19 replies to this topic

[HorusI]

Hello,

 

for a while now I have been having problems with services on my computer not starting. An example is the Workstation service that is not starting due to "dependency issues," Three of the dependencies are not listed in the services such as the bowser (Browser Support Driver). I have had some Malware (I do not remember what kind, sorry) a year or so ago but was able to remove it. I now fear that maybe some of it is still in the registry. I did multiple root kit scans with nothing coming up. Part of my problem is that due to the Workstation service not starting my AV Kaspersky is unable to activate and get rid of obsolete databases. I have talked to their support and they sent me to Windows support which told me to wipe my system and reinstall in order to fix my issues. I would like to avoid that as I fear that in case I do have a virus it might still be in my backup. I have Windows 7 Home Edition (SP 2) 64-bit. Below the required logs. Please tell me what other information you need me to provide.

 

Thank you very much for attempting to help me,

 

HorusI

 

 

 

Malwarebytes Log:

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 10/14/2014

Scan Time: 11:52:47 PM

Logfile: Malwarebytes Log.txt

Administrator: Yes

 

Version: 2.00.3.1025

Malware Database: v2014.10.14.12

Rootkit Database: v2014.10.11.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Jonas Greiner

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 388725

Time Elapsed: 8 min, 59 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

 

 

 

DDS:

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 11.0.9600.17280

Run by Jonas Greiner at 0:03:58 on 2014-10-15

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.8190.3659 [GMT 2:00]

.

AV: Kaspersky PURE 3.0 *Disabled/Outdated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}

SP: Kaspersky PURE 3.0 *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky PURE 3.0 *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe

C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\SysWOW64\HerculesWiFiService.exe

C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\SysWOW64\NMSAccess32.exe

C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Program Files (x86)\Ralink\Common\RaRegistry.exe

C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\rundll32.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Logitech Gaming Software\LCore.exe

C:\Windows\system\3DG4me.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Drive\googledrivesync.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Hercules\WiFi Station N\WiFiN.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

C:\Program Files (x86)\Google\Drive\googledrivesync.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe

C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe

C:\Program Files\Logitech Gaming Software\Applets\LCDRSS.exe

C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe

C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.224\deploy\LoLLauncher.exe

C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.8\deploy\LoLPatcher.exe

C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.113\deploy\LolClient.exe

C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.1.60\deploy\League of Legends.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uSearch Bar = Preserve

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: Kaspersky Passsword Manager Toolbar: {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - 

BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll

BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\OnlineBanking\online_banking_bho.dll

BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll

TB: Kaspersky Passsword Manager Toolbar: {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - 

EB: <No Name>: {555D4D79-4BD2-4094-A395-CFC534424A05} - LocalServer32 - <no file>

uRun: [Google Update] "C:\Users\Jonas Greiner\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [MusicManager] "C:\Users\Jonas Greiner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe"

uRun: [Spotify Web Helper] "C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

uRun: [Spotify] "C:\Users\Jonas Greiner\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart

uRun: [GoogleChromeAutoLaunch_ED62C97A9A654C625D6FA18D9338683E] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window

uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

mRun: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

mRun: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [AcronisTibMounterMonitor] C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe

mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe"

mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start

mRunOnce: [Malwarebytes Anti-Malware (cleanup)] "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware"

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CRASHP~1.LNK - C:\Program Files\CrashPlan\CrashPlanTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\RALINK~1.LNK - C:\Program Files (x86)\Ralink\Common\RaUI.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\WIFIST~1.LNK - C:\Program Files (x86)\Hercules\WiFi Station N\WiFiN.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:28

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ie_banner_deny.htm

IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_04-windows-i586.cab

TCP: Interfaces\{5B4D8545-89CD-47BC-AF97-A4A972A12461} : DHCPNameServer = 192.168.43.1

TCP: Interfaces\{712B231E-DAEA-4664-A85E-4FBBB74EF8EB} : DHCPNameServer = 192.168.42.129

TCP: Interfaces\{73F8EB48-746A-403F-AE5F-4693439F34EE} : DHCPNameServer = 216.181.134.16 216.181.30.11 68.105.28.12 68.105.29.12 68.105.28.11

TCP: Interfaces\{73F8EB48-746A-403F-AE5F-4693439F34EE}\75540545572656A7 : DHCPNameServer = 168.94.0.14 168.94.0.15

TCP: Interfaces\{929D1979-AFA5-4D70-96DD-FA2BA4DAC9D0} : DHCPNameServer = 216.181.134.16 216.181.30.11

TCP: Interfaces\{B036A92A-59FC-4E58-93C5-C0A6DE4D9012} : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{EC38558C-20FF-48CE-ACE5-6F9A0280CB5A} : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{EC38558C-20FF-48CE-ACE5-6F9A0280CB5A}\140707C65602E4564777F627B602034383035693 : DHCPNameServer = 10.0.1.1

TCP: Interfaces\{EC38558C-20FF-48CE-ACE5-6F9A0280CB5A}\14E64627F6964684F6473707F64723935373 : DHCPNameServer = 192.168.43.1

TCP: Interfaces\{EC38558C-20FF-48CE-ACE5-6F9A0280CB5A}\14E64627F6964684F6473707F64733133353 : DHCPNameServer = 192.168.43.1

TCP: Interfaces\{EC38558C-20FF-48CE-ACE5-6F9A0280CB5A}\74275696E656270275C414E4D2E45647A7775627B6 : DHCPNameServer = 192.168.2.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.101\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll

x64-BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\OnlineBanking\online_banking_bho.dll

x64-BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\UrlAdvisor\klwtbbho.dll

x64-Run: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"

x64-Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe /minimized

x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

x64-Run: [ShadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart

x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"

x64-Run: [3DG4me] C:\Windows\System\3DG4me.exe

x64-IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\UrlAdvisor\klwtbbho.dll

x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

x64-DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\

FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypchub.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Jonas Greiner\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll

FF - plugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\extensions\DeviceDetection@logitech.com\plugins\npLogitechDeviceDetection.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll

.

============= SERVICES / DRIVERS ===============

.

R0 CSCrySec;InfoWatch Encrypt Sector Library driver;C:\Windows\System32\drivers\CSCrySec.sys [2013-5-31 84536]

R0 fltsrv;Acronis Storage Filter Management;C:\Windows\System32\drivers\fltsrv.sys [2012-9-3 108832]

R0 mv91xx;mv91xx;C:\Windows\System32\drivers\mv91xx.sys [2010-7-1 293416]

R0 tib;Acronis TIB Manager;C:\Windows\System32\drivers\tib.sys [2013-5-29 1120032]

R0 tib_mounter;Acronis TIB Mounter;C:\Windows\System32\drivers\tib_mounter.sys [2013-5-29 183224]

R0 vididr;Acronis Virtual Disk;C:\Windows\System32\drivers\vididr.sys [2013-5-29 161568]

R0 vidsflt;Acronis Disk Storage Filter;C:\Windows\System32\drivers\vidsflt.sys [2012-9-3 117024]

R1 avkmgr;avkmgr;C:\Windows\System32\drivers\avkmgr.sys [2011-10-12 27760]

R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;C:\Windows\System32\drivers\CSVirtualDiskDrv.sys [2013-5-31 66616]

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2011-3-11 29792]

R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2012-10-18 54368]

R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2012-8-13 178448]

R2 afcdpsrv;Acronis Nonstop Backup Service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2013-5-29 3783672]

R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2011-10-12 98848]

R2 avp;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe -r --> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe -r [?]

