Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Winzipper und delta homes

Winzipper und delta homes


Log-Analyse und Auswertung: Winzipper und delta homes

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 28.05.2015, 16:41   #1
Scree
 
Winzipper und delta homes - Standard

Winzipper und delta homes


Hi,
auf dem PC meiner Freundin war heute spontan die Startseite in Firefox verstellt auf delta-homes.com. Ein Blick in die installieren Programme zeigte, dass sich heute eine Software namens Winzipper installiert hat, die laut internet wohl damit in Verbindung steht. Nur wurde heute an dem PC nichts installiert, daher frage ich mich wie sowas kommen kann und wie man das wieder los wird.
Anbei die üblichen scans:
defogger_disable.log
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:07 on 28/05/2015 (Chris)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
FRST.txt
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-05-2015 01
Ran by Chris (administrator) on TOWER-POWER on 28-05-2015 17:09:14
Running from C:\Users\Chris\Desktop
Loaded Profiles: Chris (Available Profiles: Chris)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
() C:\Gaming Mouse\Gaming Mouse.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2015-01-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Gaming Mouse] => C:\Gaming Mouse\Gaming Mouse.exe [1306624 2009-09-30] ()
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888896 2015-03-24] (Valve Corporation)
Startup: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-01-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:64146;https=127.0.0.1:64146
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421333276&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421333276&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2561094446-920685720-2640435214-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2561094446-920685720-2640435214-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499&q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-17] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-17] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 213.211.192.34 8.8.8.8
Tcpip\..\Interfaces\{2D5FC48A-55F6-4052-ABDF-159A06A20D32}: [NameServer] 8.8.8.8,8.8.4.4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1421333204&from=smt&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499

FireFox:
========
FF ProfilePath: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: delta-homes
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499
FF NetworkProxy: "ftp", "119.110.73.130"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "http", "119.110.73.130"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "119.110.73.130"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "119.110.73.130"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-16] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-16] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF SearchPlugin: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\searchplugins\delta-homes.xml [2015-05-28]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystartsearch.xml [2015-01-15]
FF Extension: QuickSearch - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\quick_searchff@gmail.com [2015-05-28]
FF Extension: Search Enginer - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\sweetsearch@gmail.com [2015-05-28]
FF Extension: Firebug - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\firebug@software.joehewitt.com.xpi [2015-03-05]
FF Extension: Stealthy - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\stealthyextension@gmail.com.xpi [2015-01-17]
FF Extension: Video DownloadHelper - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-03-26]
FF Extension: Adblock Edge - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-01-13]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\fftoolbar2014@etech.com
FF HKLM-x32\...\Firefox\Extensions: [quick_searchff@gmail.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\quick_searchff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\r79ey395.default\extensions\sweetsearch@gmail.com
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.delta-homes.com/?type=sc&ts=1432820656&z=64ab8bf6276e64ca63f8a66g2zbcdo0b1o4eeq0z2t&from=wpm05283&uid=CrucialXCT256MX100SSD1_14450DBC24990DBC2499

