Windows 8.1: Plus-HD-V1.6, Webseiten werden automatisch geöffnet Hallo trojaner-board,
ich habe mich heute zufällig an das Laptop von meinem Sohn gesetzt und beim öffnen vom Browser "Chrome / IE" nur noch Seiten mit wilder Werbung bekommen.
Wenn ich eine Seite öffnen wollte, wurden weitere Seiten zusätzlich geöffnet.
Viel hat er nicht auf seinen Rechner aber irgend etwas hat er sich wohl eingefangen.
Nun gut, meiner erster Schritt war bevor ich auf das trojaner-board gestoßen bin, das ich das Malewarebytes zum Laufen bekomme.
Also nix mit Regel Nr. 1.
Gesagt getan, runter geladen, MB Quickscan ausgeführt und das Log angeschaut. Siehe da, einige Einträge gefunden und in Quarantäne verschoben, u.a. habe ich Einträge mit HDV1.6.... gefunden.
Folge dessen gegoogelt und auf das Board hier gestoßen mit dem Thema "Plus-HD-V1.6 entfernen".
Da ich mir die Regel immer noch nicht durchgelesen hatte, habe ich die Schritte bis zum Punkt ESET Online Scanner dann abgearbeitet.
Und da hier immer noch Meldungen aufgetaucht sind, habe ich mich dann doch entschlossen ein Thread hier zu eröffnen und hoffe auf eure Hilfe!
Jetzt aber nach Anleitung!,
Defogger und FRST liefen ohne Probleme, allerdings gab es beim starten von GMER... Probleme,
und beim scannen kommt es sogar zum Crash der Anwendung.
Die Anwendung GMER... habe ich dann auch mal im abgesicherten Modus ausgeführt.
GMER Start: C:\WINDOWS\system32\config\system: Der Prozess kann nicht auf die Datei zugreifen, das sie von einem anderen Prozess verwendet wird.
GMER crash: ...EXE funktioniert nicht mehr.
Das Programm wird aufgrund eines Problems nicht richtig ausgeführt. Das Programm wird geschlossen und Sie werden benachrichtigt, wenn eine Lösung verfügbar ist.
Einmalig konnte ich dann doch ein Log erstellen, ob dieser komplett ist?
Ein aktueller Virenscanner ist nicht aktiv, damit warte ich jetzt erst einmal, bis ich von euch Antworten bekomme.
So und nun hänge ich mal meine Log's an.
Danke schon einmal im voraus. Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 20.02.2015
Suchlauf-Zeit: 16:40:09
Logdatei: mbam.txt
Administrator: Ja
Version: 2.00.4.1028
Malware Datenbank: v2015.02.20.05
Rootkit Datenbank: v2015.02.03.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Aktiviert
Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Niklas
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 391826
Verstrichene Zeit: 20 Min, 5 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 2
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104-10.exe, 3848, Löschen bei Neustart, [5b5abe62682283b3dd19c6ef29d84db3]
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104-11.exe, 3836, Löschen bei Neustart, [9124a7794a40c175c70f254af50e4db3]
Module: 0
(Keine schädliche Elemente erkannt)
Registrierungsschlüssel: 42
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110511951164}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11111111-1111-1111-1111-110511951164}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440544954464}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550555955564}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660566956664}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550555955564}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660566956664}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440544954464}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0059564.BHO.1, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110511951164}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110511951164}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0059564.BHO, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0059564.BHO, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0059564.BHO.1, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKU\S-1-5-21-20931122-1115254766-2354099539-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110511951164}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKU\S-1-5-21-20931122-1115254766-2354099539-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110511951164}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{22222222-2222-2222-2222-220522952264}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0059564.Sandbox.1, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0059564.Sandbox, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0059564.Sandbox, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0059564.Sandbox.1, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220522952264}, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110511951164}\INPROCSERVER32, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PennyBee.A, HKLM\SOFTWARE\CLASSES\wit4ie.WitBHO, In Quarantäne, [52636cb442480333001ddc6d45bee11f],
PUP.Optional.PennyBee.A, HKLM\SOFTWARE\CLASSES\wit4ie.WitBHO.2, In Quarantäne, [7441f030fd8dd06633eae06935ce12ee],
PUP.Optional.PennyBee.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\wit4ie.WitBHO, In Quarantäne, [7441f030fd8dd06633eae06935ce12ee],
