Malware Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 03.10.2014
Suchlauf-Zeit: 11:53:37
Logdatei: mbam.txt
Administrator: Ja
Version: 2.00.2.1012
Malware Datenbank: v2014.10.03.01
Rootkit Datenbank: v2014.09.19.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Marcus
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 381636
Verstrichene Zeit: 31 Min, 43 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 10
PUP.Optional.Wajam.A, HKLM\SOFTWARE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, In Quarantäne, [d4797e92027a989ed22d3c918d75ab55],
PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, In Quarantäne, [d4797e92027a989ed22d3c918d75ab55],
PUP.Optional.Snapdo.T, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, Löschen bei Neustart, [1a33ab654b314fe7722d05cba161bf41],
PUP.Optional.Snapdo.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, In Quarantäne, [1a33ab654b314fe7722d05cba161bf41],
PUP.Optional.Wajam.A, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, Löschen bei Neustart, [e8650808e19b95a1f895257521e1bd43],
PUP.Optional.SettingsManager.A, HKLM\SOFTWARE\WOW6432NODE\SmdmF, In Quarantäne, [e16c2fe1a9d31f1726abba59f90a0000],
PUP.Optional.FastSearchings, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}, In Quarantäne, [d6774bc5621a80b63b9047321ee6e31d],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, Löschen bei Neustart, [e16ca16f91eb77bf3c90350cc63d629e],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, Löschen bei Neustart, [6ae365ab7804f640ad7b65f38480f010],
PUP.Optional.Softonic.A, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Löschen bei Neustart, [ff4e8f814c30ec4a5aada190a55e17e9],
Registrierungswerte: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, zr2X2X1G1S1F2V1S2Q0V, Löschen bei Neustart, [6ae365ab7804f640ad7b65f38480f010]
Registrierungsdaten: 4
PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=CH&userid=fbf7d233-3c78-4029-bd62-577ffed084e2&searchtype=ds&q={searchTerms}&installDate=01/01/1970, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=CH&userid=fbf7d233-3c78-4029-bd62-577ffed084e2&searchtype=ds&q={searchTerms}&installDate=01/01/1970),Ersetzt,[f558d23ef7851d1972eb6a9de025ad53]
PUP.Optional.DefaultSearch.A, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.default-search.net?sid=476&aid=196&itype=n&ver=13892&tm=486&src=hmp, Gut: (www.google.com), Schlecht: (hxxp://www.default-search.net?sid=476&aid=196&itype=n&ver=13892&tm=486&src=hmp),Löschen bei Neustart,[490451bf8def60d6497442c4ad5852ae]
PUP.Optional.Snapdo, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=CH&userid=fbf7d233-3c78-4029-bd62-577ffed084e2&searchtype=ds&q={searchTerms}&installDate=, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=CH&userid=fbf7d233-3c78-4029-bd62-577ffed084e2&searchtype=ds&q={searchTerms}&installDate=),Löschen bei Neustart,[cb82a96723592a0c913037d99c69847c]
PUP.Optional.Snapdo, HKU\S-1-5-21-4239641482-3143192181-4160799578-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=CH&userid=fbf7d233-3c78-4029-bd62-577ffed084e2&searchtype=ds&q={searchTerms}&installDate=, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=CH&userid=fbf7d233-3c78-4029-bd62-577ffed084e2&searchtype=ds&q={searchTerms}&installDate=),Löschen bei Neustart,[b19cf818d7a5191d82404cc4788d728e]
Ordner: 14
PUP.Optional.SpeedTestAnalysis.A, C:\Users\Marcus\AppData\Roaming\SpeedTestAnalysis, In Quarantäne, [c984050b96e6c86ec8a1f34cbd461be5],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\0659281FEAE04687905E3B15C36E60AB, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\09C4BED447E84E9AA56C0B7C5F574D3E, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\22F1067C71514BF18488F65C1EA5BDEE, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\5AF7F8B80FFD438BA0908E8577B0585E, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\C5453612962A409DA26336F4D1FFCD9E, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\F4D5527661354E849C56495D0EF56918, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.NextLive.A, C:\Users\Marcus\AppData\Roaming\newnext.me, In Quarantäne, [410c8f81bdbf80b6f449756dd82ad52b],