R2 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-7-14 1390176]

R2 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-7-14 1767520]

R2 cpuz135;cpuz135;C:\Windows\System32\drivers\cpuz135_x64.sys [2012-2-15 21992]

R2 CSObjectsSrv;CryptoStorage control service;C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [2012-12-21 819040]

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2014-9-4 2525008]

R2 HerculesWiFi;HerculesWiFi;C:\Windows\SysWOW64\HerculesWiFiService.exe [2013-7-24 72488]

R2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [2014-8-8 377616]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-10-14 1871160]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-10-14 968504]

R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-29 1615192]

R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-29 20541216]

R2 RalinkRegistryWriter;Ralink Registry Writer;C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [2013-7-24 185632]

R2 RalinkRegistryWriter64;Ralink Registry Writer 64;C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe [2013-7-24 212256]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-4-20 411936]

R2 syncagentsrv;Acronis Sync Agent Service;C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [2013-3-21 7084672]

R2 TeamViewer6;TeamViewer 6;C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-7 2358656]

R3 afcdp;afcdp;C:\Windows\System32\drivers\afcdp.sys [2013-5-29 367200]

R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2012-9-3 29280]

R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2012-9-4 29280]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\System32\drivers\LGBusEnum.sys [2009-11-24 22408]

R3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;C:\Windows\System32\drivers\LGSHidFilt.Sys [2013-1-17 66800]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\System32\drivers\LGVirHid.sys [2009-11-24 16008]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-10-14 25816]

R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-10-14 129752]

R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\Windows\System32\drivers\mwac.sys [2014-10-14 63704]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-1-22 77824]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-1-22 180224]

R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2014-4-19 40392]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]

R3 USBADVAU;Sennheiser 3D G4ME1 Interface;C:\Windows\System32\drivers\cm11264.sys [2014-1-18 1308160]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2012-2-15 1342064]

S2 AntiVirSchedulerService;Avira Scheduler;"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" --> C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [?]

S2 AntiVirService;Avira Realtime Protection;"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" --> C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]

S2 mi-raysat_3dsmax2012_64;mental ray 3.9 Satellite for Autodesk 3ds Max 2012 64-bit - English 64-bit;C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe [2011-2-23 86016]

S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-10-26 1431888]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-9-11 111616]

S3 LADF_BakerCOnly;BakerC Filter Driver;C:\Windows\System32\drivers\ladfBakerCamd64.sys [2011-3-18 410184]

S3 LADF_BakerROnly;BakerR Filter Driver;C:\Windows\System32\drivers\ladfBakerRamd64.sys [2011-3-18 335688]

S3 LADF_CaptureOnly;LADF Capture Filter Driver;C:\Windows\System32\drivers\ladfGSCamd64.sys [2013-4-24 410008]

S3 LADF_RenderOnly;LADF Render Filter Driver;C:\Windows\System32\drivers\ladfGSRamd64.sys [2013-4-24 102808]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\System32\drivers\netr28x.sys [2013-7-24 787968]

S3 pwdrvio;pwdrvio;C:\Windows\System32\pwdrvio.sys [2011-12-27 19152]

S3 pwdspio;pwdspio;C:\Windows\System32\pwdspio.sys [2011-12-27 12504]

S3 RTL8192cu;Realtek RTL8192CU Wireless LAN 802.11n USB 2.0 Network Adapter;C:\Windows\System32\drivers\RTL8192cu.sys [2013-7-24 748648]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-9-18 1255736]

.

=============== Created Last 30 ================

.

2014-10-14 21:52:15 79064 ----a-w- C:\Windows\System32\drivers\qktulvd.sys

2014-10-14 21:38:42 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys

2014-10-14 21:38:42 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys

2014-10-14 21:38:42 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-14 21:10:44 98816 ----a-w- C:\Windows\sed.exe

2014-10-14 21:10:44 256000 ----a-w- C:\Windows\PEV.exe

2014-10-14 21:10:44 208896 ----a-w- C:\Windows\MBR.exe

2014-10-14 21:10:41 -------- d-s---w- C:\ComboFix

2014-10-14 20:53:16 -------- d-----w- C:\ProgramData\Malwarebytes

2014-10-14 20:53:04 129752 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys

2014-10-14 20:53:04 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-10-14 20:50:36 93400 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2014-10-14 12:54:45 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4745FF6C-88E9-4972-B08C-4583602442CA}\offreg.dll

2014-10-14 11:25:22 11578928 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4745FF6C-88E9-4972-B08C-4583602442CA}\mpengine.dll

2014-10-05 23:39:17 -------- d-----w- C:\$UPGRADE.~OS

2014-10-02 19:59:32 -------- d-----w- C:\Users\Jonas Greiner\AppData\Local\Unity

2014-10-01 15:42:58 519680 ----a-w- C:\Windows\SysWow64\qdvd.dll

2014-10-01 15:42:58 371712 ----a-w- C:\Windows\System32\qdvd.dll

2014-09-25 22:45:06 -------- d-----w- C:\Users\Jonas Greiner\AppData\Local\The Witcher 2

2014-09-25 11:07:50 -------- d-----w- C:\Users\Jonas Greiner\AppData\Local\Adobe

2014-09-24 13:02:25 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2014-09-24 13:02:25 2048 ----a-w- C:\Windows\System32\tzres.dll

2014-09-19 20:38:01 627600 ----a-w- C:\Windows\System32\deployJava1.dll

.

==================== Find3M  ====================

.

2014-09-23 22:06:49 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2014-09-23 22:06:49 701104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2014-09-15 07:06:02 278152 ------w- C:\Windows\System32\MpSigStub.exe

2014-09-05 02:10:43 578048 ----a-w- C:\Windows\System32\aepdu.dll

2014-09-05 02:05:42 424448 ----a-w- C:\Windows\System32\aeinv.dll

2014-08-23 02:07:00 404480 ----a-w- C:\Windows\System32\gdi32.dll

2014-08-23 01:45:55 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll

2014-08-23 00:59:01 3163648 ----a-w- C:\Windows\System32\win32k.sys

2014-08-18 22:29:49 2724864 ----a-w- C:\Windows\System32\mshtml.tlb

2014-08-18 22:29:35 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll

2014-08-18 22:19:53 5833728 ----a-w- C:\Windows\System32\jscript9.dll

2014-08-18 22:15:34 547328 ----a-w- C:\Windows\System32\vbscript.dll

2014-08-18 22:15:09 66048 ----a-w- C:\Windows\System32\iesetup.dll

2014-08-18 22:14:38 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll

2014-08-18 22:14:10 83968 ----a-w- C:\Windows\System32\MshtmlDac.dll

2014-08-18 22:08:55 4232704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2014-08-18 22:03:47 139264 ----a-w- C:\Windows\System32\ieUnatt.exe

2014-08-18 22:03:37 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe

2014-08-18 22:03:01 758272 ----a-w- C:\Windows\System32\jscript9diag.dll

2014-08-18 21:57:44 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2014-08-18 21:56:17 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe

2014-08-18 21:46:26 454656 ----a-w- C:\Windows\SysWow64\vbscript.dll

2014-08-18 21:45:23 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll

2014-08-18 21:45:12 72704 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll

2014-08-18 21:44:44 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll

2014-08-18 21:44:09 61952 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll

2014-08-18 21:36:07 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2014-08-18 21:35:24 597504 ----a-w- C:\Windows\SysWow64\jscript9diag.dll

2014-08-18 21:23:17 2104832 ----a-w- C:\Windows\System32\inetcpl.cpl

2014-08-18 21:23:16 1249280 ----a-w- C:\Windows\System32\mshtmlmedia.dll

2014-08-18 21:22:48 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll

2014-08-18 21:15:13 2310656 ----a-w- C:\Windows\System32\wininet.dll

2014-08-18 21:08:54 2014208 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2014-08-18 21:07:44 1068032 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll

2014-08-18 20:46:48 1812992 ----a-w- C:\Windows\SysWow64\wininet.dll

2014-08-01 11:53:22 1031168 ----a-w- C:\Windows\System32\TSWorkspace.dll

2014-08-01 11:35:06 793600 ----a-w- C:\Windows\SysWow64\TSWorkspace.dll

2014-07-25 00:35:46 875688 ----a-w- C:\Windows\SysWow64\msvcr120_clr0400.dll

2014-07-24 21:47:06 869544 ----a-w- C:\Windows\System32\msvcr120_clr0400.dll

.

============= FINISH:  0:04:22.20 ===============

 

 

 

Security Checkup:

 

 Results of screen317's Security Check version 0.99.88  

 Windows 7 Service Pack 1 x64 (UAC is disabled!)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

 Windows Firewall Disabled!  