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-05] (Microsoft Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2015-01-17] (Realtek Semiconductor)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [315392 2015-05-20] (SysTool PasSame LIMITED) [File not signed] <==== ATTENTION
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [426128 2015-05-28] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [656664 2014-08-19] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2014-11-21] (Advanced Micro Devices)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [223232 2014-06-21] (Advanced Micro Devices)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2015-01-15] (Disc Soft Ltd)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [457496 2015-01-14] (Intel Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 17:09 - 2015-05-28 17:09 - 00016860 _____ () C:\Users\Chris\Desktop\FRST.txt
2015-05-28 17:08 - 2015-05-28 17:09 - 00000000 ____D () C:\FRST
2015-05-28 17:07 - 2015-05-28 17:07 - 00000542 _____ () C:\Users\Chris\Desktop\defogger_disable.log
2015-05-28 17:07 - 2015-05-28 17:07 - 00000168 _____ () C:\Users\Chris\defogger_reenable
2015-05-28 17:06 - 2015-05-28 17:04 - 02108928 _____ (Farbar) C:\Users\Chris\Desktop\FRST64.exe
2015-05-28 17:06 - 2015-05-28 17:04 - 00380416 _____ () C:\Users\Chris\Desktop\q3c7d44r.exe
2015-05-28 17:06 - 2015-05-28 17:03 - 00050477 _____ () C:\Users\Chris\Desktop\Defogger.exe
2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\WinZipper
2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
2015-05-28 15:45 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\WinZipper
2015-05-21 19:40 - 2015-05-21 19:40 - 00000000 ____D () C:\Users\Chris\Documents\eBooks
2015-05-21 19:39 - 2015-05-21 19:39 - 00000000 ____D () C:\Users\Chris\Documents\Neuer Ordner
2015-05-21 19:37 - 2015-05-21 19:38 - 70217728 _____ () C:\Users\Chris\Downloads\calibre-64bit-2.28.0.msi
2015-05-20 23:14 - 2015-05-20 23:36 - 154430818 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal Akt 22 Erwartungen - Nemesis - - Niconic.mp4
2015-05-20 23:13 - 2015-05-20 23:18 - 74414621 _____ () C:\Users\Chris\Desktop\Sailor Moon Crystal 21.mp4
2015-05-18 19:15 - 2015-05-18 19:15 - 00747216 _____ (Installer generic ) C:\Users\Chris\Downloads\miranda-im-v0.10.32-unicode.exe
2015-05-16 14:05 - 2015-05-16 14:05 - 00279816 _____ () C:\Windows\Minidump\051615-4156-01.dmp
2015-05-16 13:43 - 2015-05-28 15:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-14 13:21 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:21 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 13:19 - 2015-05-01 01:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-14 13:19 - 2015-05-01 00:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-14 13:19 - 2015-04-10 02:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-14 13:19 - 2015-04-10 02:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-14 13:19 - 2015-03-20 03:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-05-14 13:19 - 2015-03-17 19:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-14 13:19 - 2015-03-09 04:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-14 13:19 - 2015-03-04 03:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-03-04 03:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-14 13:19 - 2015-01-30 02:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-14 13:19 - 2014-11-14 08:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-14 13:17 - 2015-04-24 23:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-14 13:17 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-14 13:17 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-14 13:17 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-14 13:17 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-14 13:17 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-14 13:17 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-14 13:17 - 2015-04-21 18:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-14 13:17 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-14 13:17 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-14 13:17 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 18:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-14 13:17 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-14 13:17 - 2015-04-21 17:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-14 13:17 - 2015-04-21 17:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-14 13:17 - 2015-04-21 17:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-14 13:17 - 2015-04-21 17:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-05-14 13:17 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-14 13:17 - 2015-04-21 17:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-05-14 13:17 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-14 13:17 - 2015-04-21 17:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-05-14 13:17 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-14 13:17 - 2015-04-21 17:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-14 13:17 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-14 13:17 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-14 13:17 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-14 13:17 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-14 13:17 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-14 13:17 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-14 13:17 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-14 13:17 - 2015-04-14 00:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-14 13:17 - 2015-04-10 03:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-14 13:17 - 2015-04-10 02:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-14 13:17 - 2015-04-10 02:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-14 13:17 - 2015-04-09 00:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-14 13:17 - 2015-04-03 02:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-03 02:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-14 13:17 - 2015-04-02 00:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2015-05-14 13:17 - 2015-04-02 00:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2015-05-14 13:17 - 2015-04-01 05:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2015-05-14 13:17 - 2015-04-01 04:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2015-05-14 13:17 - 2015-03-30 07:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-14 13:17 - 2015-03-27 05:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-14 13:17 - 2015-03-27 04:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-14 13:17 - 2015-03-13 06:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-14 13:17 - 2015-03-13 06:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-14 13:17 - 2015-03-13 04:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-14 13:17 - 2015-03-13 03:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-05-14 13:17 - 2015-03-13 02:29 - 00410017 _____ () C:\Windows\system32\ApnDatabase.xml