PUP.Optional.PennyBee.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\wit4ie.WitBHO.2, In Quarantäne, [7441f030fd8dd06633eae06935ce12ee],
PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64, In Quarantäne, [2c89e53bd2b844f2c535a90cfa096799],
PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w64, In Quarantäne, [07ae3be57812c47250ed3bd98481a15f],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\HDV1.6, In Quarantäne, [bff69b8563271e1854545467f70ce020],
PUP.Optional.Surftastic, HKLM\SOFTWARE\WOW6432NODE\raving reyven, In Quarantäne, [6e47c7591476d85e56259f14b35009f7],
PUP.Optional.WindowsProtectManger.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsProtectManger, In Quarantäne, [734226fa8a00989e5bb5c3f8d231cd33],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\supWPM, In Quarantäne, [ded7d74995f5cf67c55f57592fd4de22],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, In Quarantäne, [595c77a93654e056e81f298ff60d46ba],
PUP.Optional.IEPluginServices.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginServices, In Quarantäne, [3d7875ab5436b086a7b22b7a689b01ff],
PUP.Optional.PlusHD.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HDV1.6, In Quarantäne, [615463bd305ab5810d9dcfecac577b85],
PUP.Optional.Surftastic, HKU\S-1-5-21-20931122-1115254766-2354099539-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\raving reyven, In Quarantäne, [397c9d834c3e3ff71567e9ca37cc7987],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-20931122-1115254766-2354099539-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, In Quarantäne, [9223110fd1b9ae88eaf5e6224eb736ca],
PUP.Optional.PlusHD.A, HKU\S-1-5-21-20931122-1115254766-2354099539-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HDV1.6, In Quarantäne, [6055ea36a4e6ee48d1d9dfdc62a114ec],
PUP.Optional.Linkury.A, HKU\S-1-5-21-20931122-1115254766-2354099539-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\pennybee, In Quarantäne, [278e938d53377cba3990159c778c35cb],
PUP.Optional.PennyBee.A, HKU\S-1-5-21-20931122-1115254766-2354099539-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\pennybeepro, In Quarantäne, [506527f92d5ddc5a117a2bf1030258a8],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HDV1.6, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
Registrierungswerte: 1
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, In Quarantäne, [595c77a93654e056e81f298ff60d46ba]
Registrierungsdaten: 2
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1403807846&from=cor&uid=ST1000LM024XHN-M101MBB_S2U5J9FCC33273&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403807846&from=cor&uid=ST1000LM024XHN-M101MBB_S2U5J9FCC33273&q={searchTerms}),Ersetzt,[179ecd534347df576ebaac1c7f86a25e]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1403807846&from=cor&uid=ST1000LM024XHN-M101MBB_S2U5J9FCC33273&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1403807846&from=cor&uid=ST1000LM024XHN-M101MBB_S2U5J9FCC33273&q={searchTerms}),Ersetzt,[6c49ff2144467cbaf33d3489867f17e9]
Ordner: 4
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger, In Quarantäne, [f6bfb36dc8c22e08e1d6f87622e1fd03],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log, In Quarantäne, [f6bfb36dc8c22e08e1d6f87622e1fd03],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update, In Quarantäne, [f6bfb36dc8c22e08e1d6f87622e1fd03],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6, Löschen bei Neustart, [9124a7794a40c175c70f254af50e4db3],
Dateien: 60
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104-10.exe, Löschen bei Neustart, [5b5abe62682283b3dd19c6ef29d84db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6-bho64.dll, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6-bho.dll, In Quarantäne, [6f46da46ef9bb97dce287243e0219967],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\wprotectmanager.exe, In Quarantäne, [c7ee25fb6723b1854acd6b47877a39c7],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104-4.exe, In Quarantäne, [536263bd0684e94d6f873184db269070],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104-3.exe, In Quarantäne, [6c497ea2fd8db77f579ff0c5709134cc],
PUP.Optional.CrossRider.A, C:\Program Files (x86)\HDV1.6\utils.exe, In Quarantäne, [b7fe5fc1bdcdef474d06cd7330d022de],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104-5.exe, In Quarantäne, [783d021e8bffb3838d692194c140fe02],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6-bg.exe, In Quarantäne, [e8cdcb55cebc0e2849add6dfa35efa06],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6-codedownloader.exe, In Quarantäne, [d1e43be5a0ea2c0a867090256998e31d],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6-nova.exe, In Quarantäne, [5e57928eb7d3c571fafce3d217eaab55],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6-novainstaller.exe, In Quarantäne, [5362a17fc5c52f07fbfbd0e5d72a0ff1],
PUP.Optional.Agent.A, C:\Users\Niklas\AppData\Local\tmp27191\dag27191.exe, In Quarantäne, [e5d0839dcdbdc76fa4de16448a7608f8],
PUP.Optional.SelectNGo.A, C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage, In Quarantäne, [bcf9041cb0da82b41fdb375fe71cb24e],
