400.98 MB
Total Pagefile: 16303.55 MB
Available Pagefile: 11541.41 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:435.72 GB) (Free:352.13 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.39 GB) (Free:412.05 GB) NTFS
Drive r: (Recovery Image) (Fixed) (Total:10.74 GB) (Free:10.66 GB) NTFS
Drive t: (Windows RE tools) (Fixed) (Total:0.29 GB) (Free:0.27 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================
         
__________________

Alt 22.02.2015, 07:34   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe - Standard

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe



Unsere Tools brauchen immer Adminrechte.

Lass die von MBAM gefundenen Dateien bitte bei Virustotal scannen.

Dateien online auf Viren prüfen - so geht's - Anleitungen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.02.2015, 18:48   #5
fps
 
Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe - Standard

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe



0/57 bei Virustotal
Malwarebytes findet auch nichts mehr.
Soll Ich die anderen Tools jetzt nochmal mit Adminrechten ausführen ?


Alt 23.02.2015, 11:16   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe - Standard

Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe



Da die Funde ja Fehlalarme waren, nö
__________________
--> Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe

Antwort

Themen zu Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe
.dll, adobe, adobe flash player, adware, backdoor, browser, defender, device driver, dll, downloader, explorer, firefox, flash player, geforce, homepage, iexplore.exe, malware, mozilla, notebook, nvidia, onedrive, opera, photoshop, popup, rundll, security, software, system, uplay, windows



Ähnliche Themen: Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe


  1. Malwarebytes findet PUP
    Plagegeister aller Art und deren Bekämpfung - 31.07.2015 (30)
  2. Malwarebytes hat Backdoor.bot gefunden.
    Log-Analyse und Auswertung - 23.04.2015 (32)
  3. Avast findet Virus und Malwarebytes findet Viren
    Plagegeister aller Art und deren Bekämpfung - 12.03.2014 (7)
  4. Kaspersky findet 7 Trojaner, kann aber nur 2 verarbeiten - malwarebytes findet nichts
    Plagegeister aller Art und deren Bekämpfung - 18.12.2013 (6)
  5. Malwarebytes findet 1 infizierte Datei (Backdoor.Agent.Fpa)
    Plagegeister aller Art und deren Bekämpfung - 12.12.2013 (14)
  6. AVG findet 32 Rootkits,kann sie aber nicht eliminieren ,Malwarebytes findet nichts
    Plagegeister aller Art und deren Bekämpfung - 16.10.2013 (5)
  7. avast findet JS:Downloader-blr, malwarebytes findet Exploit.Drop.GSA
    Plagegeister aller Art und deren Bekämpfung - 03.04.2013 (6)
  8. AntiVir findet nichts doch Malwarebytes findet 22 infizierte Dateien
    Plagegeister aller Art und deren Bekämpfung - 04.09.2012 (21)
  9. Trojan Hunt findet die Trojaner sinowal.727 und agent.28. Malwarebytes findet nichts?
    Plagegeister aller Art und deren Bekämpfung - 15.11.2011 (1)
  10. Backdoor.bot von Malwarebytes gefunden
    Plagegeister aller Art und deren Bekämpfung - 25.04.2011 (1)
  11. Backdoor.Bot / Backdoor.Gootkit / Malware.Trace -> HiJackThis + Malwarebytes logfile
    Log-Analyse und Auswertung - 02.07.2010 (6)
  12. Malwarebytes findet backdoor.dot
    Plagegeister aller Art und deren Bekämpfung - 16.09.2009 (7)
  13. Backdoor.Bot oder spinnt Malwarebytes
    Plagegeister aller Art und deren Bekämpfung - 21.02.2009 (5)
  14. Antivir findet Backdoor BDS/Agent.AY
    Plagegeister aller Art und deren Bekämpfung - 18.05.2005 (334)
  15. Antivir findet Backdoor BDS/Agent.AY
    Log-Analyse und Auswertung - 22.02.2005 (9)
  16. Antivir findet Backdoor BDS/Agent.AY
    Plagegeister aller Art und deren Bekämpfung - 09.01.2005 (10)
  17. Ewido findet Backdoor.Vnc
    Plagegeister aller Art und deren Bekämpfung - 03.04.2004 (5)

Zum Thema Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe - Hallo, vorgestern hat Malwarebytes folgenden Fund gemeldet (bei einem Routine-Scan): Code: Alles auswählen Aufklappen ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 19.02.2015 Scan Time: 18:26:00 Logfile: t.txt Administrator: No Version: 2.00.4.1028 - Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe...
Archiv
Du betrachtest: Malwarebytes findet Backdoor.Bot Ed in MakeAppxml.exe auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.