2015-05-14 13:17 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-14 13:17 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-14 13:17 - 2015-03-06 05:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-14 13:17 - 2015-03-06 04:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-14 13:17 - 2015-03-06 04:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-14 13:17 - 2015-03-05 01:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-14 13:17 - 2015-02-18 01:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-05 18:27 - 2015-05-05 18:27 - 00014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel
2015-05-04 16:19 - 2015-05-04 16:19 - 00001310 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mcedit2.lnk
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Python-Eggs
2015-05-04 15:24 - 2015-05-04 15:24 - 00000000 ____D () C:\Program Files\mcedit2-win64-2.0.0alpha-232
2015-05-04 15:22 - 2015-05-04 15:23 - 29551850 _____ (Igor Pavlov) C:\Users\Chris\Downloads\mcedit2-win64-2.0.0alpha-232.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-28 17:07 - 2015-01-13 22:00 - 00000000 ____D () C:\Users\Chris
2015-05-28 17:07 - 2014-09-24 08:16 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-28 17:07 - 2014-09-24 07:43 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2015-05-28 17:07 - 2014-09-24 07:43 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2015-05-28 17:05 - 2013-08-22 16:46 - 00702669 _____ () C:\Windows\setupact.log
2015-05-28 17:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2015-05-28 16:49 - 2015-01-13 22:00 - 01917835 _____ () C:\Windows\WindowsUpdate.log
2015-05-28 16:44 - 2015-01-13 22:19 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2561094446-920685720-2640435214-1001
2015-05-28 16:39 - 2015-01-13 19:18 - 00000000 ___RD () C:\Users\Chris\Dropbox
2015-05-28 16:11 - 2015-02-09 14:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-28 15:44 - 2015-04-02 15:11 - 00000000 ____D () C:\Users\Chris\AppData\Local\CrashDumps
2015-05-28 15:44 - 2015-01-15 16:47 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-05-28 15:44 - 2015-01-13 22:00 - 00001764 _____ () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-28 15:44 - 2015-01-13 17:28 - 00001485 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-28 14:43 - 2015-01-13 19:14 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Dropbox
2015-05-28 14:43 - 2015-01-13 18:39 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Raptr
2015-05-28 14:42 - 2015-01-16 19:56 - 00000000 ____D () C:\Users\Chris\OneDrive
2015-05-28 14:42 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-28 00:11 - 2015-01-13 16:51 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2015-05-28 00:11 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-05-26 17:27 - 2015-04-27 14:42 - 00000000 ____D () C:\Users\Chris\Desktop\Ordner
2015-05-26 17:25 - 2015-01-13 19:51 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Guild Wars 2
2015-05-21 19:47 - 2015-01-29 17:14 - 00000000 ____D () C:\Users\Chris\Documents\Calibre-Bibliothek
2015-05-21 19:40 - 2015-01-15 16:18 - 00000000 ____D () C:\Users\Chris\Sonstiges
2015-05-21 17:50 - 2015-01-18 21:27 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\vlc
2015-05-21 16:02 - 2015-01-13 18:52 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-20 22:03 - 2015-01-26 15:12 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\TS3Client
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 17:40 - 2015-04-04 11:43 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 17:40 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-05-19 15:40 - 2015-01-13 18:39 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-05-19 15:38 - 2014-09-23 23:06 - 00048806 _____ () C:\Windows\PFRO.log
2015-05-17 19:17 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2015-05-17 12:48 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-05-17 11:26 - 2015-01-17 22:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-16 14:05 - 2015-02-08 04:32 - 504073285 _____ () C:\Windows\MEMORY.DMP
2015-05-16 14:05 - 2015-02-08 04:32 - 00000000 ____D () C:\Windows\Minidump
2015-05-16 11:10 - 2015-01-14 13:41 - 00000000 ____D () C:\Users\Chris\AppData\Local\Adobe
2015-05-16 11:09 - 2015-02-09 14:20 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-15 18:18 - 2013-08-22 16:44 - 00410048 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 23:42 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2015-05-14 23:42 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 13:22 - 2015-01-15 17:37 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-14 13:21 - 2014-09-24 08:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 17:27 - 2015-01-13 17:07 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 17:26 - 2015-01-13 17:07 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-09 13:03 - 2015-01-13 19:16 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 18:48 - 2015-01-25 13:57 - 00000000 ____D () C:\Users\Chris\Documents\Guild Wars 2
2015-05-05 19:59 - 2014-09-24 09:43 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-05 19:59 - 2014-09-24 09:43 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-05 18:43 - 2015-01-14 00:05 - 00000000 ____D () C:\Users\Chris\.gimp-2.8
2015-05-05 18:27 - 2015-01-16 02:25 - 00000000 ____D () C:\Users\Chris\AppData\Local\gtk-2.0
2015-04-29 18:44 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF

==================== Files in the root of some directories =======

2015-01-25 18:12 - 2015-01-25 18:12 - 0001248 _____ () C:\Users\Chris\AppData\Roaming\MIETPOSV
2015-01-25 18:12 - 2015-01-25 18:12 - 0002086 _____ () C:\Users\Chris\AppData\Roaming\SUS
2015-01-20 23:54 - 2015-01-20 23:54 - 0003584 _____ () C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-05-05 18:27 - 2015-05-05 18:27 - 0014053 _____ () C:\Users\Chris\AppData\Local\recently-used.xbel

Some files in TEMP:
====================
C:\Users\Chris\AppData\Local\Temp\1596.exe
C:\Users\Chris\AppData\Local\Temp\2024.exe
C:\Users\Chris\AppData\Local\Temp\2596.exe
C:\Users\Chris\AppData\Local\Temp\2908.exe
C:\Users\Chris\AppData\Local\Temp\3444.exe
C:\Users\Chris\AppData\Local\Temp\3668.exe
C:\Users\Chris\AppData\Local\Temp\3916.exe
C:\Users\Chris\AppData\Local\Temp\400.exe
C:\Users\Chris\AppData\Local\Temp\636.exe
C:\Users\Chris\AppData\Local\Temp\908.exe
C:\Users\Chris\AppData\Local\Temp\amd-catalyst-omega-14.12-without-dotnet45-win8.1-64bit.exe
C:\Users\Chris\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\Chris\AppData\Local\Temp\bitool.dll
C:\Users\Chris\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpg578xh.dll
C:\Users\Chris\AppData\Local\Temp\Gw2.exe
C:\Users\Chris\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Chris\AppData\Local\Temp\npp.6.7.4.Installer.exe
C:\Users\Chris\AppData\Local\Temp\ose00000.exe
C:\Users\Chris\AppData\Local\Temp\raptrpatch.exe
C:\Users\Chris\AppData\Local\Temp\raptr_stub.exe
C:\Users\Chris\AppData\Local\Temp\smt_mystartsearch.exe
C:\Users\Chris\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-27 19:15

==================== End of log ============================
Addition.txt
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-05-2015 01
Ran by Chris at 2015-05-28 17:09:29
Running from C:\Users\Chris\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2561094446-920685720-2640435214-500 - Administrator - Disabled)
Chris (S-1-5-21-2561094446-920685720-2640435214-1001 - Administrator - Enabled) => C:\Users\Chris
Gast (S-1-5-21-2561094446-920685720-2640435214-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) Hidden
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Alice: Madness Returns (HKLM-x32\...\Steam App 19680) (Version:  - Spicy Horse Games)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Brothers - A Tale of Two Sons (HKLM-x32\...\Steam App 225080) (Version:  - Starbreeze Studios AB)
calibre 64bit (HKLM\...\{07AAC4EC-6402-4375-AA46-D7FE1390FFBB}) (Version: 2.23.0 - Kovid Goyal)
Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dropbox (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse)
Gaming Mouse (HKLM-x32\...\Gaming Mouse 3) (Version:  - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GUILD WARS (HKLM-x32\...\Guild Wars) (Version:  - )
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Haskell Platform 2014.2.0.0 (HKLM\...\HaskellPlatform-2014.2.0.0) (Version:  - Haskell.org)
Haunt the House: Terrortown (HKLM-x32\...\Steam App 270630) (Version:  - SFB Games)
Inkscape 0.48.5 (HKLM-x32\...\Inkscape) (Version: 0.48.5 - )
Intel(R) Network Connections 19.0.27.0 (HKLM\...\PROSetDX) (Version: 19.0.27.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Last Dream (HKLM-x32\...\Steam App 266230) (Version:  - White Giant RPG Studios)
LEGO Lord of the Rings (HKLM-x32\...\Steam App 214510) (Version:  - Traveller's Tales)
LIMBO (HKLM-x32\...\Steam App 48000) (Version:  - Playdead)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Miranda IM (HKLM-x32\...\Miranda IM) (Version: 0.10.27 - Miranda IM Project)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
MyPaint 1.0.0 (HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\MyPaint) (Version: 1.0.0 - Martin Renold & MyPaint Development Team)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team)
Oblivion (HKLM-x32\...\{C66BF9FD-D367-4E13-8EB8-385FFEA20DB3}) (Version: 1.2.0416 - Bethesda Softworks)
Portal 2 (HKLM-x32\...\Steam App 620) (Version:  - Valve)
Raptr (HKLM-x32\...\Raptr) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Scribblenauts Unlimited (HKLM-x32\...\Steam App 218680) (Version:  - 5th Cell Media)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SimCity 4 Deluxe (HKLM-x32\...\Steam App 24780) (Version:  - EA - Maxis)
Space Engineers (HKLM-x32\...\Steam App 244850) (Version:  - Keen Software House)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Trine (HKLM-x32\...\Steam App 35700) (Version:  - Frozenbyte)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.5-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.98 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
Year Walk (HKLM-x32\...\Steam App 269050) (Version:  - Simogo)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2561094446-920685720-2640435214-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

13-05-2015 17:25:18 Windows Update
20-05-2015 17:39:40 Windows Update
28-05-2015 15:30:53 Geplanter Prüfpunkt