PUP.Optional.SelectNGo.A, C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage-journal, In Quarantäne, [f9bcbd634d3dec4a07f3b2e4966d1fe1],
PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw64.sys, In Quarantäne, [2c89e53bd2b844f2c535a90cfa096799],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-1, In Quarantäne, [e4d1d54b6d1d2511ec16c2f622e1de22],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-10, In Quarantäne, [1c9907194e3c2d0934ce2098b44f54ac],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-11, In Quarantäne, [4e671010f8922e088e74dcdc25deea16],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-3, In Quarantäne, [803552ce91f91a1c89798c2c3ec52dd3],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-4, In Quarantäne, [e5d0d64a98f283b3659d00b8ae5516ea],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-5, In Quarantäne, [b7fe45db652596a0689ad7e1e1228878],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-5_user, In Quarantäne, [c2f31010f793ca6c7a889d1b5ca7d22e],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-6, In Quarantäne, [7a3bbf61b7d3310549b9892f5ea522de],
PUP.Optional.CrossRider.T, C:\Windows\System32\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-7, In Quarantäne, [42730a165f2b73c349b98830a063bc44],
PUP.Optional.SelectNGo.A, C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.select-n-go00.select-n-go.com_0.localstorage, Löschen bei Neustart, [9a1b839d7a1077bfaa4d586b20e3728e],
PUP.Optional.SelectNGo.A, C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.select-n-go00.select-n-go.com_0.localstorage-journal, Löschen bei Neustart, [a0152bf5d4b6d85e7483f9cac83b738d],
PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w64.sys, In Quarantäne, [07ae3be57812c47250ed3bd98481a15f],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-1.job, In Quarantäne, [edc8a17fa7e3142231e671a495706d93],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-10.job, In Quarantäne, [cbea0d13cbbfe55138df3ed7ba4bf20e],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-11.job, In Quarantäne, [d3e276aaf991db5b0b0cba5b877e19e7],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-3.job, In Quarantäne, [ae0726fa8cfe85b173a447ce36cf45bb],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-4.job, In Quarantäne, [6253aa76602ac96d9d7a52c3669fd22e],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-5.job, In Quarantäne, [2a8bf62a711944f271a655c005000bf5],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-5_user.job, In Quarantäne, [783d2df3048687af19fefd18b5508779],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-6.job, In Quarantäne, [5b5adf418a007bbb0b0cac69897c9769],
PUP.Optional.CrossRider.T, C:\Windows\Tasks\dcff6d6c-1312-41ac-9b5b-a4578bee3104-7.job, In Quarantäne, [f4c1051ba6e49a9cc2555bbabb4a09f7],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, In Quarantäne, [b7fe0d136e1c191dfe28987d1ee7d22e],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, In Quarantäne, [882dad73becceb4b0225e72e09fc2dd3],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, In Quarantäne, [d1e4041c96f4270ff3355bba848105fb],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, In Quarantäne, [8332c25e464487afd0590c09ec19d12f],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log\wprotectmanager_2014-06-26[20-37-46-669].log, In Quarantäne, [f6bfb36dc8c22e08e1d6f87622e1fd03],
PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update\conf, In Quarantäne, [f6bfb36dc8c22e08e1d6f87622e1fd03],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\1293297481.mxaddon, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\360-59564.crx, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\59564.crx, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\59564.xpi, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\background.html, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\bgNova.html, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104-11.exe, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\Interop.IWshRuntimeLibrary.dll, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\Newtonsoft.Json.dll, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\SuperSocket.ClientEngine.Common.dll, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\SuperSocket.ClientEngine.Core.dll, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\SuperSocket.ClientEngine.Protocol.dll, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\Uninstall.exe, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\WebSocket4Net.dll, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\dcff6d6c-1312-41ac-9b5b-a4578bee3104.crx, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6-nova.dll, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
PUP.Optional.PlusHD.A, C:\Program Files (x86)\HDV1.6\HDV1.6.ico, In Quarantäne, [9124a7794a40c175c70f254af50e4db3],
Physische Sektoren: 0
(Keine schädliche Elemente erkannt)
(end) Code:
# AdwCleaner v4.111 - Bericht erstellt 20/02/2015 um 17:30:32
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-02-18.3 [Server]
