![]() |
|
Log-Analyse und Auswertung: Winzipper und delta homesWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
![]() | ![]() Winzipper und delta homes Hi, auf dem PC meiner Freundin war heute spontan die Startseite in Firefox verstellt auf delta-homes.com. Ein Blick in die installieren Programme zeigte, dass sich heute eine Software namens Winzipper installiert hat, die laut internet wohl damit in Verbindung steht. Nur wurde heute an dem PC nichts installiert, daher frage ich mich wie sowas kommen kann und wie man das wieder los wird. Anbei die üblichen scans: defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 17:07 on 28/05/2015 (Chris) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. HKCU:DAEMON Tools Lite -> Removed Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01 Ran by Chris (administrator) on TOWER-POWER on 28-05-2015 17:09:14 Running from C:\Users\Chris\Desktop Loaded Profiles: Chris (Available Profiles: Chris) Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe () C:\Gaming Mouse\Gaming Mouse.exe (Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe (Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe (Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe (SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2015-01-17] (Realtek Semiconductor) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [Gaming Mouse] => C:\Gaming Mouse\Gaming Mouse.exe [1306624 2009-09-30] () HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888896 2015-03-24] (Valve Corporation) Startup: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-01-13] ShortcutTarget: Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled ProxyServer: [.DEFAULT] => http=127.0.0.1:64146;https=127.0.0.1:64146 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421333276&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421333276&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} SearchScopes: HKU\S-1-5-21-2561094446-920685720-2640435214-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} SearchScopes: HKU\S-1-5-21-2561094446-920685720-2640435214-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms} BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-17] (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-17] (Oracle Corporation) Tcpip\Parameters: [DhcpNameServer] 213.211.192.34 8.8.8.8 Tcpip\..\Interfaces\{2D5FC48A-55F6-4052-ABDF-159A06A20D32}: [NameServer] 8.8.8.8,8.8.4.4 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 FireFox: ======== FF ProfilePath: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default FF NewTab: chrome://quick_start/content/index.html FF DefaultSearchEngine: delta-homes FF SelectedSearchEngine: delta-homes FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 FF NetworkProxy: "ftp", "119.110.73.130" FF NetworkProxy: "ftp_port", 8080 FF NetworkProxy: "http", "119.110.73.130" FF NetworkProxy: "http_port", 8080 FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co" FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "socks", "119.110.73.130" FF NetworkProxy: "socks_port", 8080 FF NetworkProxy: "ssl", "119.110.73.130" FF NetworkProxy: "ssl_port", 8080 FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-16] () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-16] () FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-17] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-17] (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.) FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom) FF SearchPlugin: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\searchplugins\delta-homes.xml [2015-05-28] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystartsearch.xml [2015-01-15] FF Extension: QuickSearch - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\quick_searchff@gmail.com [2015-05-28] FF Extension: Search Enginer - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\sweetsearch@gmail.com [2015-05-28] FF Extension: Firebug - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\firebug@software.joehewitt.com.xpi [2015-03-05] FF Extension: Stealthy - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\stealthyextension@gmail.com.xpi [2015-01-17] FF Extension: Video DownloadHelper - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-26] FF Extension: Adblock Edge - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-01-13] FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\fftoolbar2014@etech.com FF HKLM-x32\...\Firefox\Extensions: [quick_searchff@gmail.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\quick_searchff@gmail.com FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\sweetsearch@gmail.com StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499 ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation) R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation) S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2015-01-17] (Realtek Semiconductor) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation) R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [315392 2015-05-20] (SysTool PasSame LIMITED) [File not signed] <==== ATTENTION R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [426128 2015-05-28] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [656664 2014-08-19] (Wacom Technology, Corp.