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {3B31EEB1-F47B-417C-9237-9BE14E6A860F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {44FC21B8-FDD7-46F8-89B5-F3FDDCDB3346} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {64C4FEA2-33D5-4C1C-A0C2-43402B8BA2E4} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {AB51F3E1-B437-4015-ABBF-2F8EA2BF25DE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-05-13] (Microsoft Corporation)
Task: {FC4A3A12-0FA7-4A91-B1BC-E23DE771F816} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-16] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-01-15 23:23 - 2014-08-19 21:12 - 01356568 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2009-09-30 03:05 - 2009-09-30 03:05 - 01306624 _____ () C:\Gaming Mouse\Gaming Mouse.exe
2010-11-23 00:56 - 2010-11-23 00:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd
2010-11-23 00:57 - 2010-11-23 00:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd
2014-05-14 01:26 - 2014-05-14 01:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd
2014-08-14 02:37 - 2014-08-14 02:37 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll
2013-11-21 02:05 - 2013-11-21 02:05 - 00256000 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll
2010-11-23 00:56 - 2010-11-23 00:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd
2010-11-23 00:56 - 2010-11-23 00:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd
2015-05-15 04:21 - 2015-05-15 04:21 - 02540288 _____ () C:\Program Files (x86)\Raptr\ltc_host_ex.DLL
2014-08-14 02:37 - 2014-08-14 02:37 - 00027667 _____ () C:\Program Files (x86)\Raptr\plugins\audio_output\libdirectsound_plugin.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 00031251 _____ () C:\Program Files (x86)\Raptr\plugins\audio_output\libwaveout_plugin.dll
2014-08-14 02:37 - 2014-08-14 02:37 - 00066579 _____ () C:\Program Files (x86)\Raptr\plugins\video_output\libdirectdraw_plugin.dll
2010-11-23 00:57 - 2010-11-23 00:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd
2014-06-18 02:56 - 2014-06-18 02:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd
2011-02-15 20:17 - 2011-02-15 20:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll
2010-11-23 01:06 - 2010-11-23 01:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll
2013-05-10 01:52 - 2013-05-10 01:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll
2013-05-03 20:56 - 2013-05-03 20:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll
2013-05-03 20:57 - 2013-05-03 20:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll
2015-05-28 15:45 - 2015-05-28 05:12 - 00612496 _____ () C:\Program Files (x86)\WinZipper\sqlite3.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Chris\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Chris\Desktop\Einspruch.MP3:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2561094446-920685720-2640435214-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Chris\Pictures\5bqde - Imgur.jpg
DNS Servers: 8.8.8.8 - 8.8.4.4