PUP.Optional.NextLive.A, C:\Users\Marcus\AppData\Roaming\newnext.me\cache, In Quarantäne, [410c8f81bdbf80b6f449756dd82ad52b],
PUP.Optional.IBUpdater.A, C:\ProgramData\IBUpdaterService, In Quarantäne, [58f5d13f81fba294f876758809f94fb1],
PUP.Optional.Updater.A, C:\Users\Marcus\AppData\Roaming\DSite\UpdateProc, In Quarantäne, [04499e72ea92fc3a66d7c539ad55926e],
PUP.Optional.ContinueToSave.A, C:\Program Files (x86)\ContinueToSave, In Quarantäne, [be8f0907fd7fa4923a05c33b43bf34cc],
PUP.Optional.BrowserSystemEnahncer.A, C:\ProgramData\Browser System Enahncer, In Quarantäne, [67e6ab654e2e2a0cdbc2a958788b54ac],
Dateien: 27
PUP.Optional.NextLive.A, C:\Program Files (x86)\Mobogenie\nengine.dll, In Quarantäne, [3e0f9b75a2da04325c8fa4c244bdc937],
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, In Quarantäne, [57f6d7395f1d55e1ef19f32e847c22de],
PUP.Optional.Solimba, C:\Users\Marcus\Downloads\WhatsApp (1).exe, In Quarantäne, [6be2ce42abd1fe38c7a086436c9533cd],
PUP.Optional.Solimba, C:\Users\Marcus\Downloads\WhatsApp.exe, In Quarantäne, [b499858b700c072f2542676245bc51af],
PUP.Optional.Softonic, C:\Users\Marcus\Downloads\SoftonicDownloader_for_icesword.exe, In Quarantäne, [c6875cb42557c6705554407936cb8080],
PUP.Optional.Softonic, C:\Users\Marcus\Downloads\SoftonicDownloader_fuer_icesword.exe, In Quarantäne, [cd80ff11dd9fcd69beebdcdd6e932ad6],
PUP.Optional.NextLive.A, C:\Users\Marcus\AppData\Local\genienext\nengine.dll, In Quarantäne, [ba933dd3bcc0f640618a2640d72ab24e],
PUP.Optional.Superfish.A, C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Löschen bei Neustart, [db72c34d720a37ff5f8c2009bb48b947],
PUP.Optional.Superfish.A, C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, In Quarantäne, [90bd2ee2631976c0dd0efa2fe51e7d83],
PUP.Optional.Softonic.A, C:\Users\Marcus\AppData\Roaming\Mozilla\Firefox\Profiles\5xnt640u.default\searchplugins\softonic.xml, In Quarantäne, [a4a9759b502cf3437792d55f05fe817f],
PUP.Optional.SpeedTestAnalysis.A, C:\Users\Marcus\AppData\Roaming\SpeedTestAnalysis\speedtestanalysis.crx, In Quarantäne, [c984050b96e6c86ec8a1f34cbd461be5],
PUP.Optional.SpeedTestAnalysis.A, C:\Users\Marcus\AppData\Roaming\SpeedTestAnalysis\DeskTopIcon.ico, In Quarantäne, [c984050b96e6c86ec8a1f34cbd461be5],
PUP.Optional.SpeedTestAnalysis.A, C:\Users\Marcus\AppData\Roaming\SpeedTestAnalysis\install_helper.exe, In Quarantäne, [c984050b96e6c86ec8a1f34cbd461be5],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\0659281FEAE04687905E3B15C36E60AB\chrometest.html, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\09C4BED447E84E9AA56C0B7C5F574D3E\chrometest.html, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\22F1067C71514BF18488F65C1EA5BDEE\OptimizerPro.exe, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\5AF7F8B80FFD438BA0908E8577B0585E\3705.ico, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\5AF7F8B80FFD438BA0908E8577B0585E\EBB77268-338F-4C6A-8590-AD88FED26F4A, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\5AF7F8B80FFD438BA0908E8577B0585E\Installer.exe, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\5AF7F8B80FFD438BA0908E8577B0585E\OCBrowserHelper_1.0.6.128.exe, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\C5453612962A409DA26336F4D1FFCD9E\TuneUpUtilities2013-2200212_de-DE.exe, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.OpenCandy, C:\Users\Marcus\AppData\Roaming\OpenCandy\F4D5527661354E849C56495D0EF56918\Trial-14.0.1000.89_de-DE_1004743_CH-DE-1.exe, In Quarantäne, [91bc9080dba1cf676d2abf2159a9c739],
PUP.Optional.NextLive.A, C:\Users\Marcus\AppData\Roaming\newnext.me\nengine.cookie, In Quarantäne, [410c8f81bdbf80b6f449756dd82ad52b],
PUP.Optional.NextLive.A, C:\Users\Marcus\AppData\Roaming\newnext.me\cache\spark.bin, In Quarantäne, [410c8f81bdbf80b6f449756dd82ad52b],
PUP.Optional.IBUpdater.A, C:\ProgramData\IBUpdaterService\repository.xml, In Quarantäne, [58f5d13f81fba294f876758809f94fb1],