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2014-11-21] (Advanced Micro Devices) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-06-21] (Advanced Micro Devices) R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-15] (Disc Soft Ltd) R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [457496 2015-01-14] (Intel Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-05-28 17:09 - 2015-05-28 17:09 - 00016860 _____ () C:\Users\Chris\Desktop\FRST.txt 2015-05-28 17:08 - 2015-05-28 17:09 - 00000000 ____D () C:\FRST 2015-05-28 17:07 - 2015-05-28 17:07 - 00000542 _____ () C:\Users\Chris\Desktop\defogger_disable.log 2015-05-28 17:07 - 2015-05-28 17:07 - 00000168 _____ () C:\Users\Chris\defogger_reenable 2015-05-28 17:06 - 2015-05-28 17:04 - 02108928 _____ (Farbar) C:\Users\Chris\Desktop\FRST64.exe 2015-05-28 17:06 - 2015-05-28 17:04 - 00380416 _____ () C:\Users\Chris\Desktop\q3c7d44r.exe 2015-05-28 17:06 - 2015-05-28 17:03 - 00050477 _____ () C:\Users\Chris\Desktop\Defogger.exe 2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\WinZipper 2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper 2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\WinZipper 2015-05-21 19:40 - 2015-05-21 19:40 - 00000000 ____D () C:\Users\Chris\Documents\eBooks 2015-05-21 19:39 - 2015-05-21 19:39 - 00000000 ____D () C:\Users\Chris\Documents\Neuer Ordner 2015-05-21 19:37 - 2015-05-21 19:38 - 70217728 _____ () C:\Users\Chris\Downloads\calibre-64bit-2.28.0.msi 2015-05-20 23:14 - 2015-05-20 23:36 - 154430818 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal Akt 22 Erwartungen - Nemesis - - Niconic.mp4 2015-05-20 23:13 - 2015-05-20 23:18 - 74414621 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal 21.mp4 2015-05-18 19:15 - 2015-05-18 19:15 - 00747216 _____ (Installer generic ) C:\Users\Chris\Downloads\miranda-im-v0.10.32-unicode.exe 2015-05-16 14:05 - 2015-05-16 14:05 - 00279816 _____ () C:\Windows\Minidump\051615-4156-01.dmp 2015-05-16 13:43 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-05-14 13:21 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-05-14 13:21 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2015-05-14 13:19 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-05-14 13:19 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-05-14 13:19 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll 2015-05-14 13:19 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll 2015-05-14 13:19 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys 2015-05-14 13:19 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS 2015-05-14 13:19 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys 2015-05-14 13:19 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll 2015-05-14 13:19 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll 2015-05-14 13:19 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll 2015-05-14 13:19 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll 2015-05-14 13:17 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll 2015-05-14 13:17 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-05-14 13:17 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-05-14 13:17 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-05-14 13:17 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-05-14 13:17 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-05-14 13:17 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-05-14 13:17 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-05-14 13:17 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-05-14 13:17 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2015-05-14 13:17 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-05-14 13:17 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-05-14 13:17 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-05-14 13:17 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2015-05-14 13:17 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-05-14 13:17 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-05-14 13:17 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-05-14 13:17 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-05-14 13:17 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-05-14 13:17 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-05-14 13:17 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-05-14 13:17 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-05-14 13:17 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-05-14 13:17 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-05-14 13:17 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-05-14 13:17 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-05-14 13:17 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-05-14 13:17 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-05-14 13:17 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-05-14 13:17 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-05-14 13:17 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-05-14 13:17 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-05-14 13:17 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-05-14 13:17 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-05-14 13:17 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-05-14 13:17 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-05-14 13:17 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-05-14 13:17 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-05-14 13:17 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-05-14 13:17 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-05-14 