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "BCSSync"
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKU\S-1-5-21-2561094446-920685720-2640435214-1001\...\StartupApproved\Run: => "Steam"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [TCP Query User{322D338F-3F69-4D19-91B2-98AD8D2F66E6}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [UDP Query User{7467FFC5-13ED-4061-A2D7-80E229E2ECE8}C:\program files (x86)\miranda im\miranda32.exe] => (Allow) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [{CD5BD729-1D8B-40A5-9C8D-8BBBE80B0053}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{902F1FCF-C905-4954-A04A-18DA64E0C216}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{E9247673-E34E-418E-AFFA-F79E1011444F}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{3799BDDA-B04C-440A-8D24-9B930BF777A2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{877154DD-DEFC-4E7B-B449-F720EEDEDDF0}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{154A3DDE-D904-46AC-BAB1-D61A0F064308}] => (Allow) C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E2049D11-C7FA-4745-8F15-51F4D07F087C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{6893A4BC-E269-4D4B-9D90-9F896FE19801}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\BrothersLauncher.exe
FirewallRules: [{379F17D2-5FB3-4521-95D5-9C567EF33A57}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{4D2E4BD1-B0CA-4E9A-8A42-7340A6EC6572}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brothers - A Tale of Two Sons\Binaries\Win32\Brothers.exe
FirewallRules: [{D9928F33-DA6D-4C4A-98A2-6E0B2BAA41C3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe
FirewallRules: [{27F8199A-33E8-402C-9225-54D84E3F73F9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Haunt the House Terrortown\HauntTheHouseTerrortown.exe
FirewallRules: [{816EC679-99B5-4438-BCE9-334A11621A63}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe
FirewallRules: [{96D4B554-FA25-4BD6-9E4C-907C3A9E6439}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Last Dream\Game.exe
FirewallRules: [{19294CB7-8E9F-4A51-9F55-B769F7F02EA5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe
FirewallRules: [{2E511C23-453B-4A30-8071-3D145E4FA734}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\LEGO Lord of the Rings\LEGOLOTR.exe
FirewallRules: [{5498C18F-6E50-4F3E-9BC7-F56B8046A129}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe
FirewallRules: [{294DE233-9F93-427D-B6D5-CAC22F7D6491}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Limbo\limbo.exe
FirewallRules: [{4E876F61-CD82-43AD-A0EB-5C3C8C00C754}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{B66AA9F3-0B18-4B26-A35C-327305A98854}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Scribblenauts\Scribble.exe
FirewallRules: [{09F0E349-47E1-4D97-BFFD-295E5215BC33}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe
FirewallRules: [{78DAF125-C3DF-4DE4-8B69-C150D18AA57E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SimCity 4 Deluxe\Apps\SimCity 4.exe
FirewallRules: [{D712E4A0-3235-48B5-8D8F-3DE2F1B13082}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe
FirewallRules: [{2280B3F1-D7E3-4C66-A3E5-B084980ED531}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SpaceEngineers\Bin64\SpaceEngineers.exe
FirewallRules: [{19FDCE86-5026-4DBB-8CEF-8C6EE0D3E7E7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe
FirewallRules: [{46AFD520-3A5F-4572-82D8-2B344310FF89}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Trine\_enchanted_edition_\trine1_launcher.exe
FirewallRules: [{7BBA4820-6639-4C99-8805-AD6D31B9127E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe
FirewallRules: [{C52420D8-C425-4265-B126-B598AA9B60B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\YearWalk\yearwalk.exe
FirewallRules: [{88A0629B-21E2-4A36-83DA-E9E70AC76FDE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe
FirewallRules: [{517471F5-35C3-4DD6-A63B-DAB9CD75EF07}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Alice Madness Returns\Binaries\Win32\AliceMadnessReturns.exe
FirewallRules: [TCP Query User{AA2BBCE6-E12C-400A-83EF-FF3E7701D621}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{3E78BDD4-25B8-4566-B8B9-18709F4028DD}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{03674CEF-6239-4211-9039-EBB745833368}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{1C75413F-589C-4E66-8633-30CD01442470}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\witcher.exe
FirewallRules: [{3F9E6F76-1128-4746-8599-75137446F34E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{3FC52BCC-077F-4E1E-8FA2-9A598D74CC67}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\System\djinni!.exe
FirewallRules: [{1DC78FE1-4B23-4E4D-82CE-B75861196C9E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [{62C5B64B-1CC7-4CF1-9D2B-F03C436CC1BC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher Enhanced Edition\Digital Comic\DigitalComic.exe
FirewallRules: [TCP Query User{9B614EE6-93D1-48EF-BBC4-0E8CE89FFF69}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{C9E21A59-E878-4E12-881F-11F712B919A4}C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\chris\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{7C5D5258-9C17-4A92-BBF2-84565B7E6366}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe
FirewallRules: [UDP Query User{93FF9520-49E1-4AE4-91D1-AB2390948071}C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe] => (Block) C:\users\chris\appdata\local\temp\a3eb.tmp\kmservice.exe
FirewallRules: [TCP Query User{CAE61E69-ECD6-499B-B972-3F17D64BE7F9}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [UDP Query User{C1E17F90-50BF-455B-85E4-5AA8AEFDD4B1}C:\program files (x86)\miranda im\miranda32.exe] => (Block) C:\program files (x86)\miranda im\miranda32.exe
FirewallRules: [{39CAB1CE-111D-4EEB-9922-D286346B5B54}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE91AB11-0C2A-4865-99D5-9DB98C210BD3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BEDF15BF-34AE-4C4B-899A-0C114093F18F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{6534B34D-8D9D-4FD5-8243-D850B1301A6A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{0014F327-77C4-410F-B503-C0EE1A98128D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{F5E10FBA-9FFE-40A6-9748-4E15BAA0B235}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe
FirewallRules: [TCP Query User{78EBCDE1-06B4-49A3-9CE4-460A1C9EBCE1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{312E7875-7410-40E2-A996-5892C596D2D1}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{43FF6593-4E26-42DA-8D41-C265630F4EE6}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{B71851F8-4C88-44A3-9727-1569678021E0}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{04CEAA9D-C4CE-4EAA-94B4-80AD6040B8EF}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{BD96691E-F3FF-4475-9EB0-0EC9D657B660}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

==================== Faulty Device Manager Devices =============

Name: Qualcomm Atheros AR9485-Funknetzwerkadapter
Description: Qualcomm Atheros AR9485-Funknetzwerkadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2
Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0xb94
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2
Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5

Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe, Version: 17.0.0.188, Zeitstempel: 0x553ba7a2
Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000142
Fehleroffset: 0x0009d4f2
ID des fehlerhaften Prozesses: 0x4ec
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_17_0_0_188.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_17_0_0_188.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_17_0_0_188.exe2
Berichtskennung: FlashPlayerPlugin_17_0_0_188.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_17_0_0_188.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_17_0_0_188.exe5

Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x298
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifest.