# Betriebssystem : Windows 8.1 (x64)
# Benutzername : Niklas - NIKISPC
# Gestarted von : C:\Users\Niklas\Downloads\AdwCleaner_4.111.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Niklas\AppData\Local\CrashRpt
Datei Gelöscht : C:\WINDOWS\System32\log\iSafeKrnlCall.log
Datei Gelöscht : C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gelöscht : C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal
***** [ Geplante Tasks ] *****
Task Gelöscht : PC Speed Maximizer Schedule
Task Gelöscht : pennybee Runner
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\wit4ie.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{425ED333-6083-428A-92C9-0CFC28B9D1BF}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{425ED333-6083-428A-92C9-0CFC28B9D1BF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{425ED333-6083-428a-92C9-0CFC28B9D1BF}
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sweet-page uninstall
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\raving reyven
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\sweet-page.com
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Google Chrome v40.0.2214.111
*************************
AdwCleaner[R0].txt - [7241 Bytes] - [20/02/2015 17:25:53]
AdwCleaner[S0].txt - [6974 Bytes] - [20/02/2015 17:30:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7033 Bytes] ########## Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 8.1 x64
Ran by Niklas on 20.02.2015 at 17:38:29,96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\update raving reyven
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\util raving reyven
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F96F190-09C4-4BEC-B7FB-A9E26151EAB0}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{7F96F190-09C4-4BEC-B7FB-A9E26151EAB0}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F96F190-09C4-4BEC-B7FB-A9E26151EAB0}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{7F96F190-09C4-4BEC-B7FB-A9E26151EAB0}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\WINDOWS\syswow64\ai_recyclebin"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.02.2015 at 17:43:01,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
Shortcut Cleaner 1.3.4 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Shortcut Cleaner can be found at this link:
hxxp://www.bleepingcomputer.com/download/shortcut-cleaner/
Windows Version: Windows 8.1
Program started at: 02/20/2015 08:18:28 PM.
Scanning for registry hijacks:
* No issues found in the Registry.
Searching for Hijacked Shortcuts:
Searching C:\Users\Niklas\AppData\Roaming\Microsoft\Windows\Start Menu\
Searching C:\ProgramData\Microsoft\Windows\Start Menu\
Searching C:\Users\Niklas\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\
Searching C:\Users\Public\Desktop\
Searching C:\Users\Niklas\Desktop
0 bad shortcuts found.
Program finished at: 02/20/2015 08:18:28 PM
Execution time: 0 hours(s), 0 minute(s), and 0 seconds(s) ESET LOG: Code:
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\DEDI1SMG\91[1].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\DEDI1SMG\91[2].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\F3WQNO20\91[1].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\F3WQNO20\91[2].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\F3WQNO20\91[3].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\XTCH1DHT\91[1].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\XTCH1DHT\91[2].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\XTCH1DHT\qpnj3133ge[1].htm JS/Exploit.Agent.NHW Trojaner
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\YSXGEACB\91[1].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\YSXGEACB\91[2].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\YSXGEACB\91[3].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\Microsoft\Windows\INetCache\IE\YSXGEACB\91[4].js JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung
C:\Users\Niklas\AppData\Local\tmp22699\dag22699.exe Variante von Win32/AdWare.PennyBee.A Anwendung
C:\Users\Niklas\AppData\Local\tmp2630\dag2630.exe Win32/AdWare.PennyBee Anwendung
C:\Users\Niklas\AppData\Local\tmp661\dag661.exe Variante von Win32/AdWare.PennyBee.A Anwendung
C:\Users\Niklas\AppData\Roaming\unpacked674\10040004.exe Variante von Win32/AdWare.PennyBee.A Anwendung Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:43 on 20/02/2015 (Niklas)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=- Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by Niklas (administrator) on NIKISPC on 20-02-2015 21:21:33
Running from C:\Users\Niklas\Desktop
Loaded Profiles: Niklas (Available profiles: UpdatusUser & Niklas)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13267016 2013-01-29] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1276488 2013-01-18] (Realtek Semiconductor)
HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-16] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [258592 2012-11-27] (CyberLink Corp.)