13:17 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-05-14 13:17 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-05-14 13:17 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-05-14 13:17 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2015-05-14 13:17 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe 2015-05-14 13:17 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll 2015-05-14 13:17 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll 2015-05-14 13:17 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll 2015-05-14 13:17 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll 2015-05-14 13:17 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll 2015-05-14 13:17 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll 2015-05-14 13:17 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-05-14 13:17 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-05-14 13:17 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-05-14 13:17 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-05-14 13:17 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys 2015-05-14 13:17 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys 2015-05-14 13:17 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys 2015-05-14 13:17 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll 2015-05-14 13:17 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll 2015-05-14 13:17 - 2015-03-13 02:29 - 00410017 _____ () C:\Windows\system32\ApnDatabase.xml 2015-05-14 13:17 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe 2015-05-14 13:17 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe 2015-05-14 13:17 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll 2015-05-14 13:17 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll 2015-05-14 13:17 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll 2015-05-14 13:17 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll 2015-05-14 13:17 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll 2015-05-05 18:27 - 2015-05-05 18:27 - 00014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel 2015-05-04 16:19 - 2015-05-04 16:19 - 00001310 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mcedit2.lnk 2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Python-Eggs 2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Program Files\mcedit2-win64-2.0.0alpha-232 2015-05-04 15:22 - 2015-05-04 15:23 - 29551850 _____ (Igor Pavlov) C:\Users\Chris\Downloads\mcedit2-win64-2.0.0alpha-232.exe ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-05-28 17:07 - 2015-01-13 22:00 - 00000000 ____D () C:\Users\Chris 2015-05-28 17:07 - 2014-09-24 08:16 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-05-28 17:07 - 2014-09-24 07:43 - 00764340 _____ () C:\Windows\system32\perfh007.dat 2015-05-28 17:07 - 2014-09-24 07:43 - 00159160 _____ () C:\Windows\system32\perfc007.dat 2015-05-28 17:05 - 2013-08-22 16:46 - 00702669 _____ () C:\Windows\setupact.log 2015-05-28 17:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru 2015-05-28 16:49 - 2015-01-13 22:00 - 01917835 _____ () C:\Windows\WindowsUpdate.log 2015-05-28 16:44 - 2015-01-13 22:19 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2561094446-920685720-2640435214-1001 2015-05-28 16:39 - 2015-01-13 19:18 - 00000000 ___RD () C:\Users\Chris\Dropbox 2015-05-28 16:11 - 2015-02-09 14:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-05-28 15:44 - 2015-04-02 15:11 - 00000000 ____D () C:\Users\Chris\AppData\Local\CrashDumps 2015-05-28 15:44 - 2015-01-15 16:47 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect 2015-05-28 15:44 - 2015-01-13 22:00 - 00001764 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-05-28 15:44 - 2015-01-13 17:28 - 00001485 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-05-28 14:43 - 2015-01-13 19:14 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Dropbox 2015-05-28 14:43 - 2015-01-13 18:39 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Raptr 2015-05-28 14:42 - 2015-01-16 19:56 - 00000000 ____D () C:\Users\Chris\OneDrive 2015-05-28 14:42 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-05-28 00:11 - 2015-01-13 16:51 - 00065536 _____ () C:\Windows\system32\spu_storage.bin 2015-05-28 00:11 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2015-05-26 17:27 - 2015-04-27 14:42 - 00000000 ____D () C:\Users\Chris\Desktop\Ordner 2015-05-26 17:25 - 2015-01-13 19:51 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Guild Wars 2 2015-05-21 19:47 - 2015-01-29 17:14 - 00000000 ____D () C:\Users\Chris\Documents\Calibre-Bibliothek 2015-05-21 19:40 - 2015-01-15 16:18 - 00000000 ____D () C:\Users\Chris\Sonstiges 2015-05-21 17:50 - 2015-01-18 21:27 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\vlc 2015-05-21 16:02 - 2015-01-13 18:52 - 00000000 ____D () C:\Program Files (x86)\Steam 2015-05-20 22:03 - 2015-01-26 15:12 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\TS3Client 2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\SysWOW64\GWX 2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\system32\GWX 2015-05-20 17:40 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp 2015-05-19 15:40 - 2015-01-13 18:39 - 00000000 ____D () C:\Program Files (x86)\Raptr 2015-05-19 15:38 - 2014-09-23 23:06 - 00048806 _____ () C:\Windows\PFRO.log 2015-05-17 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache 2015-05-17 12:48 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness 2015-05-17 11:26 - 2015-01-17 22:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-05-16 14:05 - 2015-02-08 04:32 - 504073285 _____ () C:\Windows\MEMORY.DMP 2015-05-16 14:05 - 2015-02-08 04:32 - 00000000 ____D () C:\Windows\Minidump 2015-05-16 11:10 - 2015-01-14 13:41 - 00000000 ____D () C:\Users\Chris\AppData\Local\Adobe 2015-05-16 11:09 - 2015-02-09 14:20 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-05-15 18:18 - 2013-08-22 16:44 - 00410048 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-05-14 23:42 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel 2015-05-14 23:42 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers 2015-05-14 13:22 - 2015-01-15 17:37 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-05-14 13:21 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal 2015-05-13 17:27 - 2015-01-13 17:07 - 00000000 ____D () C:\Windows\system32\MRT 2015-05-13 17:26 - 2015-01-13 17:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-05-09 13:03 - 2015-01-13 19:16 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2015-05-07 18:48 - 2015-01-25 13:57 - 00000000 ____D () C:\Users\Chris\Documents\Guild Wars 2 2015-05-05 19:59 - 2014-09-24 09:43 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-05-05 19:59 - 2014-09-24 09:43 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-05-05 18:43 - 2015-01-14 00:05 - 00000000 ____D () C:\Users\Chris\.gimp-2.8 2015-05-05 18:27 - 2015-01-16 02:25 - 00000000 ____D () C:\Users\Chris\AppData\Local\gtk-2.0 2015-04-29 18:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF ==================== Files in the root of some directories ======= 2015-01-25 18:12 - 2015-01-25 18:12 - 0001248 _____ () C:\Users\Chris\AppData\Roaming\MIETPOSV 2015-01-25 18:12 - 2015-01-25 18:12 - 0002086 _____ () C:\Users\Chris\AppData\Roaming\SUS 2015-01-20 23:54 - 2015-01-20 23:54 - 0003584 _____ () C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-05-05 18:27 - 2015-05-05 18:27 - 0014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel Some files in TEMP: ==================== C:\Users\Chris\AppData\Local\Temp\1596.exe C:\Users\Chris\AppData\Local\Temp\2024.exe C:\Users\Chris\AppData\Local\Temp\2596.exe C:\Users\Chris\AppData\Local\Temp\2908.exe C:\Users\Chris\AppData\Local\Temp\3444.exe C:\Users\Chris\AppData\Local\Temp\3668.exe C:\Users\Chris\AppData\Local\Temp\3916.exe C:\Users\Chris\AppData\Local\Temp\400.exe C:\Users\Chris\AppData\Local\Temp\636.exe C:\Users\Chris\AppData\Local\Temp\908.exe C:\Users\Chris\AppData\Local\Temp\amd-catalyst-omega-14.12-without-dotnet45-win8.1-64bit.exe C:\Users\Chris\AppData\Local\Temp\AutoDetectUtilApp.exe C:\Users\Chris\AppData\Local\Temp\bitool.dll C:\Users\Chris\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpg578xh.dll C:\Users\Chris\AppData\Local\Temp\Gw2.exe C:\Users\Chris\AppData\Local\Temp\jre-8u31-windows-au.exe C:\Users\Chris\AppData\Local\Temp\npp.6.7.4.Installer.exe C:\Users\Chris\AppData\Local\Temp\ose00000.exe C:\Users\Chris\AppData\Local\Temp\raptrpatch.exe C:\Users\Chris\AppData\Local\Temp\raptr_stub.exe C:\Users\Chris\AppData\Local\Temp\smt_mystartsearch.exe C:\Users\Chris\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-05-27 19:15 ==================== End of log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01 Ran by Chris at 2015-05-28 17:09:29 Running from C:\Users\Chris\Desktop Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2561094446-920685720-2640435214-500 - Administrator - Disabled) Chris (S-1-5-21-2561094446-920685720-2640435214-1001 - Administrator - Enabled) => C:\Users\Chris Gast (S-1-5-21-2561094446-920685720-2640435214-501 - Limited - Disabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) Hidden Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated) Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated) Alice: Madness Returns (HKLM-x32\...\Steam App 19680) (Version: - Spicy Horse Games) AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.) Brothers - A Tale of Two Sons (HKLM-x32\...\Steam App 225080) (Version: - Starbreeze Studios AB) calibre 64bit (HKLM\...\{07AAC4EC-6402-4375-AA46-D7FE1390FFBB}) (Version: 2.23.0 - Kovid Goyal) Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD) DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd) Dropbox (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.) FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse) Gaming Mouse (HKLM-x32\...\Gaming Mouse 3) (Version: - ) GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team) GUILD WARS (HKLM-x32\...\Guild Wars) (Version: - ) Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.) Haskell Platform 2014.2.0.0 (HKLM\...\HaskellPlatform-2014.2.0.0) (Version: - Haskell.org) Haunt the House: Terrortown (HKLM-x32\...\Steam App 270630) (Version: - SFB Games) Inkscape 0.48.5 (HKLM-x32\...\Inkscape) (Version: 0.48.5 - ) Intel(R) Network Connections 19.0.27.0 (HKLM\...\PROSetDX) (Version: 19.0.27.0 - Intel) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan) Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation) Last Dream (HKLM-x32\...\Steam App 266230) (Version: - White Giant RPG Studios) LEGO Lord of the Rings (HKLM-x32\...\Steam App 214510) (Version: - Traveller's Tales) LIMBO (HKLM-x32\...\Steam App 48000) (Version: - Playdead) Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation) Miranda IM (HKLM-x32\...