Error: (05/27/2015 07:15:16 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "System-reserviert" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)

Error: (05/27/2015 05:30:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Name des fehlerhaften Moduls: igfxCUIService.exe, Version: 6.15.10.3960, Zeitstempel: 0x54299ab0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000012bb8
ID des fehlerhaften Prozesses: 0x22c
Startzeit der fehlerhaften Anwendung: 0xigfxCUIService.exe0
Pfad der fehlerhaften Anwendung: igfxCUIService.exe1
Pfad des fehlerhaften Moduls: igfxCUIService.exe2
Berichtskennung: igfxCUIService.exe3
Vollständiger Name des fehlerhaften Pakets: igfxCUIService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: igfxCUIService.exe5

Error: (05/26/2015 10:36:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm wmplayer.exe, Version 12.0.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 82c

Startzeit: 01d097f3adc3daad

Endzeit: 5

Anwendungspfad: C:\Program Files (x86)\Windows Media Player\wmplayer.exe

Berichts-ID: efcbddb5-03e6-11e5-828f-d0509942e1d9

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


System errors:
=============
Error: (05/28/2015 02:42:40 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/28/2015 02:42:36 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/27/2015 05:30:38 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/27/2015 05:30:34 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/26/2015 02:18:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/26/2015 02:18:01 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/26/2015 01:19:09 AM) (Source: DCOM) (EventID: 10010) (User: TOWER-POWER)
Description: {1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}

Error: (05/25/2015 02:07:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037

Error: (05/25/2015 02:07:16 PM) (Source: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv) (EventID: 10) (User: NT-AUTORITÄT)
Description: A TCG Command has returned an error.
Desc: AuthenticateSession
Param1: 0x1
Param2: 0x60000001c
Param3: 0x900000006
Param4: 0x0
Status: 0x1

Error: (05/24/2015 11:45:16 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) HD Graphics Control Panel Service" wurde mit folgendem Fehler beendet: 
%%2147500037


Microsoft Office:
=========================
Error: (05/28/2015 03:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f2b9401d0994c6ea4f553C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dllac52d525-053f-11e5-8291-d0509942e1d9

Error: (05/28/2015 03:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_17_0_0_188.exe17.0.0.188553ba7a2USER32.dll6.3.9600.17736550f42c2c00001420009d4f24ec01d0994c67446510C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_188.exeUSER32.dlla4f53663-053f-11e5-8291-d0509942e1d9

Error: (05/28/2015 03:30:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert

Error: (05/28/2015 03:28:19 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/28/2015 03:26:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/28/2015 02:42:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb829801d09943c85890f5C:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe06a27806-0537-11e5-8291-d0509942e1d9

Error: (05/27/2015 07:16:05 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_a9f497a901334c74.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17784_none_624760d1ecb7236e.manifestC:\Program Files (x86)\Miranda IM\dbtool.exe

Error: (05/27/2015 07:15:16 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: System-reserviertFalscher Parameter. (0x80070057)

Error: (05/27/2015 05:30:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: igfxCUIService.exe6.15.10.396054299ab0igfxCUIService.exe6.15.10.396054299ab0c00000050000000000012bb822c01d0989214db483cC:\Windows\system32\igfxCUIService.exeC:\Windows\system32\igfxCUIService.exe5322cd8b-0485-11e5-8290-d0509942e1d9

Error: (05/26/2015 10:36:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: wmplayer.exe12.0.9600.1741582c01d097f3adc3daad5C:\Program Files (x86)\Windows Media Player\wmplayer.exeefcbddb5-03e6-11e5-828f-d0509942e1d9


CodeIntegrity Errors:
===================================
  Date: 2015-05-28 15:26:09.740
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-27 19:15:22.546
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-26 14:45:18.011
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-25 14:17:25.800
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-24 13:54:52.200
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-23 15:26:44.317
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-22 14:44:37.500
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-20 10:40:37.550
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-19 18:24:36.091
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-05-18 18:25:52.835
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4460 CPU @ 3.20GHz
Percentage of memory in use: 18%
Total physical RAM: 8127.11 MB
Available physical RAM: 6641.2 MB
Total Pagefile: 16319.11 MB
Available Pagefile: 14286.29 MB
Total Virtual: 131072 MB
Available Virtual: 131071.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.13 GB) (Free:86.3 GB) NTFS
Drive e: (USB-STICK) (Removable) (Total:0.95 GB) (Free:0.94 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 37832B8A)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 972 MB) (Disk ID: 000DAD2F)
Partition 1: (Active) - (Size=972 MB) - (Type=0B)