Kaspersky PURE 3.0   

 Antivirus out of date! (On Access scanning disabled!) 

`````````Anti-malware/Other Utilities Check:````````` 

 Adobe Flash Player 15.0.0.152  

 Adobe Reader 10.1.12 Adobe Reader out of Date!  

 Mozilla Firefox (28.0) 

 Mozilla Thunderbird (17.0.6) 

 Google Chrome 37.0.2062.124  

 Google Chrome 38.0.2125.101  

````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbam.exe  

 Malwarebytes Anti-Malware mbamscheduler.exe   

 Kaspersky Lab Kaspersky PURE 3.0 avp.exe  

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0% 

````````````````````End of Log`````````````````````` 

 

[nasdaq]

Hello, Welcome to SpywareInfoForum.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===

Please download AdwCleaner by Xplode onto your Desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Click the Report button and the report will open in Notepad.

IMPORTANT

• If you click the Clean button all items listed in the report will be removed.

If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Check off the element(s) you wish to keep.
• Click on the Clean button follow the prompts.
• A log file will automatically open after the scan has finished.
• Please post the content of that log file with your next answer.
• You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).

===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Wait for further instructions.

[HorusI]

Hi Nasdaq, thanks a lot for the help.

 

I have pasted the requested logs below. The Addition log as attached as requested. As of now, the problem still exists. Services are still unable to start and/or missing from the Services list. 

 

Thank you very much,

 

HorusI

 

Adware Cleaner Log file before clean-up:

 

# AdwCleaner v4.000 - Report created 16/10/2014 at 16:03:41

# Updated 12/10/2014 by Xplode

# Database : 2014-10-15.7

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Jonas Greiner - JONASGREINER-PC

# Running from : D:\Jonas Data\New folder (3)\adwcleaner_4.000.exe

# Option : Scan

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

File Found : C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\11-suche.xml

File Found : C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\user.js

File Found : C:\Windows\SysWOW64\RegistryHelperLM.ocx

Folder Found : C:\Users\Jonas Greiner\AppData\Local\eSupport.com

Folder Found : C:\Users\Jonas Greiner\AppData\LocalLow\AVG Secure Search

 

***** [ Scheduled Tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Found : HKCU\Software\AVG Secure Search

Key Found : HKCU\Software\IGearSettings

Key Found : [x64] HKCU\Software\AVG Secure Search

Key Found : [x64] HKCU\Software\IGearSettings

Key Found : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Tencent

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17344

 

 

-\\ Mozilla Firefox v28.0 (en-US)

 

[d0xqpaog.default] - Line Found : user_pref("{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}.ScriptData_whiteListSearch", "{\"isearch.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"se[...]

 

-\\ Google Chrome v38.0.2125.101

 

 

*************************

 

AdwCleaner[R0].txt - [2305 octets] - [16/10/2014 16:03:41]

 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2365 octets] ##########

 

 

 

 

AdwCleaner Log after clean-up:

 

# AdwCleaner v4.000 - Report created 16/10/2014 at 16:15:08

# DB v2014-10-15.7

# Updated 12/10/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Jonas Greiner - JONASGREINER-PC

# Running from : D:\Jonas Data\New folder (3)\adwcleaner_4.000.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\Users\Jonas Greiner\AppData\LocalLow\AVG Secure Search

Folder Deleted : C:\Users\Jonas Greiner\AppData\Local\eSupport.com

File Deleted : C:\Windows\SysWOW64\RegistryHelperLM.ocx

File Deleted : C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\11-suche.xml

File Deleted : C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\user.js

 

***** [ Scheduled Tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}

Key Deleted : HKCU\Software\AVG Secure Search

Key Deleted : HKCU\Software\IGearSettings

Key Deleted : HKLM\SOFTWARE\Tencent

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17344

 

 

-\\ Mozilla Firefox v28.0 (en-US)

 

[d0xqpaog.default] - Line Deleted : user_pref("{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}.ScriptData_whiteListSearch", "{\"isearch.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"se[...]

 

-\\ Google Chrome v38.0.2125.101

 

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

 

*************************

 

AdwCleaner[R0].txt - [2457 octets] - [16/10/2014 16:03:41]

AdwCleaner[S0].txt - [2383 octets] - [16/10/2014 16:15:08]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2443 octets] ##########

 

 

 

 

Farbar recovery Scan Tool FRST Log:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-10-2014 02

Ran by Jonas Greiner (administrator) on JONASGREINER-PC on 16-10-2014 16:23:25

Running from D:\Jonas Data\New folder (3)

Loaded Profile: Jonas Greiner (Available profiles: Jonas Greiner)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Infowatch) C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

(Guillemot Corporation) C:\Windows\SysWOW64\HerculesWiFiService.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

() C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe

() C:\Windows\SysWOW64\NMSAccess32.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe

(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corporation) C:\Windows\System32\alg.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe

() C:\Windows\system\3DG4me.exe

(Google Inc.) C:\Users\Jonas Greiner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe

(Spotify Ltd) C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Spotify Ltd) C:\Users\Jonas Greiner\AppData\Roaming\Spotify\spotify.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaUI.exe

() C:\Program Files (x86)\Hercules\WiFi Station N\WiFiN.exe

(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe

(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe

(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe

(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe

(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDPOP3.exe

(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDRSS.exe

() C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

() C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe

(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [516928 2013-02-15] (Acronis)

HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [7477016 2013-04-25] (Logitech Inc.)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-17] (NVIDIA Corporation)

HKLM\...\Run: [3DG4me] => C:\Windows\System\3DG4me.exe [151552 2013-05-28] ()

HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [6365920 2013-03-28] (Acronis)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2472048 2010-08-11] (VIA)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2010-01-22] (NEC Electronics Corporation)

HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1103424 2013-01-10] (Acronis)

HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [356128 2013-10-21] (Kaspersky Lab ZAO)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3802448 2014-09-04] (LogMeIn Inc.)

HKLM\...\Policies\Explorer: [AllowLegacyWebView] 1

HKLM\...\Policies\Explorer: [AllowUnhashedWebView] 1

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Run: [Google Update] => C:\Users\Jonas Greiner\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-09] (Google Inc.)

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Run: [MusicManager] => C:\Users\Jonas Greiner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7631872 2014-07-23] (Google Inc.)

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Run: [Spotify Web Helper] => C:\Users\Jonas Greiner\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-08] (Spotify Ltd)

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Run: [Spotify] => C:\Users\Jonas Greiner\AppData\Roaming\Spotify\spotify.exe [6553144 2014-10-08] (Spotify Ltd)

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Run: [GoogleChromeAutoLaunch_ED62C97A9A654C625D6FA18D9338683E] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [854344 2014-10-01] (Google Inc.)

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)

HKU\S-1-5-21-1855080985-2381892401-1833874690-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CrashPlan Tray.lnk

ShortcutTarget: CrashPlan Tray.lnk -> C:\Program Files\CrashPlan\CrashPlanTray.exe (No File)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk

ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WiFi Station N.lnk

ShortcutTarget: WiFi Station N.lnk -> C:\Program Files (x86)\Hercules\WiFi Station N\WiFiN.exe ()

ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis)

ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis)

ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis)

ShellIconOverlayIdentifiers: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\shellex.dll (Kaspersky Lab ZAO)

ShellIconOverlayIdentifiers-x32: [KAVOverlayIcon] -> {dd230880-495a-11d1-b064-008048ec2fc5} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\shellex.dll (Kaspersky Lab ZAO)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

BHO-x32: Kaspersky Passsword Manager Toolbar -> {215BA832-75A3-426E-A4FC-7C5B58CE6A10} -> C:\PROGRA~2\KASPER~1\KASPER~2.0\KASPER~2\spIEBho.dll No File

BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

Toolbar: HKLM-x32 - Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\PROGRA~2\KASPER~1\KASPER~2.0\KASPER~2\spIEBho.dll No File

DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.co...sreqlab_nvd.cab

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

 

FireFox:

========

FF ProfilePath: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default

FF Homepage: https://www.google.com/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()

FF Plugin: @java.com/DTPlugin -> C:\Program Files\Java\jre7\bin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Jonas Greiner\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Jonas Greiner\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\webde-suche.xml