\Miranda IM) (Version: 0.10.27 - Miranda IM Project) Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla) MyPaint 1.0.0 (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\MyPaint) (Version: 1.0.0 - Martin Renold & MyPaint Development Team) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team) Oblivion (HKLM-x32\...\{C66BF9FD-D367-4E13-8EB8-385FFEA20DB3}) (Version: 1.2.0416 - Bethesda Softworks) Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve) Raptr (HKLM-x32\...\Raptr) (Version: - ) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.) Scribblenauts Unlimited (HKLM-x32\...\Steam App 218680) (Version: - 5th Cell Media) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) SimCity 4 Deluxe (HKLM-x32\...\Steam App 24780) (Version: - EA - Maxis) Space Engineers (HKLM-x32\...\Steam App 244850) (Version: - Keen Software House) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios) The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version: - CD Projekt RED) Trine (HKLM-x32\...\Steam App 35700) (Version: - Frozenbyte) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.5-3 - Wacom Technology Corp.) WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.) WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.) WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.98 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION Year Walk (HKLM-x32\...\Steam App 269050) (Version: - Simogo) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ==================== Restore Points ========================= 13-05-2015 17:25:18 Windows Update 20-05-2015 17:39:40 Windows Update 28-05-2015 15:30:53 Geplanter Prüfpunkt ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {3B31EEB1-F47B-417C-9237-9BE14E6A860F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated) Task: {44FC21B8-FDD7-46F8-89B5-F3FDDCDB3346} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation) Task: {64C4FEA2-33D5-4C1C-A0C2-43402B8BA2E4} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation) Task: {AB51F3E1-B437-4015-ABBF-2F8EA2BF25DE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-05-13] (Microsoft Corporation) Task: {FC4A3A12-0FA7-4A91-B1BC-E23DE771F816} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-16] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (Whitelisted) ============== 2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll 2015-01-15 23:23 - 2014-08-19 21:12 - 01356568 _____ () C:\Program Files\Tablet\Pen\libxml2.dll 2009-09-30 03:05 - 2009-09-30 03:05 - 01306624 _____ () C:\Gaming Mouse\Gaming Mouse.exe 2010-11-23 00:56 - 2010-11-23 00:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd 2014-05-14 01:26 - 2014-05-14 01:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd 2014-05-14 01:26 - 2014-05-14 01:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd 2014-05-14 01:26 - 2014-05-14 01:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd 2014-05-14 01:26 - 2014-05-14 01:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd 2010-11-23 00:57 - 2010-11-23 00:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll 2010-11-23 00:56 - 2010-11-23 00:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd 2010-11-23 00:57 - 2010-11-23 00:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd 2010-11-23 00:57 - 2010-11-23 00:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd 2011-02-15 20:17 - 2011-02-15 20:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll 2010-11-23 00:57 - 2010-11-23 00:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd 2014-05-14 01:26 - 2014-05-14 01:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd 2014-08-14 02:37 - 2014-08-14 02:37 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll 2014-08-14 02:37 - 2014-08-14 02:37 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll 2013-11-21 02:05 - 2013-11-21 02:05 - 00256000 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll 2010-11-23 00:56 - 2010-11-23 00:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll 2010-11-23 00:57 - 2010-11-23 00:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd 2010-11-23 00:56 - 2010-11-23 00:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd 2015-05-15 04:21 - 2015-05-15 04:21 - 02540288 _____ () C:\Program Files (x86)\Raptr\ltc_host_ex.DLL 2014-08-14 02:37 - 2014-08-14 02:37 - 00027667 _____ () C:\Program Files (x86)\Raptr\plugins\audio_output\libdirectsound_plugin.dll 2014-08-14 02:37 - 2014-08-14 02:37 - 00031251 _____ () C:\Program Files (x86)\Raptr\plugins\audio_output\libwaveout_plugin.dll 2014-08-14 02:37 - 2014-08-14 02:37 - 00066579 _____ () C:\Program Files (x86)\Raptr\plugins\video_output\libdirectdraw_plugin.dll 2010-11-23 00:57 - 2010-11-23 00:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd 2014-06-18 02:56 - 2014-06-18 02:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd 2011-02-15 20:17 - 2011-02-15 20:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll 2010-11-23 01:06 - 2010-11-23 01:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll 2013-05-10 01:52 - 2013-05-10 01:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll 2013-05-10 01:52 - 2013-05-10 01:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll 2013-05-10 01:52 - 2013-05-10 01:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll 2013-05-03 20:57 - 2013-05-03 20:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll 2013-05-03 20:56 - 2013-05-03 20:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll 2013-05-03 20:56 - 2013-05-03 20:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll 2013-05-03 20:57 - 2013-05-03 20:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll 2013-05-03 20:56 - 2013-05-03 20:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll 2013-05-03 20:57 - 2013-05-03 20:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll 2013-05-03 20:57 - 2013-05-03 20:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll 2013-05-03 20:57 - 2013-05-03 20:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll 2013-05-03 20:57 - 2013-05-03 20:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll 2015-05-28 15:45 - 2015-05-28 05:12 - 00612496 _____ () C:\Program Files (x86)\WinZipper\sqlite3.