HKLM-x32\...\Run: [HotkeyApp] => C:\Program Files (x86)\Launch Manager\HotkeyApp.exe [320824 2012-08-16] (Wistron)
HKLM-x32\...\Run: [LMgrVolOSD] => C:\Program Files (x86)\Launch Manager\OSD.exe [348960 2012-08-13] (Wistron Corp.)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\Run: [Spotify] => C:\Users\Niklas\AppData\Roaming\Spotify\Spotify.exe [6737976 2014-12-05] (Spotify Ltd)
HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\Run: [MK LOL] => C:\Program Files (x86)\MKJogo\MK IM\Bin\MKIM.exe [1092296 2014-12-15] ()
HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATILGE.EXE [297024 2014-12-03] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\Run: [spotimote] => C:\Program Files (x86)\spotimote\spotimote.exe [2828712 2014-12-15] ()
HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\Run: [Spotify Web Helper] => C:\Users\Niklas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-05] (Spotify Ltd)
HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=de-DE&Src=WD8&Tid=00032955&OHP=http%3A%2F%2Fwww.google.com&OSP=
SearchScopes: HKLM -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-20931122-1115254766-2354099539-1002 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: No Name -> {7F96F190-09C4-4BEC-B7FB-A9E26151EAB0}} -> No File
BHO-x32: No Name -> {7F96F190-09C4-4BEC-B7FB-A9E26151EAB0}} -> No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR StartupUrls: Default -> "https://www.google.de/?gws_rd=ssl", "https://www.google.de/?gws_rd=ssl"
CHR DefaultSearchKeyword: Default -> google
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-26]
CHR Extension: (Google Drive) - C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-18]
CHR Extension: (YouTube) - C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-26]
CHR Extension: (Google Search) - C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-26]
CHR Extension: (Google Wallet) - C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-26]
CHR Extension: (Gmail) - C:\Users\Niklas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-26]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
S2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-12-03] ()
S2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S3 WisLMSvc; C:\Program Files (x86)\Launch Manager\WisLMSvc.exe [118560 2012-08-13] (Wistron Corp.)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3386160 2012-12-03] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
S3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1342848 2012-12-03] (Motorola Solutions, Inc.)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S2 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-20] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-16] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated)
S3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-11-29] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-11-29] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-20 21:21 - 2015-02-20 21:22 - 00011578 _____ () C:\Users\Niklas\Desktop\FRST.txt
2015-02-20 20:44 - 2015-02-20 21:21 - 00000000 ____D () C:\FRST
2015-02-20 20:43 - 2015-02-20 20:43 - 00000474 _____ () C:\Users\Niklas\Desktop\defogger_disable.log
2015-02-20 20:43 - 2015-02-20 20:43 - 00000000 _____ () C:\Users\Niklas\defogger_reenable
2015-02-20 20:41 - 2015-02-20 20:41 - 00380416 _____ () C:\Users\Niklas\Desktop\Gmer-19357.exe
2015-02-20 20:40 - 2015-02-20 20:40 - 02086912 _____ (Farbar) C:\Users\Niklas\Desktop\FRST64.exe
2015-02-20 20:37 - 2015-02-20 20:37 - 00050477 _____ () C:\Users\Niklas\Desktop\Defogger.exe
2015-02-20 20:18 - 2015-02-20 20:18 - 00001752 _____ () C:\Users\Niklas\Desktop\sc-cleaner.txt
2015-02-20 20:17 - 2015-02-20 20:17 - 00001966 _____ () C:\Users\Niklas\Desktop\ESET.txt
2015-02-20 17:59 - 2015-02-20 17:59 - 00259584 _____ (OldTimer Tools) C:\Users\Niklas\Desktop\OTH.scr
2015-02-20 17:55 - 2015-02-20 17:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Niklas\Desktop\revosetup95.exe
2015-02-20 17:49 - 2015-02-20 17:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-20 17:48 - 2015-02-20 17:48 - 02347384 _____ (ESET) C:\Users\Niklas\Desktop\esetsmartinstaller_deu.exe
2015-02-20 17:46 - 2015-02-20 20:18 - 00001752 _____ () C:\sc-cleaner.txt
2015-02-20 17:46 - 2015-02-20 17:46 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\Niklas\Desktop\sc-cleaner.exe
2015-02-20 17:43 - 2015-02-20 17:43 - 00001541 _____ () C:\Users\Niklas\Desktop\JRT.txt
2015-02-20 17:37 - 2015-02-20 17:37 - 01388274 _____ (Thisisu) C:\Users\Niklas\Desktop\JRT.exe
2015-02-20 17:33 - 2015-02-20 17:33 - 00007125 _____ () C:\Users\Niklas\Desktop\AdwCleaner[S0].txt
2015-02-20 17:33 - 2015-02-20 17:33 - 00000000 ____D () C:\Users\Niklas\AppData\Local\CrashRpt
2015-02-20 17:25 - 2015-02-20 17:30 - 00000000 ____D () C:\AdwCleaner
2015-02-20 17:09 - 2015-02-20 17:09 - 02126848 _____ () C:\Users\Niklas\Desktop\AdwCleaner_4.111.exe
2015-02-20 17:06 - 2015-02-20 17:06 - 00017905 _____ () C:\Users\Niklas\Desktop\mbam.txt
2015-02-20 16:38 - 2015-02-20 20:33 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-20 16:38 - 2015-02-20 16:38 - 00001118 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-20 16:38 - 2015-02-20 16:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-20 16:37 - 2015-02-20 16:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-20 16:37 - 2015-02-20 16:37 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Niklas\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-20 16:37 - 2015-02-20 16:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-20 16:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-02-20 16:37 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-02-20 16:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-02-20 16:06 - 2014-12-31 12:14 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-02-14 13:32 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-02-14 13:32 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-02-11 13:04 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-02-11 13:04 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-02-11 13:04 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-02-11 13:04 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-02-11 13:04 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-02-11 13:04 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll
2015-02-11 13:04 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll
2015-02-11 13:04 - 2014-10-29 03:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2015-02-11 13:04 - 2014-10-29 03:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2015-02-11 13:04 - 2014-10-29 02:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-02-11 13:04 - 2014-10-29 02:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe
2015-02-11 13:03 - 2015-02-04 00:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-02-11 13:03 - 2015-02-04 00:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-02-11 13:03 - 2015-02-04 00:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-02-11 13:03 - 2015-02-03 00:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-02-11 13:03 - 2015-02-03 00:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-02-11 13:03 - 2015-02-03 00:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-02-11 13:03 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-02-11 13:03 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-02-11 13:03 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-02-11 13:03 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-02-11 13:03 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-02-11 13:03 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-02-11 13:03 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-02-11 13:03 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-02-11 13:03 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-02-11 13:03 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-02-11 13:03 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-02-11 13:03 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-02-11 13:03 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-02-11 13:03 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-02-11 13:03 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-02-11 13:03 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-02-11 13:03 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-02-11 13:03 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-02-11 13:03 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-02-11 13:03 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-02-11 13:03 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-02-11 13:03 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-02-11 13:03 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-02-11 13:03 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-02-11 13:03 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-02-11 13:03 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-02-11 13:03 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-02-11 13:03 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-02-11 13:03 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-02-11 13:03 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-02-11 13:03 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-02-11 13:03 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-02-11 13:03 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-02-11 13:03 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-02-11 13:03 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-02-11 13:03 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-02-11 13:03 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-02-11 13:03 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-02-11 13:03 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-02-11 13:03 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-02-11 13:03 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-02-11 13:03 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-02-11 13:03 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2015-02-11 13:03 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2015-02-11 13:03 - 2014-12-09 00:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-02-11 13:03 - 2014-10-29 03:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll
2015-02-11 13:03 - 2014-10-29 03:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll
2015-02-11 13:03 - 2014-10-29 03:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll
2015-02-11 13:03 - 2014-10-29 03:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll
2015-02-11 13:03 - 2014-10-29 02:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-02-11 13:03 - 2014-10-29 02:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-02-11 13:03 - 2014-10-29 02:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll
2015-02-11 13:03 - 2014-10-29 02:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe
2015-02-11 13:03 - 2014-10-29 02:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe
2015-02-07 20:25 - 2015-02-14 13:24 - 00000000 ____D () C:\Users\Niklas\AppData\Roaming\spotimote
2015-02-07 20:25 - 2015-02-07 20:25 - 04228408 _____ () C:\Users\Niklas\Downloads\spotimote_installer.exe
2015-02-07 20:25 - 2015-02-07 20:25 - 00000000 ____D () C:\Users\Niklas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\spotimote
2015-02-07 20:25 - 2015-02-07 20:25 - 00000000 ____D () C:\Program Files (x86)\spotimote
2015-01-28 16:42 - 2015-02-20 20:42 - 00000935 _____ () C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90}.job
2015-01-28 16:42 - 2015-02-20 20:42 - 00000749 _____ () C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90}.job
2015-01-28 16:42 - 2015-01-28 16:42 - 00003966 _____ () C:\WINDOWS\System32\Tasks\EPSON XP-215 217 Series Update {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90}
2015-01-28 16:42 - 2015-01-28 16:42 - 00003780 _____ () C:\WINDOWS\System32\Tasks\EPSON XP-215 217 Series Invitation {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90}
2015-01-28 16:42 - 2015-01-28 16:42 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2015-01-28 16:41 - 2015-02-02 13:42 - 00000000 ____D () C:\ProgramData\EPSON
2015-01-28 16:39 - 2014-12-03 01:48 - 00179712 _____ (SEIKO EPSON CORPORATION) C:\WINDOWS\system32\E_ILMBLGE.DLL
2015-01-28 16:39 - 2014-12-03 01:48 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\WINDOWS\system32\E_ID4BLGE.DLL
2015-01-28 16:39 - 2014-12-03 01:48 - 00010752 _____ (SEIKO EPSON CORP.) C:\WINDOWS\system32\E_GCINST.DLL
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-20 21:18 - 2014-09-24 07:17 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-20 21:18 - 2014-09-24 06:43 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-02-20 21:18 - 2014-09-24 06:43 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-02-20 21:17 - 2014-06-26 19:49 - 00000000 ____D () C:\Users\Niklas\AppData\Roaming\Spotify