FF Extension: Разпознаване на устройство Logitech - C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\Extensions\DeviceDetection@logitech.com [2012-03-15]

FF Extension: Media Converter - C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\Extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18}.xpi [2011-12-04]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\url_advisor@kaspersky.com

FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\url_advisor@kaspersky.com [2013-05-31]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\virtual_keyboard@kaspersky.com

FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\virtual_keyboard@kaspersky.com [2013-05-31]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\content_blocker@kaspersky.com

FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\content_blocker@kaspersky.com [2013-05-31]

FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\anti_banner@kaspersky.com

FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\anti_banner@kaspersky.com [2013-05-31]

FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\online_banking@kaspersky.com

FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\online_banking@kaspersky.com [2013-05-31]

 

Chrome: 

=======

CHR HomePage: Default -> 

CHR Profile: C:\Users\Jonas Greiner\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Drive) - C:\Users\Jonas Greiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-09]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jonas Greiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-12]

CHR Extension: (YouTube) - C:\Users\Jonas Greiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-09]

CHR Extension: (Google-Suche) - C:\Users\Jonas Greiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-09]

CHR Extension: (Google Wallet) - C:\Users\Jonas Greiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-09]

CHR Extension: (Google Mail) - C:\Users\Jonas Greiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-09]

CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\urladvisor.crx [2013-11-11]

CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\online_banking_chrome.crx [2013-11-11]

CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\content_blocker_chrome.crx [2013-11-11]

CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\virtkbd.crx [2013-11-11]

CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\ab.crx [2013-11-11]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [356128 2013-10-21] (Kaspersky Lab ZAO)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 CSObjectsSrv; C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [819040 2012-12-21] (Infowatch)

R2 HerculesWiFi; C:\Windows\SysWOW64\\HerculesWiFiService.exe [72488 2010-11-17] (Guillemot Corporation)

R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-08-08] (LogMeIn, Inc.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

R2 mi-raysat_3dsmax2012_64; C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe [86016 2011-02-23] () [File not signed]

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-17] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-17] (NVIDIA Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-07-07] ()

S2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [X]

S2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [X]

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-08] (Avira GmbH)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-08] (Avira GmbH)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-16] (Avira GmbH)

R3 CMUSBDAC; C:\Windows\System32\DRIVERS\CMUSBDAC.sys [594944 2014-09-19] (C-MEDIA)

R0 CSCrySec; C:\Windows\System32\DRIVERS\CSCrySec.sys [84536 2011-06-02] (Infowatch)

R1 CSVirtualDiskDrv; C:\Windows\System32\DRIVERS\CSVirtualDiskDrv.sys [66616 2011-06-02] (Infowatch)

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-04-02] (Kaspersky Lab ZAO)

U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-10-21] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-10-21] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-04-02] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-21] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-21] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-24] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-24] (Kaspersky Lab ZAO)

S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [410184 2011-03-18] (Logitech)

S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [335688 2011-03-18] (Logitech)

R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-16] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)

S3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [158208 2011-04-27] (Microsoft Corporation) [File not signed]

S3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [288768 2011-07-09] (Microsoft Corporation) [File not signed]

S3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [128000 2011-04-27] (Microsoft Corporation) [File not signed]

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19152 2013-09-30] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()

S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-07-13] (Realtek Semiconductor Corporation                           )

R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2013-05-29] (Acronis International GmbH)

R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [183224 2013-05-29] (Acronis)

R3 USBADVAU; C:\Windows\System32\drivers\cm11264.sys [1308160 2009-11-25] (C-Media Electronics Inc)

R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2013-05-29] (Acronis International GmbH)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 lvpopf64; system32\DRIVERS\lvpopf64.sys [X]

S3 LVPr2M64; system32\DRIVERS\LVPr2M64.sys [X]

S3 LVRS64; system32\DRIVERS\lvrs64.sys [X]

S3 LVUVC64; system32\DRIVERS\lvuvc64.sys [X]

S3 motandroidusb; System32\Drivers\motoandroid.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2014-10-16 16:22 - 2014-10-16 16:23 - 00000000 ____D () C:\FRST

2014-10-16 16:03 - 2014-10-16 16:15 - 00000000 ____D () C:\AdwCleaner

2014-10-15 19:07 - 2014-10-15 19:07 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-10-15 19:06 - 2014-09-13 22:13 - 00613696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-10-15 18:58 - 2014-09-17 06:51 - 01538880 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2014-10-15 18:58 - 2014-09-17 06:51 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2014-10-15 18:58 - 2014-09-17 06:51 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 31887680 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 24552592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 19954520 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 14026304 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 13939272 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 13157696 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-10-15 18:58 - 2014-09-14 01:48 - 11392576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 11330776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 04287296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 04008592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 02838424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00984424 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00957584 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00925896 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00919240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00894096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00867528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00174856 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-10-15 18:58 - 2014-09-14 01:48 - 00156840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-10-15 18:36 - 2014-09-14 01:48 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434411.dll

2014-10-15 18:36 - 2014-09-14 01:48 - 01539272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434411.dll

2014-10-15 18:26 - 2014-10-07 04:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 18:26 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 18:26 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 18:26 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-10-15 18:26 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 18:26 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 18:26 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 18:26 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 18:26 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 18:26 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 18:26 - 2014-09-19 03:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-10-15 18:26 - 2014-09-19 03:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-10-15 18:26 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 18:26 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 18:26 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 18:26 - 2014-09-19 03:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-10-15 18:26 - 2014-09-19 03:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-10-15 18:26 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 18:26 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 18:26 - 2014-09-19 03:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-10-15 18:26 - 2014-09-19 03:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-10-15 18:26 - 2014-09-19 03:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-10-15 18:26 - 2014-09-19 03:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-10-15 18:26 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 18:26 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 18:26 - 2014-09-19 03:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-10-15 18:26 - 2014-09-19 03:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-10-15 18:26 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-10-15 18:26 - 2014-09-19 03:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-10-15 18:26 - 2014-09-19 03:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-10-15 18:26 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 18:26 - 2014-09-19 03:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-10-15 18:26 