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) AlternateDataStreams: C:\Users\Chris\OneDrive:ms-properties AlternateDataStreams: C:\Users\Chris\Desktop\Einspruch.MP3:com.dropbox.attributes ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Chris\Pictures\5bqde - Imgur.jpg DNS Servers: 8.8.8.8 - 8.8.4.4 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\Run32: => "BCSSync" HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "DAEMON Tools Lite" HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "Steam" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe FirewallRules: [TCP Query User{322D338F-3F69-4D19-91B2-98AD8D2F66E6}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe FirewallRules: [UDP Query User{7467FFC5-13ED-4061-A2D7-80E229E2ECE8}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe FirewallRules: [{CD5BD729-1D8B-40A5-9C8D-8BBBE80B0053}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{902F1FCF-C905-4954-A04A-18DA64E0C216}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe FirewallRules: [{E9247673-E34E-418E-AFFA-F79E1011444F}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{3799BDDA-B04C-440A-8D24-9B930BF777A2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe FirewallRules: [{877154DD-DEFC-4E7B-B449-F720EEDEDDF0}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe FirewallRules: [{154A3DDE-D904-46AC-BAB1-D61A0F064308}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe FirewallRules: [{E2049D11-C7FA-4745-8F15-51F4D07F087C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe FirewallRules: [{6893A4BC-E269-4D4B-9D90-9F896FE19801}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe FirewallRules: [{379F17D2-5FB3-4521-95D5-9C567EF33A57}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe FirewallRules: [{4D2E4BD1-B0CA-4E9A-8A42-7340A6EC6572}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe FirewallRules: [{D9928F33-DA6D-4C4A-98A2-6E0B2BAA41C3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe FirewallRules: [{27F8199A-33E8-402C-9225-54D84E3F73F9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe FirewallRules: [{816EC679-99B5-4438-BCE9-334A11621A63}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe FirewallRules: [{96D4B554-FA25-4BD6-9E4C-907C3A9E6439}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe FirewallRules: [{19294CB7-8E9F-4A51-9F55-B769F7F02EA5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe FirewallRules: [{2E511C23-453B-4A30-8071-3D145E4FA734}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe FirewallRules: [{5498C18F-6E50-4F3E-9BC7-F56B8046A129}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe FirewallRules: [{294DE233-9F93-427D-B6D5-CAC22F7D6491}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe FirewallRules: [{4E876F61-CD82-43AD-A0EB-5C3C8C00C754}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe FirewallRules: [{B66AA9F3-0B18-4B26-A35C-327305A98854}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe FirewallRules: [{09F0E349-47E1-4D97-BFFD-295E5215BC33}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe FirewallRules: [{78DAF125-C3DF-4DE4-8B69-C150D18AA57E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe FirewallRules: [{D712E4A0-3235-48B5-8D8F-3DE2F1B13082}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe FirewallRules: [{2280B3F1-D7E3-4C66-A3E5-B084980ED531}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe FirewallRules: [{19FDCE86-5026-4DBB-8CEF-8C6EE0D3E7E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe FirewallRules: [{46AFD520-3A5F-4572-82D8-2B344310FF89}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe FirewallRules: [{7BBA4820-6639-4C99-8805-AD6D31B9127E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe FirewallRules: [{C52420D8-C425-4265-B126-B598AA9B60B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe FirewallRules: [{88A0629B-21E2-4A36-83DA-E9E70AC76FDE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe FirewallRules: [{517471F5-35C3-4DD6-A63B-DAB9CD75EF07}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe FirewallRules: [TCP Query User{AA2BBCE6-E12C-400A-83EF-FF3E7701D621}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe FirewallRules: [UDP Query User{3E78BDD4-25B8-4566-B8B9-18709F4028DD}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe FirewallRules: [{03674CEF-6239-4211-9039-EBB745833368}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe FirewallRules: [{1C75413F-589C-4E66-8633-30CD01442470}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe FirewallRules: [{3F9E6F76-1128-4746-8599-75137446F34E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe FirewallRules: [{3FC52BCC-077F-4E1E-8FA2-9A598D74CC67}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe FirewallRules: [{1DC78FE1-4B23-4E4D-82CE-B75861196C9E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe FirewallRules: [{62C5B64B-1CC7-4CF1-9D2B-F03C436CC1BC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe FirewallRules: [TCP Query User{9B614EE6-93D1-48EF-BBC4-0E8CE89FFF69}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe FirewallRules: [UDP Query User{C9E21A59-E878-4E12-881F-11F712B919A4}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe FirewallRules: [TCP Query User{7C5D5258-9C17-4A92-BBF2-84565B7E6366}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe FirewallRules: [UDP Query User{93FF9520-49E1-4AE4-91D1-AB2390948071}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe FirewallRules: [TCP Query User{CAE61E69-ECD6-499B-B972-3F17D64BE7F9}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe FirewallRules: [UDP Query User{C1E17F90-50BF-455B-85E4-5AA8AEFDD4B1}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe FirewallRules: [{39CAB1CE-111D-4EEB-9922-D286346B5B54}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{EE91AB11-0C2A-4865-99D5-9DB98C210BD3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{BEDF15BF-34AE-4C4B-899A-0C114093F18F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe FirewallRules: [{6534B34D-8D9D-4FD5-8243-D850B1301A6A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe FirewallRules: [{0014F327-77C4-410F-B503-C0EE1A98128D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe FirewallRules: [{F5E10FBA-9FFE-40A6-9748-4E15BAA0B235}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe FirewallRules: [TCP Query User{78EBCDE1-06B4-49A3-9CE4-460A1C9EBCE1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [UDP Query User{312E7875-7410-40E2-A996-5892C596D2D1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [{43FF6593-4E26-42DA-8D41-C265630F4EE6}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{B71851F8-4C88-44A3-9727-1569678021E0}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{04CEAA9D-C4CE-4EAA-94B4-80AD6040B8EF}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{BD96691E-F3FF-4475-9EB0-0EC9D657B660}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe ==================== Faulty Device Manager Devices ============= Name: Qualcomm Atheros AR9485-Funknetzwerkadapter Description: Qualcomm Atheros AR9485-Funknetzwerkadapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Qualcomm Atheros Communications Inc. Service: athr Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: SM-Bus-Controller Description: SM-Bus-Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2 Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2 Ausnahmecode: 0xc0000142 Fehleroffset: 0x0009d4f2 ID des fehlerhaften Prozesses: 0xb94 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2 Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5 Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2 Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2 Ausnahmecode: 0xc0000142 Fehleroffset: 0x0009d4f2 ID des fehlerhaften Prozesses: 0x4ec Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2 Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5 Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer". Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll. System Error: Zugriff verweigert . Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest. Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest. Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0 Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000012bb8 ID des fehlerhaften Prozesses: 0x298 Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0 Pfad der fehlerhaften Anwendung: igfxCUIService.exe1 Pfad des fehlerhaften Moduls: igfxCUIService.exe2 Berichtskennung: igfxCUIService.exe3 Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5 Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest. Error: (05/27/2015 07:15:16 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (05/27/2015 05:30:38 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0 Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000000000012bb8 ID des fehlerhaften Prozesses: 0x22c Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0 Pfad der fehlerhaften Anwendung: igfxCUIService.exe1 Pfad des fehlerhaften Moduls: igfxCUIService.exe2 Berichtskennung: igfxCUIService.exe3 Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5 Error: (05/26/2015 10:36:54 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm wmplayer.exe, Version 12.0.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 82c Startzeit: 01d097f3adc3daad Endzeit: 5 Anwendungspfad: C:\Program Files (x86)\Windows Media Player\wmplayer.exe Berichts-ID: efcbddb5-03e6-11e5-828f-d0509942e1d9 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: System errors: ============= Error: (05/28/2015 02:42:40 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: %%2147500037 Error: (05/28/2015 02:42:36 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT) Description: A TCG Command has returned an error. Desc: AuthenticateSession Param1: 0x1 Param2: 0x60000001c Param3: 0x900000006 Param4: 0x0 Status: 0x1 Error: (05/27/2015 05:30:38 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: %%2147500037 Error: (05/27/2015 05:30:34 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT) Description: A TCG Command has returned an error. Desc: AuthenticateSession Param1: 0x1 Param2: 0x60000001c Param3: 0x900000006 Param4: 0x0 Status: 0x1 Error: (05/26/2015 02:18:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: %%2147500037 Error: (05/26/2015 02:18:01 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT) Description: A TCG Command has returned an error. Desc: AuthenticateSession Param1: 0x1 Param2: 0x60000001c Param3: 0x900000006 Param4: 0x0 Status: 0x1 Error: (05/26/2015 01:19:09 AM) (Source: DCOM) (EventID: 10010) (User: TOWER-POWER) Description: {1A1F4206-0688-4E7F-BE03-D82EC69DF9A5} Error: (05/25/2015 02:07:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: %%2147500037 Error: (05/25/2015 02:07:16 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT) Description: A TCG Command has returned an error. Desc: AuthenticateSession Param1: 0x1 Param2: 0x60000001c Param3: 0x900000006 Param4: 0x0 Status: 0x1 Error: (05/24/2015 11:45:16 AM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: %%2147500037 Microsoft Office: ========================= Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f2b9401d0994c6ea4f553C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dllac52d525-053f-11e5-8291-d0509942e1d9 Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f24ec01d0994c67446510C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dlla4f53663-053f-11e5-8291-d0509942e1d9 Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll. System Error: Zugriff verweigert Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb829801d09943c85890f5C:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe06a27806-0537-11e5-8291-d0509942e1d9 Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: ) Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe Error: (05/27/2015 07:15:16 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: ) Description: System-reserviertFalscher Parameter. (0x80070057) Error: (05/27/2015 05:30:38 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb822c01d0989214db483cC:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe5322cd8b-0485-11e5-8290-d0509942e1d9 Error: (05/26/2015 10:36:54 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: wmplayer.exe12.0.9600.1741582c01d097f3adc3daad5C:\Program Files (x86)\Windows Media Player\wmplayer.exeefcbddb5-03e6-11e5-828f-d0509942e1d9 CodeIntegrity Errors: =================================== Date: 2015-05-28 15:26:09.740 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-27 19:15:22.546 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-26 14:45:18.011 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-25 14:17:25.800 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-24 13:54:52.200 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-23 15:26:44.317 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-22 14:44:37.500 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-20 10:40:37.550 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-19 18:24:36.091 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-05-18 18:25:52.835 Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-4460 CPU @ 3.20GHz Percentage of memory in use: 18% Total physical RAM: 8127.11 MB Available physical RAM: 6641.2 MB Total Pagefile: 16319.11 MB Available Pagefile: 14286.29 MB Total Virtual: 131072 MB Available Virtual: 131071.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:238.13 GB) (Free:86.3 GB) NTFS Drive e: (USB-STICK) (Removable) (Total:0.95 GB) (Free:0.94 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 37832B8A) Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=238.1 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 972 MB) (Disk ID: 000DAD2F) Partition 1: (Active) - (Size=972 MB) - (Type=0B) ==================== End of log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-05-28 17:20:04 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002a Crucial_CT256MX100SSD1 rev.MU01 238,47GB Running: q3c7d44r.exe; Driver: C:\Users\Chris\AppData\Local\Temp\kglyaaow.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960001bb900 15 bytes [00, 57, F4, 01, 40, 8F, 6E, ...] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 16 fffff960001bb910 11 bytes [00, 41, FC, FF, 00, 79, C7, ...] ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\csrss.exe [572:3164] fffff960008b22d0 ---- Processes - GMER 2.1 ---- Process C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [2840] (Windows SysTool Svr/SysTool PasSame LIMITED)(2015-01-15 14:47:57) 00000000000d0000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}\Connection@Name isatap.{2D5FC48A-55F6-4052-ABDF-159A06A20D32} Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed -405932739 Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@InterfaceName isatap.{2D5FC48A-55F6-4052-ABDF-159A06A20D32} Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@ReusableType 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@DefunctTimestamp 0x40 0x0D 0x67 0x55 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 2721 Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 813 Reg HKLM\SYSTEM\CurrentControlSet\Services\WpdUpFltr\Parameters\Wdf@TimeOfLastSqmLog 0x95 0x6B 0x0E 0x31 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Run@DAEMON Tools Lite "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun ---- EOF - GMER 2.1 ---- Scree |
Themen zu Winzipper und delta homes |
.dll, adware, browser, cpu, defender, error, explorer, firefox, flash player, frage, ftp, helper, home, homepage, iexplore.exe, internet, launch, mozilla, nemesis, newtab, port, realtek, registry, security, software, system, tablet, udp, windows |