2015-02-20 21:17 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-02-20 21:16 - 2014-06-26 19:22 - 00001130 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-20 21:12 - 2013-08-22 15:46 - 00330982 _____ () C:\WINDOWS\setupact.log
2015-02-20 21:12 - 2013-02-01 08:32 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-20 21:02 - 2014-07-01 19:24 - 00019968 ___SH () C:\Users\Niklas\Downloads\Thumbs.db
2015-02-20 21:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-02-20 20:52 - 2014-10-28 10:10 - 01833426 _____ () C:\WINDOWS\WindowsUpdate.log
2015-02-20 20:50 - 2014-06-26 19:22 - 00001134 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-20 20:43 - 2014-10-28 10:19 - 00000000 ____D () C:\Users\Niklas
2015-02-20 20:42 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-02-20 20:07 - 2014-06-27 23:19 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-20931122-1115254766-2354099539-1002
2015-02-20 19:56 - 2014-10-29 14:12 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{97D361BD-7B5A-4369-A510-CA5451385E0B}
2015-02-20 19:00 - 2014-08-19 19:34 - 00000000 ____D () C:\Users\Niklas\AppData\Roaming\unpacked674
2015-02-20 18:51 - 2014-06-26 19:23 - 00002257 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-20 17:42 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp
2015-02-20 17:32 - 2014-06-26 19:50 - 00000000 ____D () C:\Users\Niklas\AppData\Local\Spotify
2015-02-20 17:31 - 2014-09-23 22:06 - 00024390 _____ () C:\WINDOWS\PFRO.log
2015-02-20 17:30 - 2014-07-25 14:48 - 00000000 ____D () C:\WINDOWS\system32\log
2015-02-20 16:54 - 2014-10-22 16:02 - 00000000 ____D () C:\Users\Niklas\AppData\Local\tmp26991
2015-02-20 16:54 - 2014-10-04 21:36 - 00000000 ____D () C:\Users\Niklas\AppData\Local\tmp27191
2015-02-20 16:42 - 2014-08-14 21:35 - 00000000 ____D () C:\Users\Niklas\AppData\Roaming\unpacked22719
2015-02-20 16:19 - 2012-07-26 09:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-02-20 16:18 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-02-20 16:18 - 2012-07-26 06:37 - 00000000 ____D () C:\Users\Default.migrated
2015-02-20 16:09 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-02-16 13:34 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-02-15 14:57 - 2014-12-02 15:29 - 00000000 ____D () C:\Users\Niklas\AppData\Roaming\TS3Client
2015-02-14 13:21 - 2013-08-22 15:44 - 00347808 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-13 14:01 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-11 13:08 - 2014-07-24 13:34 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-02-11 13:05 - 2014-12-19 18:57 - 00000000 ____D () C:\WINDOWS\system32\appraiser
2015-02-11 13:05 - 2014-09-24 08:43 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2015-02-11 13:05 - 2013-02-01 06:09 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-02-07 18:45 - 2014-06-26 19:22 - 00004106 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 18:45 - 2014-06-26 19:22 - 00003870 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-03 20:31 - 2014-10-30 15:11 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:31 - 2014-10-30 15:11 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-29 15:03 - 2012-07-26 09:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
==================== Files in the root of some directories =======
2013-02-01 08:41 - 2013-02-01 08:41 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some content of TEMP:
====================
C:\Users\Niklas\AppData\Local\Temp\Quarantine.exe
C:\Users\Niklas\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-20 20:07
==================== End Of Log ============================ Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Niklas at 2015-02-20 21:22:26
Running from C:\Users\Niklas\Desktop
Boot Mode: Safe Mode (with Networking)
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
CyberLink PowerDirector (Version: 9.0.0.3815c - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.0913 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.0913 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
EPSON XP-215 217 Series Printer Uninstall (HKLM\...\EPSON XP-215 217 Series) (Version: - SEIKO EPSON Corporation)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{DA2600C1-6BDF-4FD1-1212-148929CC1385}) (Version: 2.6.1212.0302 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.7.0.1013 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{23D486D4-FBE0-40F3-A245-E4D56D094764}) (Version: 3.5.41.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{2b83a547-7e0f-4dca-8990-97ff818fa3d8}) (Version: 15.6.0 - Intel Corporation)
Launch Manager (HKLM-x32\...\{D0846526-66DD-4DC9-A02C-98F9A2806812}) (Version: 1.5.1.8 - Wistron Corp.)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mediathek (HKLM-x32\...\{EFFED0C0-5299-422E-AFE6-8B8066D18A2A}) (Version: 1.4.0 - Medion)
Medion Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Medion Home Cinema 10 (x32 Version: 10.1924 - CyberLink Corp.) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4433.1507 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MK LOL (HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\MK LOL) (Version: - )
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
NVIDIA 3D Vision Treiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 327.02 - NVIDIA Corporation)
NVIDIA Grafiktreiber 327.02 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.02 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
Raccolta foto (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6833 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Skype™ 6.1 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.1.129 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-20931122-1115254766-2354099539-1002\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
spotimote (HKLM-x32\...\spotimote) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-20931122-1115254766-2354099539-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
23-01-2015 15:34:58 Windows Update
29-01-2015 12:26:35 Windows Update
07-02-2015 22:11:19 Geplanter Prüfpunkt
11-02-2015 12:43:43 Windows Modules Installer
16-02-2015 13:33:49 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {3763096E-DDD7-4121-86C7-F87E70379944} - System32\Tasks\Dolby Selector => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [2012-08-31] (Dolby Laboratories Inc.)