==================== End of log ============================
GMER.txt
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-28 17:20:04
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002a Crucial_CT256MX100SSD1 rev.MU01 238,47GB
Running: q3c7d44r.exe; Driver: C:\Users\Chris\AppData\Local\Temp\kglyaaow.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                                                                                                fffff960001bb900 15 bytes [00, 57, F4, 01, 40, 8F, 6E, ...]
.text    C:\Windows\System32\win32k.sys!W32pServiceTable + 16                                                                                                                                                                           fffff960001bb910 11 bytes [00, 41, FC, FF, 00, 79, C7, ...]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [572:3164]                                                                                                                                                                                       fffff960008b22d0
---- Processes - GMER 2.1 ----

Process  C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [2840] (Windows SysTool  Svr/SysTool PasSame LIMITED)(2015-01-15 14:47:57)  00000000000d0000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}\Connection@Name                                                                                    isatap.{2D5FC48A-55F6-4052-ABDF-159A06A20D32}
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                                                                                                              -405932739
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@InterfaceName                                                                                                         isatap.{2D5FC48A-55F6-4052-ABDF-159A06A20D32}
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@ReusableType                                                                                                          0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{CB834AF5-B80F-4B50-BC64-B9398BAD5480}@DefunctTimestamp                                                                                                      0x40 0x0D 0x67 0x55 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                                                                                                                2721
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                                                                                                               813
Reg      HKLM\SYSTEM\CurrentControlSet\Services\WpdUpFltr\Parameters\Wdf@TimeOfLastSqmLog                                                                                                                                               0x95 0x6B 0x0E 0x31 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Run@DAEMON Tools Lite                                                                                                                                                           "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

---- EOF - GMER 2.1 ----
MFG
Scree

 

Themen zu Winzipper und delta homes
.dll, adware, browser, cpu, defender, error, explorer, firefox, flash player, frage, ftp, helper, home, homepage, iexplore.exe, internet, launch, mozilla, nemesis, newtab, port, realtek, registry, security, software, system, tablet, udp, windows


« Win7: Erscheinen neuer Ordner bestehend aus Buchstaben- und Zahlenkombination. Virus? | Pop Ups und Weiterleitung zu Werbeseiten, schadsoftware installiert durch streaming software, Widerherstellung nicht möglich. »


Ähnliche Themen: Winzipper und delta homes


  1. Delta-Homes.com redirect entfernen
    Anleitungen, FAQs & Links - 11.10.2015 (2)
  2. delta-homes
    Plagegeister aller Art und deren Bekämpfung - 24.08.2015 (22)
  3. delta-homes browser hijacker geht nicht weg
    Log-Analyse und Auswertung - 19.06.2015 (3)
  4. delta-homes als Startseite
    Log-Analyse und Auswertung - 04.06.2015 (19)
  5. Windows 8.1: Adware (delta-homes) und SpyHunter entfernen
    Plagegeister aller Art und deren Bekämpfung - 28.05.2015 (9)
  6. Picexa.exe / Suchanbieter in Browsern verändert (Delta-Homes)
    Log-Analyse und Auswertung - 26.05.2015 (15)
  7. Delta Homes, noch nicht Entfernt.
    Plagegeister aller Art und deren Bekämpfung - 30.03.2015 (7)
  8. Delta-Homes lässt sich nicht entfernen
    Plagegeister aller Art und deren Bekämpfung - 19.01.2015 (4)
  9. DELTA- Homes geht net weg
    Plagegeister aller Art und deren Bekämpfung - 22.12.2014 (13)
  10. Delta-homes hijack
    Plagegeister aller Art und deren Bekämpfung - 17.12.2014 (9)
  11. Den Trojaner Delta Homes von meinem PC entfernen
    Log-Analyse und Auswertung - 02.04.2014 (13)
  12. Delta-Homes bzw. QV06 in IE, FF und Chrome
    Plagegeister aller Art und deren Bekämpfung - 14.12.2013 (9)
  13. Delta-Homes im Firefox nicht zu entfernen
    Log-Analyse und Auswertung - 27.10.2013 (4)
  14. Delta Homes wie bekomme ich es weg?
    Plagegeister aller Art und deren Bekämpfung - 25.08.2013 (5)
  15. Firefox: Delta Homes
    Plagegeister aller Art und deren Bekämpfung - 11.07.2013 (13)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Winzipper und delta homes - Hi, auf dem PC meiner Freundin war heute spontan die Startseite in Firefox verstellt auf delta-homes.com. Ein Blick in die installieren Programme zeigte, dass sich heute eine Software namens Winzipper - Winzipper und delta homes...
Archiv
Du betrachtest: Winzipper und delta homes auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131