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-10-15 18:26 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-10-15 18:26 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 18:26 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 18:26 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 18:26 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 18:26 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-10-15 18:26 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-10-15 18:26 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-10-15 18:26 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-10-15 18:26 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-10-15 18:26 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 18:26 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 18:26 - 2014-09-19 02:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-10-15 18:26 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-10-15 18:26 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 18:26 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-10-15 18:26 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 18:26 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-10-15 18:26 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 18:26 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 18:26 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 18:26 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 18:26 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 18:19 - 2014-09-04 21:14 - 00038048 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2014-10-15 18:19 - 2014-09-04 21:14 - 00032416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2014-10-15 18:18 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 18:18 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll

2014-10-15 18:18 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll

2014-10-15 18:18 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll

2014-10-15 18:18 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll

2014-10-15 18:18 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll

2014-10-15 18:18 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll

2014-10-15 18:17 - 2014-08-19 05:11 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2014-10-15 18:17 - 2014-08-19 05:10 - 00616352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2014-10-15 18:17 - 2014-08-19 05:08 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2014-10-15 18:17 - 2014-08-19 05:08 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2014-10-15 18:17 - 2014-08-19 05:08 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2014-10-15 18:17 - 2014-08-19 05:07 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2014-10-15 18:17 - 2014-08-19 05:07 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2014-10-15 18:17 - 2014-08-19 05:07 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2014-10-15 18:17 - 2014-08-19 05:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2014-10-15 18:17 - 2014-08-19 05:07 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2014-10-15 18:17 - 2014-08-19 04:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2014-10-15 18:17 - 2014-08-19 04:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2014-10-15 18:17 - 2014-08-19 04:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2014-10-15 18:17 - 2014-07-07 04:07 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll

2014-10-15 18:17 - 2014-07-07 04:07 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll

2014-10-15 18:17 - 2014-07-07 04:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 05551032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-10-15 18:17 - 2014-07-07 04:06 - 04120576 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe

2014-10-15 18:17 - 2014-07-07 04:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe

2014-10-15 18:17 - 2014-07-07 04:06 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll

2014-10-15 18:17 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx

2014-10-15 18:17 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll

2014-10-15 18:17 - 2014-07-07 04:05 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL

2014-10-15 18:17 - 2014-07-07 04:05 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe

2014-10-15 18:17 - 2014-07-07 04:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll

2014-10-15 18:17 - 2014-07-07 03:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys

2014-10-15 18:17 - 2014-07-07 03:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll

2014-10-15 18:17 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx

2014-10-15 18:17 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll

2014-10-15 18:17 - 2014-07-07 03:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL

2014-10-15 18:17 - 2014-07-07 03:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-10-15 18:17 - 2014-07-07 03:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-10-15 18:17 - 2014-07-07 03:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe

2014-10-15 18:17 - 2014-07-07 03:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe

2014-10-15 18:17 - 2014-07-07 03:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll

2014-10-15 18:17 - 2014-06-28 02:21 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2014-10-15 18:17 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2014-10-15 18:17 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll

2014-10-15 18:16 - 2014-10-10 04:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-15 18:16 - 2014-10-10 04:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-15 18:16 - 2014-10-10 04:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-15 18:11 - 2014-09-18 04:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 18:11 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 18:10 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 18:10 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 18:10 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 18:10 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 18:10 - 2014-07-17 04:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-15 18:10 - 2014-07-17 04:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-10-15 18:10 - 2014-07-17 04:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-10-15 18:10 - 2014-07-17 04:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-10-15 18:10 - 2014-07-17 04:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll

2014-10-15 18:10 - 2014-07-17 04:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll

2014-10-15 18:10 - 2014-07-17 04:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-10-15 18:10 - 2014-07-17 04:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-10-15 18:10 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll

2014-10-15 18:10 - 2014-07-17 03:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-15 18:10 - 2014-07-17 03:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-10-15 18:10 - 2014-07-17 03:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll

2014-10-15 18:10 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-10-15 18:10 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-10-15 18:10 - 2014-07-17 03:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys

2014-10-15 18:10 - 2014-07-17 03:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2014-10-15 12:02 - 2014-10-16 16:16 - 00002160 _____ () C:\Windows\PFRO.log

2014-10-14 23:38 - 2014-10-14 23:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-14 23:38 - 2014-10-14 23:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-14 23:38 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-14 23:38 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-14 23:10 - 2014-10-14 23:20 - 00000000 ___SD () C:\ComboFix

2014-10-14 23:10 - 2014-10-14 23:10 - 00000000 ____D () C:\Windows\erdnt

2014-10-14 23:10 - 2014-10-14 23:10 - 00000000 ____D () C:\Qoobox

2014-10-14 23:10 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-10-14 23:10 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-10-14 23:10 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-10-14 23:10 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-10-14 23:10 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-10-14 23:10 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-10-14 23:10 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-10-14 23:10 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-10-14 22:53 - 2014-10-16 16:17 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-14 22:53 - 2014-10-14 23:38 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-14 22:53 - 2014-10-14 23:06 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-10-14 22:50 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers

• Back to top

[HorusI]

End of the FRST log and Addition log that I forgot to attach to the previous post:
 
 
2014-10-06 12:12 - 2014-10-06 12:12 - 00262144 _____ () C:\Windows\system32\config\userdiff
2014-10-06 01:42 - 2014-10-06 01:42 - 00000002 _____ () C:\$UpgDrv$
2014-10-06 01:39 - 2014-10-06 12:35 - 00000000 ____D () C:\$UPGRADE.~OS
2014-10-06 00:33 - 2014-10-06 00:33 - 00002144 _____ () C:\Users\Jonas Greiner\0
2014-10-02 21:59 - 2014-10-11 12:55 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Unity
2014-10-01 17:42 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 17:42 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-26 00:45 - 2014-09-26 00:45 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\The Witcher 2
2014-09-25 13:07 - 2014-10-15 21:22 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Adobe
2014-09-24 15:02 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 15:02 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-19 22:38 - 2014-09-19 22:37 - 00627600 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2014-09-19 22:38 - 2014-09-19 22:37 - 00252296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-09-19 22:38 - 2014-09-19 22:37 - 00188808 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-09-19 22:38 - 2014-09-19 22:37 - 00188808 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-09-19 22:37 - 2014-09-19 22:37 - 00000000 ____D () C:\Program Files\Java
2014-09-19 04:15 - 2014-09-19 04:15 - 00594944 _____ (C-MEDIA) C:\Windows\system32\Drivers\CMUSBDAC.sys