PUP.Optional.Updater.A, C:\Users\Marcus\AppData\Roaming\DSite\UpdateProc\config.dat, In Quarantäne, [04499e72ea92fc3a66d7c539ad55926e],
PUP.Optional.Updater.A, C:\Users\Marcus\AppData\Roaming\DSite\UpdateProc\TTL.DAT, In Quarantäne, [04499e72ea92fc3a66d7c539ad55926e],
Physische Sektoren: 0
(No malicious items detected)
(end)
AdwCleaner Code:
# AdwCleaner v3.311 - Bericht erstellt am 03/10/2014 um 12:48:24
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Marcus - MARCUS-PC
# Gestartet von : C:\Users\Marcus\Desktop\AdwCleaner_3.311.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : 671c50b0
[#] Dienst Gelöscht : 70e6ca8c
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\ApptoU
Ordner Gelöscht : C:\ProgramData\StarApp
Ordner Gelöscht : C:\ProgramData\EnjjOyCoiupoN
Ordner Gelöscht : C:\ProgramData\PngToPPPTCoNverrt
Ordner Gelöscht : C:\ProgramData\UTuBereAdBLoocker
Ordner Gelöscht : C:\Program Files (x86)\ApptoU
Ordner Gelöscht : C:\Program Files (x86)\Mobogenie
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Users\Marcus\AppData\Local\genienext
Ordner Gelöscht : C:\Users\Marcus\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Marcus\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Marcus\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Marcus\AppData\Roaming\NCdownloader
Ordner Gelöscht : C:\Users\Marcus\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Marcus\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Marcus\Documents\Optimizer Pro
Ordner Gelöscht : C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\enfnjopdddpgbakkicgjagacfalhdjjj
Datei Gelöscht : C:\Users\Marcus\daemonprocess.txt
Datei Gelöscht : C:\Users\Marcus\AppData\Roaming\Mozilla\Firefox\Profiles\5xnt640u.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\EExstraCOupoun.EExstraCOupoun
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\EExstraCOupoun.EExstraCOupoun.4.3
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_k-lite-codec-pack_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_k-lite-codec-pack_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_microsoft-security-essentials_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_microsoft-security-essentials_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8EB4687F-BF15-D71A-2076-E9795515173B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8EB4687F-BF15-D71A-2076-E9795515173B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8EB4687F-BF15-D71A-2076-E9795515173B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\Linkey
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Schlüssel Gelöscht : HKLM\SOFTWARE\SP Global
Schlüssel Gelöscht : HKLM\SOFTWARE\SProtector
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
-\\ Mozilla Firefox v
[ Datei : C:\Users\Marcus\AppData\Roaming\Mozilla\Firefox\Profiles\5xnt640u.default\prefs.js ]
-\\ Google Chrome v31.0.1650.63
[ Datei : C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Extension] : enfnjopdddpgbakkicgjagacfalhdjjj
*************************
AdwCleaner[R0].txt - [6899 octets] - [03/10/2014 12:34:48]
AdwCleaner[S0].txt - [6376 octets] - [03/10/2014 12:48:24]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6436 octets] ##########
JRT Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.7 (10.03.2014:1)
OS: Windows 7 Home Premium x64
Ran by Marcus on 03.10.2014 at 12:58:24.65
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1-8-21-14_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Softonic_chr_1-8-21-14_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Softonic_chr_1-8-21-14_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Softonic_chr_1-8-21-14_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B5F78095-7ABA-4E2D-A346-C97801164461}
~~~ Files
Successfully deleted: [File] "C:\Users\Marcus\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage"
Successfully deleted: [File] "C:\Users\Marcus\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage-journal"
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.10.2014 at 13:05:11.84