Task: {8326988F-6AD7-45DF-884D-8A2C40AE6216} - System32\Tasks\EPSON XP-215 217 Series Invitation {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE [2014-12-03] (SEIKO EPSON CORPORATION)
Task: {9BC69F5F-77BC-4BAC-9651-0B346EA4A320} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-16] (Synaptics Incorporated)
Task: {CE74640E-553E-4825-A6D2-3845CB73A5D9} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-11] (Microsoft Corporation)
Task: {F67956F8-160C-4D9B-939F-7AF532EE1EA9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-26] (Google Inc.)
Task: {FAFBA608-C87B-43D7-A29E-D83F69179D90} - System32\Tasks\EPSON XP-215 217 Series Update {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE [2014-12-03] (SEIKO EPSON CORPORATION)
Task: {FF5ADBB5-486F-4B14-A5C4-04F0802135F0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-26] (Google Inc.)
Task: C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE
Task: C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {5C0AE4A6-839C-4533-96CD-A5E2F0A57E90}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) ==============
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-20931122-1115254766-2354099539-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Niklas\Downloads\coca_cola_017.jpg
DNS Servers: Media is not connected to internet.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-20931122-1115254766-2354099539-500 - Administrator - Disabled)
Gast (S-1-5-21-20931122-1115254766-2354099539-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-20931122-1115254766-2354099539-1004 - Limited - Enabled)
Niklas (S-1-5-21-20931122-1115254766-2354099539-1002 - Administrator - Enabled) => C:\Users\Niklas
UpdatusUser (S-1-5-21-20931122-1115254766-2354099539-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/20/2015 09:20:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (02/20/2015 08:11:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (02/20/2015 05:49:14 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (02/20/2015 05:48:59 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (02/20/2015 05:48:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
System errors:
=============
Error: (02/20/2015 09:22:32 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:22:32 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:22:29 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:22:29 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:22:27 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:22:27 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:22:22 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:22:22 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:21:34 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Error: (02/20/2015 09:21:34 PM) (Source: DCOM) (EventID: 10005) (User: NikisPc)
Description: 1084WSearchNicht verfügbar{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
Microsoft Office Sessions:
=========================
Error: (02/20/2015 09:20:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Niklas\Desktop\esetsmartinstaller_deu.exe
Error: (02/20/2015 08:11:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (02/20/2015 05:49:14 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Niklas\Desktop\esetsmartinstaller_deu.exe
Error: (02/20/2015 05:48:59 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Niklas\Desktop\esetsmartinstaller_deu.exe
Error: (02/20/2015 05:48:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Niklas\Downloads\esetsmartinstaller_deu.exe
CodeIntegrity Errors:
===================================
Date: 2015-02-20 16:14:33.698
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-20 16:14:33.692
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-20 16:14:33.641
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-20 16:14:33.597
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-20 16:06:58.429
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-20 13:31:04.815
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-20 13:31:04.748
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-19 18:56:22.917
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-19 18:56:22.864
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
Date: 2015-02-19 18:56:22.862
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-3120M CPU @ 2.50GHz
Percentage of memory in use: 13%
Total physical RAM: 8054.98 MB
Available physical RAM: 6948.58 MB
Total Pagefile: 9334.98 MB
Available Pagefile: 8284.34 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:869.8 GB) (Free:809.33 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:38.64 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: CEAAD2D8)
Partition: GPT Partition Type.
==================== End Of Log ============================ |