2014-09-19 04:15 - 2014-09-19 04:15 - 00233984 _____ (C-MEDIA) C:\Windows\system32\CMUSBDACASIO64.dll
2014-09-19 04:15 - 2014-09-19 04:15 - 00206848 _____ (C-MEDIA) C:\Windows\SysWOW64\CMUSBDACASIO.dll
2014-09-17 10:52 - 2014-10-08 08:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-10-16 16:23 - 2009-07-14 07:13 - 00006398 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-16 16:21 - 2011-09-18 00:58 - 02092389 _____ () C:\Windows\WindowsUpdate.log
2014-10-16 16:19 - 2013-11-01 16:21 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Spotify
2014-10-16 16:19 - 2012-06-20 17:42 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-10-16 16:19 - 2011-09-27 23:41 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Skype
2014-10-16 16:18 - 2014-07-04 15:02 - 00000000 ___RD () C:\Users\Jonas Greiner\Google Drive
2014-10-16 16:18 - 2012-06-21 21:32 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\LogMeIn Hamachi
2014-10-16 16:17 - 2014-04-12 13:23 - 00033306 _____ () C:\Windows\setupact.log
2014-10-16 16:17 - 2014-04-09 23:11 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-16 16:16 - 2012-07-26 19:19 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-16 16:16 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-16 16:07 - 2009-07-14 06:45 - 00029136 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-16 16:07 - 2009-07-14 06:45 - 00029136 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-16 16:06 - 2012-05-05 03:45 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-15 23:06 - 2012-04-02 03:04 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\TS3Client
2014-10-15 22:49 - 2013-08-09 12:34 - 00000940 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1855080985-2381892401-1833874690-1000UA.job
2014-10-15 22:32 - 2014-04-09 23:11 - 00000912 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-15 21:59 - 2011-09-18 23:55 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-15 21:21 - 2012-05-05 03:45 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-15 21:21 - 2012-05-05 03:45 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-15 21:21 - 2011-09-18 19:52 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-15 20:00 - 2011-10-15 16:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-10-15 19:59 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-10-15 19:56 - 2009-07-14 06:45 - 00904600 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-15 19:18 - 2014-05-12 22:27 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-15 19:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-10-15 19:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-10-15 19:06 - 2013-05-20 06:05 - 00000000 ____D () C:\Temp
2014-10-15 19:06 - 2011-09-18 01:05 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-10-15 18:56 - 2013-07-31 16:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-15 18:41 - 2011-09-18 23:52 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 18:37 - 2011-09-18 01:05 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-10-15 18:21 - 2013-12-29 00:08 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\NVIDIA Corporation
2014-10-15 17:47 - 2014-04-19 23:32 - 00007606 _____ () C:\Users\Jonas Greiner\AppData\Local\Resmon.ResmonCfg
2014-10-15 12:49 - 2013-08-09 12:34 - 00000888 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1855080985-2381892401-1833874690-1000Core.job
2014-10-15 12:05 - 2013-11-01 16:22 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Spotify
2014-10-15 12:02 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-10-13 15:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-11 16:51 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-11 16:50 - 2014-05-23 19:27 - 00216756 _____ () C:\Windows\DirectX.log
2014-10-11 16:45 - 2011-10-02 23:35 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-10-11 02:48 - 2011-09-18 00:59 - 00000000 ____D () C:\Users\Jonas Greiner
2014-10-10 23:40 - 2011-12-25 02:30 - 00000000 ___HD () C:\Users\Jonas Greiner\AppData\Local\Ubisoft Game Launcher
2014-10-10 21:01 - 2014-05-26 15:11 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\ftblauncher
2014-10-10 00:35 - 2013-08-19 22:11 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Battle.net
2014-10-09 16:07 - 2012-06-02 00:42 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-10-09 15:42 - 2013-11-01 21:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-10-09 15:39 - 2013-08-19 22:11 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-10-08 17:10 - 2012-11-15 01:35 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\ftblauncher
2014-10-08 08:33 - 2014-07-04 15:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-10-08 08:32 - 2014-05-29 13:45 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-10-08 08:32 - 2014-04-09 15:31 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls Online
2014-10-08 08:32 - 2013-08-19 22:11 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Battle.net
2014-10-08 08:32 - 2013-08-09 12:34 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Manager
2014-10-08 08:32 - 2013-07-24 12:55 - 00000000 ____D () C:\Windows\Hercules WiFiN
2014-10-08 08:32 - 2013-06-20 00:51 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Downloaded Installations
2014-10-08 08:32 - 2013-05-31 21:50 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-10-08 08:32 - 2013-02-24 02:53 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinGrooves
2014-10-08 08:32 - 2012-12-29 02:39 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Ventrilo
2014-10-08 08:32 - 2012-12-29 02:39 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ventrilo
2014-10-08 08:32 - 2012-12-23 05:19 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Universe Sandbox
2014-10-08 08:32 - 2012-11-18 19:11 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse
2014-10-08 08:32 - 2012-10-04 03:13 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZeuX and r4wk
2014-10-08 08:32 - 2012-09-18 23:20 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Eclipse
2014-10-08 08:32 - 2012-07-07 20:07 - 00000000 ____D () C:\Windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP
2014-10-08 08:32 - 2012-06-26 03:33 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\.techniclauncher
2014-10-08 08:32 - 2012-06-26 03:17 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\.minecraft
2014-10-08 08:32 - 2012-02-17 12:55 - 00000000 ____D () C:\Windows\pss
2014-10-08 08:32 - 2012-02-15 14:20 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Marvell
2014-10-08 08:32 - 2012-02-15 14:19 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Downloaded Installations
2014-10-08 08:32 - 2011-11-18 04:18 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-10-08 08:32 - 2011-11-18 01:14 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-10-08 08:32 - 2011-11-13 22:25 - 00000000 ____D () C:\Windows\system32\Macromed
2014-10-08 08:32 - 2011-11-07 19:28 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-10-08 08:32 - 2011-11-04 02:14 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Audacity
2014-10-08 08:32 - 2011-11-01 20:40 - 00000000 ____D () C:\Windows\en
2014-10-08 08:32 - 2011-10-12 22:13 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-10-08 08:32 - 2011-09-18 19:52 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2014-10-08 08:32 - 2011-09-18 00:59 - 00000000 ___RD () C:\Users\Jonas Greiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-10-08 08:32 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files\Windows Portable Devices
2014-10-08 08:32 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices
2014-10-08 08:32 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\sr-Latn-CS
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Recovery
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\migwiz
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\InstallShield
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\zh-HK
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\tr-TR
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\sr-Latn-CS
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\spool
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\oobe
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\IME
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help
2014-10-08 08:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-10-08 08:31 - 2014-09-10 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-10-08 08:31 - 2014-09-10 17:42 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-10-08 08:31 - 2014-07-19 20:14 - 00000000 ____D () C:\ProgramData\Riot Games
2014-10-08 08:31 - 2014-06-01 20:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCSOFT
2014-10-08 08:31 - 2014-05-23 19:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cornelsen
2014-10-08 08:31 - 2014-04-09 23:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-10-08 08:31 - 2014-04-09 23:11 - 00000000 ____D () C:\Program Files (x86)\Google
2014-10-08 08:31 - 2014-04-09 00:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniTool Partition Wizard Home Edition 8.1.1
2014-10-08 08:31 - 2014-04-09 00:00 - 00000000 ____D () C:\Program Files (x86)\MiniTool Partition Wizard Home Edition 8.1.1
2014-10-08 08:31 - 2014-04-02 14:28 - 00000000 ____D () C:\Program Files (x86)\Free Mouse Auto Clicker
2014-10-08 08:31 - 2014-03-29 15:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-08 08:31 - 2013-12-30 02:46 - 00000000 ____D () C:\Program Files (x86)\Sid Meier's Pirates
2014-10-08 08:31 - 2013-12-28 01:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ascaron Entertainment
2014-10-08 08:31 - 2013-11-01 21:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-10-08 08:31 - 2013-08-19 22:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-10-08 08:31 - 2013-07-24 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cube World
2014-10-08 08:31 - 2013-07-24 13:29 - 00000000 ____D () C:\Program Files (x86)\Cube World
2014-10-08 08:31 - 2013-07-24 12:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hercules
2014-10-08 08:31 - 2013-07-24 11:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ralink Wireless
2014-10-08 08:31 - 2013-06-20 00:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\osu!