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2014
Ran by Marcus (administrator) on MARCUS-PC on 03-10-2014 13:12:36
Running from C:\Users\Marcus\Downloads
Loaded Profile: Marcus (Available profiles: Marcus)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Avid Technology, Inc.) C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorDbEngine.exe
(Avid Technology, Inc.) C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorDbEngine.exe
(Avid Technology, Inc.) C:\Program Files\Avid\Editor Transcode\TranscodeService\rnc-central\AvidEditorTranscodeStatus.exe
(Avid Technology, Inc.) C:\Program Files\Avid\Editor Transcode\TranscodeService\rnc-central\AvidEditorTranscodeStatus.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files\Autodesk\3ds Max Design 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avid Technology, Inc.) C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorMSE.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avid Technology, Inc.) C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorMSE.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avanquest Software) C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe
HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1021056 2012-03-08] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800896 2012-03-08] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2886416 2012-03-02] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM\...\Run: [InstantUpdate] => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-06] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [OOTag] => C:\Program Files (x86)\Acer\OOBEOffer\OOTag.exe [13856 2010-02-23] (Microsoft)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-24] (Dritek System Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-4239641482-3143192181-4160799578-1000\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [467680 2014-07-30] (Sony)
HKU\S-1-5-21-4239641482-3143192181-4160799578-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
Startup: C:\Users\Marcus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [{6570C58B-C08B-46AD-AA82-2369B0D1B627}] -> MacDrive volume icons => No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x23EDDEFD923FCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Marcus\AppData\Roaming\Mozilla\Firefox\Profiles\5xnt640u.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Extension: No Name - C:\Program Files\Nightly\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
Chrome:
=======
CHR HomePage: Default ->
CHR DefaultSearchKeyword: Default -> default-search.net
CHR DefaultSearchProvider: Default -> default-search.net
CHR DefaultSearchURL: Default -> hxxp://www.default-search.net/search?sid=476&aid=196&itype=n&ver=13892&tm=486&src=ds&p={searchTerms}
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-01]
CHR Extension: (Google Drive) - C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-01]
CHR Extension: (YouTube) - C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-01]
CHR Extension: (Google-Suche) - C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-01]
CHR Extension: (PngToPPPTCoNverrt) - C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\enfnjopdddpgbakkicgjagacfalhdjjj [2014-10-01]
CHR Extension: (Google Wallet) - C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (Google Mail) - C:\Users\Marcus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-01]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
S3 Avid DMF Service; C:\Program Files\Avid\Editor Transcode\Dynamic Media Files\DMFService.exe [661832 2013-12-15] (Avid Technology, Inc.)
R2 Avid Editor Broker; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorMSE.exe [662344 2013-12-15] (Avid Technology, Inc.)
R2 Avid Editor Db Engine; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorDbEngine.exe [661832 2013-12-15] (Avid Technology, Inc.)
S3 Avid Editor Transcode Service; C:\Program Files\Avid\Editor Transcode\TranscodeService\AvidEditorTranscode.exe [662344 2013-12-15] (Avid Technology, Inc.)