2014-10-08 08:31 - 2013-06-20 00:51 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-10-08 08:31 - 2013-05-31 21:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky PURE 3.0
2014-10-08 08:31 - 2013-05-31 21:25 - 00000000 ____D () C:\ProgramData\Visan
2014-10-08 08:31 - 2013-05-14 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-10-08 08:31 - 2013-05-09 00:23 - 00000000 ____D () C:\Program Files\DIFX
2014-10-08 08:31 - 2013-02-24 03:40 - 00000000 ____D () C:\ProgramData\VS Revo Group
2014-10-08 08:31 - 2013-02-24 02:04 - 00000000 ____D () C:\Program Files (x86)\GrooveWalrus
2014-10-08 08:31 - 2013-02-07 03:13 - 00000000 ____D () C:\Program Files\Logitech Gaming Software
2014-10-08 08:31 - 2012-12-29 02:39 - 00000000 ____D () C:\Program Files\Ventrilo
2014-10-08 08:31 - 2012-12-25 23:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
2014-10-08 08:31 - 2012-12-25 22:26 - 00000000 ____D () C:\Program Files (x86)\League of Legends
2014-10-08 08:31 - 2012-10-14 20:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-10-08 08:31 - 2012-10-14 20:07 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-10-08 08:31 - 2012-06-02 00:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
2014-10-08 08:31 - 2012-05-17 08:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-08 08:31 - 2012-05-17 08:08 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-08 08:31 - 2012-05-12 04:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-10-08 08:31 - 2012-05-12 04:37 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-10-08 08:31 - 2012-05-12 04:37 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-10-08 08:31 - 2012-04-26 14:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-08 08:31 - 2012-04-02 03:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-10-08 08:31 - 2012-04-02 03:03 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-10-08 08:31 - 2012-03-26 22:27 - 00000000 ____D () C:\ProgramData\Protexis64
2014-10-08 08:31 - 2012-03-15 00:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
2014-10-08 08:31 - 2012-03-15 00:49 - 00000000 ____D () C:\Program Files (x86)\ASUS
2014-10-08 08:31 - 2012-03-03 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WD Discovery Software
2014-10-08 08:31 - 2012-03-03 18:32 - 00000000 ____D () C:\Program Files (x86)\Western Digital
2014-10-08 08:31 - 2012-02-24 19:47 - 00000000 ____D () C:\ProgramData\Protexis
2014-10-08 08:31 - 2012-02-24 18:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 9.0
2014-10-08 08:31 - 2012-02-15 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
2014-10-08 08:31 - 2012-02-15 14:20 - 00000000 ____D () C:\Program Files (x86)\Marvell
2014-10-08 08:31 - 2012-02-15 14:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEC Electronics
2014-10-08 08:31 - 2012-02-15 14:16 - 00000000 ____D () C:\Program Files (x86)\VIA
2014-10-08 08:31 - 2012-02-08 23:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow
2014-10-08 08:31 - 2012-02-08 23:04 - 00000000 ____D () C:\Program Files (x86)\ffdshow
2014-10-08 08:31 - 2012-01-07 05:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-10-08 08:31 - 2012-01-07 05:03 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-10-08 08:31 - 2012-01-01 22:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-10-08 08:31 - 2011-11-17 23:35 - 00000000 ____D () C:\Program Files (x86)\MP3 to WAV Decoder
2014-10-08 08:31 - 2011-11-07 20:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-08 08:31 - 2011-11-04 03:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-10-08 08:31 - 2011-11-04 02:14 - 00000000 ____D () C:\Program Files (x86)\Audacity 1.3 Beta (Unicode)
2014-10-08 08:31 - 2011-11-01 20:36 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-10-08 08:31 - 2011-10-28 23:18 - 00000000 ____D () C:\Program Files (x86)\HP
2014-10-08 08:31 - 2011-10-26 23:45 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-10-08 08:31 - 2011-10-26 23:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2014-10-08 08:31 - 2011-10-26 23:39 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2014-10-08 08:31 - 2011-10-12 22:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-10-08 08:31 - 2011-10-12 22:13 - 00000000 ____D () C:\Program Files\WinRAR
2014-10-08 08:31 - 2011-10-05 03:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2014-10-08 08:31 - 2011-10-05 00:53 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
2014-10-08 08:31 - 2011-10-05 00:53 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3
2014-10-08 08:31 - 2011-09-28 01:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2014-10-08 08:31 - 2011-09-28 00:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2014-10-08 08:31 - 2011-09-28 00:21 - 00000000 ____D () C:\Program Files (x86)\Notepad++
2014-10-08 08:31 - 2011-09-27 23:47 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2014-10-08 08:31 - 2011-09-27 23:41 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-08 08:31 - 2011-09-27 23:41 - 00000000 ____D () C:\ProgramData\Skype
2014-10-08 08:31 - 2011-09-18 23:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2014-10-08 08:31 - 2011-09-18 01:05 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-10-08 08:31 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-08 08:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-10-08 08:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-08 08:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-10-08 08:21 - 2011-12-25 01:55 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Ubisoft
2014-10-08 08:21 - 2011-12-23 19:56 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\SoftGrid Client
2014-10-08 08:21 - 2011-09-28 00:21 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Notepad++
2014-10-08 08:21 - 2011-09-18 23:48 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Thunderbird
2014-10-08 08:19 - 2012-07-26 19:12 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-10-08 08:15 - 2014-04-09 15:08 - 00000000 ____D () C:\Program Files (x86)\Zenimax Online
2014-10-08 08:10 - 2011-11-03 03:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-10-08 08:09 - 2012-06-20 17:42 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-10-06 14:03 - 2014-05-27 17:54 - 00000000 __SHD () C:\Users\Jonas Greiner\AppData\Local\EmieUserList
2014-10-06 14:03 - 2014-05-27 17:54 - 00000000 __SHD () C:\Users\Jonas Greiner\AppData\Local\EmieSiteList
2014-10-06 14:00 - 2014-04-10 00:00 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Awesomium
2014-10-06 14:00 - 2014-03-02 18:26 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Tropico 4
2014-10-06 14:00 - 2013-05-29 20:59 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\87866FD5-799E-4C6C-B6C7-21747DC288A0
2014-10-06 14:00 - 2013-04-05 23:58 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\Curse Advertising
2014-10-06 14:00 - 2013-02-24 02:04 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\GrooveWalrus
2014-10-06 14:00 - 2012-12-23 05:19 - 00000000 __SHD () C:\Users\Jonas Greiner\AppData\Roaming\wyUpdate AU
2014-10-06 14:00 - 2012-10-04 03:14 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\Techne
2014-10-06 14:00 - 2012-05-17 08:42 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Roaming\TeamViewer
2014-10-06 14:00 - 2012-02-15 14:05 - 00000000 ___HD () C:\Users\Jonas Greiner\AppData\Roaming\Download Manager
2014-10-06 14:00 - 2011-12-17 04:53 - 00000000 ___HD () C:\Users\Jonas Greiner\AppData\Roaming\HpUpdate
2014-10-06 14:00 - 2011-11-01 20:34 - 00000000 ___HD () C:\Users\Jonas Greiner\AppData\Local\Windows Live
2014-10-06 14:00 - 2011-10-12 22:13 - 00000000 ___HD () C:\Users\Jonas Greiner\AppData\Roaming\WinRAR
2014-10-06 13:59 - 2014-05-29 15:47 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\S2
2014-10-06 13:59 - 2012-02-09 02:13 - 00000000 ___HD () C:\Users\Jonas Greiner\AppData\Local\Skyrim
2014-10-06 13:59 - 2011-11-18 04:17 - 00000000 ___HD () C:\Users\Jonas Greiner\AppData\Local\Oblivion
2014-10-06 13:58 - 2014-05-30 12:37 - 00000000 ____D () C:\Users\Jonas Greiner\.ssh
2014-10-06 13:58 - 2012-08-16 21:33 - 00000000 ____D () C:\ProgramData\CrashPlan
2014-10-06 13:58 - 2011-10-28 23:47 - 00000000 ___HD () C:\ProgramData\WEBREG
2014-10-06 13:58 - 2011-10-15 16:47 - 00000000 ____D () C:\Users\Sabine
2014-10-06 13:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Recovery
2014-10-06 13:57 - 2014-04-09 15:08 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-10-06 13:52 - 2011-10-20 03:43 - 00000000 ___HD () C:\Program Files (x86)\MSXML 4.0
2014-10-06 13:52 - 2011-09-25 17:55 - 00000000 ___HD () C:\Program Files (x86)\jv16 PowerTools 2010
2014-10-05 13:48 - 2011-12-25 02:29 - 00000000 ___HD () C:\ProgramData\Solidshield
2014-09-26 11:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-26 00:45 - 2013-05-09 19:03 - 00271880 _____ () C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT
2014-09-26 00:40 - 2014-08-25 23:27 - 00000000 ____D () C:\Users\Jonas Greiner\AppData\Local\The Witcher
2014-09-19 15:52 - 2014-06-27 21:14 - 00000088 _____ () C:\Users\Jonas Greiner\.atl.properties
2014-09-19 13:17 - 2011-10-18 02:34 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-17 10:37 - 2014-04-12 11:56 - 00000000 ____D () C:\ProgramData\Oracle
 
Some content of TEMP:
====================
C:\Users\Jonas Greiner\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Jonas Greiner\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\Jonas Greiner\AppData\Local\Temp\nvStInst.exe
C:\Users\Jonas Greiner\AppData\Local\Temp\Quarantine.exe
C:\Users\Jonas Greiner\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-10-06 04:45
 
==================== End Of Log ============================

Attached Files

•  Addition.txt   48.59KB   222 downloads

[nasdaq]

Sorry for this delay. I had technical difficulties.

 

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.

 

 
start
 
HKLM-x32\...\Run: [] => [X]
ShortcutTarget: CrashPlan Tray.lnk -> C:\Program Files\CrashPlan\CrashPlanTray.exe (No File)
BHO-x32: Kaspersky Passsword Manager Toolbar -> {215BA832-75A3-426E-A4FC-7C5B58CE6A10} -> C:\PROGRA~2\KASPER~1\KASPER~2.0\KASPER~2\spIEBho.dll No File
Toolbar: HKLM-x32 - Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\PROGRA~2\KASPER~1\KASPER~2.0\KASPER~2\spIEBho.dll No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\webde-suche.xml