R2 Avid Editor Transcode Status; C:\Program Files\Avid\Editor Transcode\TranscodeService\rnc-central\AvidEditorTranscodeStatus.exe [297800 2013-12-15] (Avid Technology, Inc.)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-16] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 mi-raysat_3dsmax2013_64; C:\Program Files\Autodesk\3ds Max Design 2013\NVIDIA\raysat_3dsmax2013_64server.exe [86016 2011-09-15] () [File not signed]
R2 mi-raysat_3dsmax2014_64; C:\Program Files\Autodesk\3ds Max Design 2014\NVIDIA\Satellite\raysat_3dsmax2014_64server.exe [86016 2011-09-15] () [File not signed]
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2014-01-15] (The OpenVPN Project)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-26] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-06-30] (Sony Mobile Communications)
S3 iLokDrvr; C:\Windows\System32\DRIVERS\iLokDrvr.sys [25808 2013-04-11] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-10-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R0 MDFSYSNT; C:\Windows\System32\Drivers\MDFSYSNT.sys [306280 2010-05-18] (Mediafour Corporation)
R0 MDPMGRNT; C:\Windows\System32\DRIVERS\MDPMGRNT.SYS [32352 2010-05-05] (Mediafour Corporation)
S2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-03 13:12 - 2014-10-03 13:12 - 00000000 ____D () C:\Users\Marcus\Downloads\FRST-OlderVersion
2014-10-03 13:10 - 2014-10-03 13:10 - 00011397 _____ () C:\Users\Marcus\Desktop\mbam.txt
2014-10-03 13:05 - 2014-10-03 13:05 - 00001563 _____ () C:\Users\Marcus\Desktop\JRT.txt
2014-10-03 12:58 - 2014-10-03 12:58 - 00000000 ____D () C:\Windows\ERUNT
2014-10-03 12:52 - 2014-10-03 12:52 - 01702068 _____ (Thisisu) C:\Users\Marcus\Downloads\JRT.exe
2014-10-03 12:51 - 2014-10-03 12:51 - 00000000 ___RD () C:\Users\Marcus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-10-03 12:30 - 2014-10-03 12:49 - 00012946 _____ () C:\Windows\PFRO.log
2014-10-03 12:30 - 2014-10-03 12:49 - 00000112 _____ () C:\Windows\setupact.log
2014-10-03 12:30 - 2014-10-03 12:30 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-03 12:28 - 2014-10-03 12:28 - 00011418 _____ () C:\Users\Marcus\Desktop\Malwarebytes Anti-Malware.txt
2014-10-03 12:02 - 2014-10-03 12:48 - 00000000 ____D () C:\AdwCleaner
2014-10-03 11:57 - 2014-10-03 11:57 - 01375089 _____ () C:\Users\Marcus\Desktop\AdwCleaner_3.311.exe
2014-10-03 11:43 - 2014-10-03 12:55 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-03 11:43 - 2014-10-03 11:43 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-03 11:42 - 2014-10-03 11:43 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-03 11:42 - 2014-10-03 11:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-03 11:42 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-03 11:42 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-03 11:42 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-03 11:40 - 2014-10-03 11:40 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Marcus\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-01 23:06 - 2014-10-01 23:06 - 00032632 _____ () C:\ComboFix.txt
2014-10-01 22:40 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-01 22:40 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-01 22:40 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-01 22:40 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-01 22:40 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-01 22:40 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-01 22:40 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-01 22:40 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-01 22:27 - 2014-10-01 23:06 - 00000000 ____D () C:\Qoobox
2014-10-01 22:26 - 2014-10-01 23:03 - 00000000 ____D () C:\Windows\erdnt
2014-10-01 22:25 - 2014-10-01 22:25 - 05582345 ____R (Swearware) C:\Users\Marcus\Downloads\ComboFix.exe
2014-10-01 22:19 - 2014-10-01 22:19 - 00001272 _____ () C:\Users\Marcus\Desktop\Revo Uninstaller.lnk
2014-10-01 22:19 - 2014-10-01 22:19 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-01 22:18 - 2014-10-01 22:18 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Marcus\Downloads\revosetup95.exe
2014-10-01 21:28 - 2014-10-01 21:28 - 00047654 _____ () C:\Users\Marcus\Desktop\Addition.txt
2014-10-01 21:28 - 2014-10-01 21:28 - 00043900 _____ () C:\Users\Marcus\Desktop\FRST.txt
2014-10-01 21:27 - 2014-10-01 21:27 - 00002308 _____ () C:\Users\Marcus\Desktop\Gmer.txt
2014-10-01 19:48 - 2014-10-01 19:48 - 00000474 _____ () C:\Users\Marcus\Desktop\defogger_disable.log
2014-10-01 19:48 - 2014-10-01 19:48 - 00000000 _____ () C:\Users\Marcus\defogger_reenable
2014-10-01 19:47 - 2014-10-01 19:47 - 00050477 _____ () C:\Users\Marcus\Downloads\Defogger.exe
2014-10-01 19:37 - 2014-10-01 19:39 - 00047654 _____ () C:\Users\Marcus\Downloads\Addition.txt
2014-10-01 19:34 - 2014-10-03 13:12 - 00019742 _____ () C:\Users\Marcus\Downloads\FRST.txt
2014-10-01 19:34 - 2014-10-03 13:12 - 00000000 ____D () C:\FRST
2014-10-01 19:33 - 2014-10-03 13:12 - 02109440 _____ (Farbar) C:\Users\Marcus\Downloads\FRST64.exe
2014-09-30 21:39 - 2014-09-30 21:39 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-09-30 21:06 - 2014-09-30 21:06 - 00003132 _____ () C:\Windows\System32\Tasks\{08D56809-F327-41EE-A3F4-A20935B178CB}
2014-09-30 21:06 - 2007-07-10 16:26 - 00000000 ____D () C:\Users\Marcus\Downloads\IceSword122en
2014-09-30 21:05 - 2014-09-30 21:05 - 00000260 _____ () C:\Users\Marcus\Downloads\fsbl-20140930190551.log
2014-09-30 20:42 - 2014-09-30 20:42 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-09-30 20:24 - 2014-09-30 20:28 - 158754488 _____ () C:\Users\Marcus\Downloads\setup_11.0.3.7.x01_2014_09_30_20_26.exe
2014-09-30 20:19 - 2014-09-30 20:19 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Marcus\Downloads\tdsskiller.exe
2014-09-30 20:11 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 20:11 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-30 15:08 - 2014-10-01 22:38 - 00001141 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-30 15:06 - 2014-09-30 15:06 - 04714656 _____ (Avira Operations GmbH & Co. KG) C:\Users\Marcus\Downloads\avira_de_av_4329448084__ws.exe
2014-09-30 14:52 - 2014-09-30 14:52 - 00735496 _____ ( ) C:\Users\Marcus\Downloads\f-secure-blacklight-2.2.1067.exe
2014-09-30 14:38 - 2014-09-30 14:38 - 00380416 _____ () C:\Users\Marcus\Downloads\novicki0.exe
2014-09-30 14:35 - 2014-09-30 14:35 - 02205157 _____ () C:\Users\Marcus\Downloads\IceSword122en.zip
2014-09-30 14:35 - 2007-07-10 16:26 - 00000000 ____D () C:\Users\Marcus\Desktop\IceSword122en
2014-09-30 14:32 - 2014-09-30 14:32 - 02174656 _____ () C:\Users\Marcus\Desktop\IceSword120_en[1].zip
2014-09-30 14:32 - 2014-09-30 14:32 - 00000000 ____D () C:\Users\Marcus\Desktop\IceSword120_en[1]
2014-09-30 14:31 - 2014-09-30 14:31 - 02496143 _____ () C:\Users\Marcus\Downloads\IceSword.exe
2014-09-30 14:28 - 2014-09-30 14:28 - 02174656 _____ () C:\Users\Marcus\Desktop\IceSword120_en.zip
2014-09-30 14:28 - 2014-09-30 14:28 - 00000000 ____D () C:\Users\Marcus\Desktop\IceSword120_en
2014-09-30 14:23 - 2014-09-30 14:23 - 01137360 _____ (F-Secure Corporation) C:\Users\Marcus\Downloads\fsbl (1).exe
2014-09-30 14:23 - 2014-09-30 14:23 - 00000260 _____ () C:\Users\Marcus\Downloads\fsbl-20140930122348.log
2014-09-30 14:20 - 2014-09-30 14:20 - 00000256 _____ () C:\Users\Marcus\Downloads\fsbl-20140930122025.log
2014-09-30 14:13 - 2014-09-30 14:13 - 00000256 _____ () C:\Users\Marcus\Downloads\fsbl-20140930121314.log
2014-09-30 14:12 - 2014-09-30 14:12 - 01137360 _____ (F-Secure Corporation) C:\Users\Marcus\Downloads\fsbl.exe
2014-09-30 14:12 - 2014-09-30 14:12 - 00000260 _____ () C:\Users\Marcus\Downloads\fsbl-20140930121246.log
2014-09-30 14:11 - 2014-09-30 14:11 - 00000256 _____ () C:\Users\Marcus\Downloads\fsbl-20140930121114.log
2014-09-30 14:09 - 2014-09-30 14:09 - 00000256 _____ () C:\Users\Marcus\Downloads\fsbl-20140930120943.log
2014-09-30 14:07 - 2014-09-30 14:07 - 00916072 _____ (F-Secure Corporation) C:\Users\Marcus\Downloads\fsbl1067.exe
2014-09-30 14:07 - 2014-09-30 14:07 - 00916072 _____ (F-Secure Corporation) C:\Users\Marcus\Downloads\fsbl1067 (1).exe
2014-09-30 14:07 - 2014-09-30 14:07 - 00000256 _____ () C:\Users\Marcus\Downloads\fsbl-20140930120755.log
2014-09-30 14:07 - 2014-09-30 14:07 - 00000256 _____ () C:\Users\Marcus\Downloads\fsbl-20140930120723.log
2014-09-30 14:02 - 2014-09-30 14:02 - 00656494 _____ () C:\Users\Marcus\Downloads\darkspy-anti-rootkit_10927 (1).zip
2014-09-30 13:59 - 2014-09-30 14:00 - 00656494 _____ () C:\Users\Marcus\Downloads\darkspy-anti-rootkit_10927.zip
2014-09-30 13:56 - 2014-09-30 13:56 - 00641193 _____ () C:\Users\Marcus\Downloads\darkspy105_en.rar
2014-09-30 13:54 - 2014-09-30 13:54 - 00249801 _____ () C:\Users\Marcus\Downloads\DarkSpy_En.rar
2014-09-30 13:45 - 2014-09-30 13:45 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-09-30 13:45 - 2014-09-30 13:45 - 00000000 ____D () C:\Program Files\CCleaner
2014-09-30 13:42 - 2014-09-30 13:42 - 03836936 _____ (Piriform Ltd) C:\Users\Marcus\Downloads\ccsetup418_slim.exe
2014-09-26 14:10 - 2014-09-26 14:12 - 41474183 _____ () C:\Users\Marcus\Desktop\swisstripv10.mov
2014-09-24 10:16 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 10:16 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-23 12:10 - 2014-09-23 12:10 - 00014862 _____ () C:\Users\Marcus\Desktop\Fazit.odt
2014-09-22 17:47 - 2014-09-22 17:47 - 00020158 _____ () C:\Users\Marcus\Desktop\Unbenannt 1.odt
2014-09-22 12:22 - 2014-09-22 12:22 - 00001885 _____ () C:\Users\Marcus\Desktop\BlueJ.lnk
2014-09-22 12:22 - 2014-09-22 12:22 - 00000000 ____D () C:\Users\Marcus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BlueJ
2014-09-22 12:21 - 2014-09-22 12:22 - 00000000 ____D () C:\Program Files (x86)\BlueJ
2014-09-22 12:09 - 2014-09-22 12:13 - 147034152 _____ () C:\Users\Marcus\Downloads\bluej-bundled-311.msi
2014-09-21 21:02 - 2014-09-21 21:04 - 38645956 _____ () C:\Users\Marcus\Desktop\swisstripv6.mov
2014-09-21 21:00 - 2014-09-21 21:00 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-09-21 20:59 - 2014-09-21 20:59 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-09-21 20:57 - 2014-09-21 20:57 - 07822880 _____ (TeamViewer GmbH) C:\Users\Marcus\Downloads\TeamViewer_Setup_9.0.32494.exe
2014-09-19 07:44 - 2014-09-19 08:09 - 00000000 ____D () C:\Users\Marcus\Desktop\2014-09-19 arztzeugnis_
2014-09-19 07:42 - 2014-09-19 07:43 - 00000000 ____D () C:\Users\Marcus\Desktop\2014-09-19 arztzeugnis
2014-09-16 22:22 - 2014-09-16 22:22 - 00735232 _____ () C:\Users\Marcus\Desktop\City_Guide_Final.swf
2014-09-12 12:23 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 12:23 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 12:23 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 12:23 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 12:23 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 12:23 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 12:23 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 12:23 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 12:23 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 12:23 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 12:23 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 12:23 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 12:23 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 12:23 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 12:23 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 12:23 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 12:23 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 12:23 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-12 12:23 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 12:23 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 12:23 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 12:23 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 12:23 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 12:23 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 12:23 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 12:23 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-12 12:23 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 12:23 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 12:23 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 12:23 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 12:23 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-12 12:23 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 12:23 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 12:23 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 12:22 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 12:22 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 12:22 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 12:22 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 12:22 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 12:22 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 12:22 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 12:22 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 12:22 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-12 12:22 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 12:22 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 12:22 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 12:22 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 12:22 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 12:22 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 12:22 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 12:22 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-12 12:22 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 12:22 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 12:22 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 12:22 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 12:22 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-12 11:52 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 11:52 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 14:58 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 14:58 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 14:57 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 14:57 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 14:57 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 14:57 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 14:57 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-11 14:56 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 14:56 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 14:56 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 14:56 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-09 08:14 - 2014-09-09 08:14 - 00000000 ____D () C:\work
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-03 13:00 - 2009-07-14 06:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-03 13:00 - 2009-07-14 06:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-03 12:56 - 2013-02-13 13:43 - 01258632 _____ () C:\Windows\WindowsUpdate.log
2014-10-03 12:49 - 2013-04-22 22:04 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-03 12:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-03 12:48 - 2013-04-22 18:32 - 00000000 ____D () C:\Users\Marcus
2014-10-03 12:28 - 2013-04-25 22:27 - 03666432 ___SH () C:\Users\Marcus\Desktop\Thumbs.db
2014-10-03 12:20 - 2013-04-22 22:04 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-03 11:53 - 2013-04-26 17:35 - 00000000 ____D () C:\Users\Marcus\AppData\Local\Adobe
2014-10-03 11:47 - 2009-03-12 11:30 - 00000000 ____D () C:\Windows\LP
2014-10-01 23:06 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-10-01 22:59 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-30 21:39 - 2013-12-12 10:57 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-09-30 21:39 - 2013-02-13 14:05 - 00000000 ____D () C:\Program Files (x86)\Atheros
2014-09-30 21:08 - 2013-04-24 21:44 - 00000000 ____D () C:\Users\Marcus\AppData\Local\CrashDumps
2014-09-30 21:05 - 2013-04-23 12:57 - 00001770 _____ () C:\Windows\wininit.ini
2014-09-30 21:02 - 2014-08-15 08:19 - 00000000 ____D () C:\Users\Marcus\Documents\iZotope
2014-09-30 21:02 - 2014-08-15 08:19 - 00000000 ____D () C:\Program Files\Common Files\Avid
2014-09-30 21:02 - 2014-08-15 08:18 - 00000000 ____D () C:\Program Files (x86)\iZotope
2014-09-30 21:01 - 2012-06-05 17:03 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-30 15:08 - 2014-02-26 09:46 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-30 15:08 - 2014-02-26 09:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-30 15:08 - 2014-02-26 09:46 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-30 13:51 - 2013-04-23 13:03 - 00000000 ____D () C:\Users\Marcus\AppData\Roaming\Sony
2014-09-30 13:51 - 2012-03-24 03:58 - 00000000 ____D () C:\Windows\Panther
2014-09-30 13:50 - 2013-07-29 19:35 - 00000000 ____D () C:\Windows\Minidump
2014-09-29 03:53 - 2013-04-23 12:58 - 00000000 ___RD () C:\Users\Marcus\Dropbox
2014-09-28 11:49 - 2013-04-23 12:56 - 00000000 ____D () C:\Users\Marcus\AppData\Roaming\Dropbox
2014-09-26 11:27 - 2014-04-07 17:50 - 00000454 ____H () C:\Windows\Tasks\Norton Security Scan for Marcus.job
2014-09-23 01:44 - 2013-02-13 22:33 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-09-23 01:44 - 2013-02-13 22:33 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-09-23 01:44 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-22 17:02 - 2014-06-25 12:43 - 00000000 ____D () C:\Users\Marcus\Desktop\bluue
2014-09-22 17:02 - 2013-04-23 12:57 - 00000000 ____D () C:\Users\Marcus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-09-22 09:13 - 2009-07-14 06:45 - 05015544 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-21 21:41 - 2013-04-22 18:34 - 00101864 _____ () C:\Users\Marcus\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-21 20:57 - 2014-08-22 17:32 - 00002030 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-09-21 20:57 - 2013-04-23 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-09-21 20:57 - 2012-06-05 16:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-19 12:38 - 2014-03-24 22:06 - 00000000 ____D () C:\Users\Marcus\Desktop\flows powers
2014-09-12 12:20 - 2013-04-23 19:11 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 11:54 - 2014-01-18 20:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 11:53 - 2014-01-18 20:31 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-12 11:51 - 2014-05-10 13:47 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-08 23:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-05 07:12 - 2014-04-07 17:50 - 00000000 ____D () C:\ProgramData\Norton
Some content of TEMP:
====================
C:\Users\Marcus\AppData\Local\Temp\avgnt.exe
C:\Users\Marcus\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-26 11:29
==================== End Of Log ============================ --- --- --- |