S2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [X]
S2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 lvpopf64; system32\DRIVERS\lvpopf64.sys [X]
S3 LVPr2M64; system32\DRIVERS\LVPr2M64.sys [X]
S3 LVRS64; system32\DRIVERS\lvrs64.sys [X]
S3 LVUVC64; system32\DRIVERS\lvuvc64.sys [X]
S3 motandroidusb; System32\Drivers\motoandroid.sys [X]
Task: {89A09382-9BBB-4BFE-9784-F3876BB73682} - \FF Watcher {6939950A-4B77-47C8-AB9F-7218BBD54BFB} No Task File <==== ATTENTION
 
End

Save the files as fixlist.txt into the same folder as FRST

 

Run FRST and click Fix only once and wait.

 

Restart the computer normally to reset the registry.

 

The tool will create a log (Fixlog.txt) please post it to your reply.

===

 

As of now, the problem still exists. Services are still unable to start and/or missing from the Services list.

 

 

Download   Farbar's Service Scanner utility

http://www.bleepingc...-scanner/dl/62/

and Save to your Desktop.

If using Windows 7 or Vista, Right-Click on fss.exe and select Run As Admisnitrator.

If using XP, double-click to start.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are checkmarked:

Internet Services

Windows Firewall

System Restore

Security Center/Action Center

Windows Update

Windows Defender

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.

Copy & Paste contents of FSS.txt into your reply.

 

 

 

 

[HorusI]

Sorry for the late response, here the two requested logs. Thanks a lot for your help.

 

Fixlog:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-10-2014

Ran by Jonas Greiner at 2014-10-20 00:49:19 Run:1

Running from D:\Jonas Data\New folder (3)

Loaded Profile: Jonas Greiner (Available profiles: Jonas Greiner)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

start

 

HKLM-x32\...\Run: [] => [X]

ShortcutTarget: CrashPlan Tray.lnk -> C:\Program Files\CrashPlan\CrashPlanTray.exe (No File)

BHO-x32: Kaspersky Passsword Manager Toolbar -> {215BA832-75A3-426E-A4FC-7C5B58CE6A10} -> C:\PROGRA~2\KASPER~1\KASPER~2.0\KASPER~2\spIEBho.dll No File

Toolbar: HKLM-x32 - Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\PROGRA~2\KASPER~1\KASPER~2.0\KASPER~2\spIEBho.dll No File

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\webde-suche.xml

S2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [X]

S2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [X]

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 lvpopf64; system32\DRIVERS\lvpopf64.sys [X]

S3 LVPr2M64; system32\DRIVERS\LVPr2M64.sys [X]

S3 LVRS64; system32\DRIVERS\lvrs64.sys [X]

S3 LVUVC64; system32\DRIVERS\lvuvc64.sys [X]

S3 motandroidusb; System32\Drivers\motoandroid.sys [X]

Task: {89A09382-9BBB-4BFE-9784-F3876BB73682} - \FF Watcher {6939950A-4B77-47C8-AB9F-7218BBD54BFB} No Task File <==== ATTENTION

 

End

*****************

 

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.

C:\Program Files\CrashPlan\CrashPlanTray.exe not found.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{215BA832-75A3-426E-A4FC-7C5B58CE6A10}" => Key deleted successfully.

"HKCR\Wow6432Node\CLSID\{215BA832-75A3-426E-A4FC-7C5B58CE6A10}" => Key deleted successfully.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{215BA832-75A3-426E-A4FC-7C5B58CE6A10} => value deleted successfully.

"HKCR\Wow6432Node\CLSID\{215BA832-75A3-426E-A4FC-7C5B58CE6A10}" => Key not found.

"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully.

C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\gmx-suche.xml => Moved successfully.

C:\Users\Jonas Greiner\AppData\Roaming\Mozilla\Firefox\Profiles\d0xqpaog.default\searchplugins\webde-suche.xml => Moved successfully.

AntiVirSchedulerService => Error deleting Service

AntiVirService => Error deleting Service

catchme => Service deleted successfully.

EagleX64 => Service deleted successfully.

lvpopf64 => Service deleted successfully.

LVPr2M64 => Service deleted successfully.

LVRS64 => Service deleted successfully.

LVUVC64 => Service deleted successfully.

motandroidusb => Service deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{89A09382-9BBB-4BFE-9784-F3876BB73682}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{89A09382-9BBB-4BFE-9784-F3876BB73682}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FF Watcher {6939950A-4B77-47C8-AB9F-7218BBD54BFB}" => Key deleted successfully.

 

==== End of Fixlog ====

 

FSS:

 

Farbar Service Scanner Version: 21-07-2014

Ran by Jonas Greiner (administrator) on 21-10-2014 at 13:00:11

Running from "D:\Jonas Data\New folder (3)"

Microsoft Windows 7 Home Premium  Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

 

Internet Services:

============

 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.

 

 

Windows Firewall:

=============

 

Firewall Disabled Policy: 

==================

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall"=DWORD:0

 

 

System Restore:

============

 

System Restore Disabled Policy: 

========================

 

 

Action Center:

============

 

 

Windows Update:

============

 

Windows Autoupdate Disabled Policy: 

============================

 

 

Windows Defender:

==============

 

Other Services:

==============

 

 

File Check:

========

C:\Windows\System32\nsisvc.dll => File is digitally signed

C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed

C:\Windows\System32\dhcpcore.dll => File is digitally signed

C:\Windows\System32\drivers\afd.sys => File is digitally signed

C:\Windows\System32\drivers\tdx.sys => File is digitally signed

C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed

C:\Windows\System32\dnsrslvr.dll => File is digitally signed

C:\Windows\System32\mpssvc.dll => File is digitally signed

C:\Windows\System32\bfe.dll => File is digitally signed

C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed

C:\Windows\System32\SDRSVC.dll => File is digitally signed

C:\Windows\System32\vssvc.exe => File is digitally signed

C:\Windows\System32\wscsvc.dll => File is digitally signed

C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed

C:\Windows\System32\wuaueng.dll => File is digitally signed

C:\Windows\System32\qmgr.dll => File is digitally signed

C:\Windows\System32\es.dll => File is digitally signed

C:\Windows\System32\cryptsvc.dll => File is digitally signed

C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

 

 

**** End of log ****

[nasdaq]

 

Reset the following registry settings.

 

Tweaking.com - Windows Repair (All In One) Tips

 

Go to this page and download the Installer from one of the recommended sites.

http://www.tweaking....all_in_one.html

 

Un-zip the file tweaking.com_windows_repair_aio.zip to the default folder.

 

Close all running Windows and programs.

 

Run the application and referring to the image on the site select the following items.

 

03 - Reset Service permissions

10 - Remove Policies Set By Infections

26 - Restore Important Windows Services

27 - Set Windows Service to Default Startup

 

Click the Start Repair button.

Let it finish.

 

Restart the computer normally.

 

How is the computer running now?

[HorusI]

Thanks for the fast response. I did Tweaking repair and during the repair the command window several times said "Access denied." Some of the repairs did go though but the Workstation service is still unable to start and the dependency services are missing.

[nasdaq]

 

Create a restore point. Windows 7.

http://windows.micro...a-restore-point

 

Refer to this page.

http://www.sevenforu...indows-7-a.html

 

Download the .reg file for  Workstation LanmanWorkstation

 

Follow the instructions on the page to merge it with the registry.

 

Restart the computer normally.

 

If something goes wrong the you will have a restore point to return to.

 

How is it now.

[HorusI]

Sorry for the late reply, I had a busy weekend and did not want to risk my computer not working when I need it to. I merged the Workstation service and everything started normally. There was no need for the restore point but nothing changed. The service is still unable to start. I tried looking for the dependency services as they seem to be the problem but they were not listed on the website you gave me. Thank you very much for your reply anyways! I hope we can still try to fix this problem without reinstalling.

[nasdaq]

Refer to this article.

 

http://computerstepb...on_service.html

 

Check the settings on your computer. Maybe you can find a solution.

 

Keep me posted.

[nasdaq]

Are you still with me?

[HorusI]

Sorry, I am a bit busy at the moment.

 

I went through the steps on the website. The problem seems to be that the dependency services are missing. This includes the Browser Support Driver, Network Store Interface Service, SMB 1.x MiniRedirector and SMB 2.0 MiniRedirector. Network Store Interface Service is the only one I am able to find. It is started so i doubt that is the problem. The other three are not in the Services menu. I am not sure if they are supposed to be. I feel like thats where the problem is. The other steps on the site did not help other then telling me that the dependencies are what seems to be the problem.

 

Thanks a lot for the replies. Maybe we can try and fix the missing services in order to get the Workstation to start again. 

[nasdaq]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation

 

and import it to the problem computer?

 

You can follow the instructions on this page.

 

https://social.techn...rum=winserverPN

 

The important thing is to create a restore point on both computer.

If somethings goes wrong then you can restore your computer.

 

As explained in the article if that fails you will have to perform an In-place Upgrade.

How to Perform an In-Place Upgrade on Windows Vista, Windows 7, Windows Server 2008 & Windows Server 2008 R2

 

Read the article before proceeding.

 

You can also try to run the SFC.EXE (System File Checker) instructions on the page.

 

===

 

One other option is to create a new topic in the Windows 7 forum

http://www.bleepingc.../167/windows-7/

 

Some one may be able to supply you with restoring your registry key.

[HorusI]

Well I found the exact article when I tried to solve the problem by myself before coming to this forum. I tried repairing the lanman workstation from my Windows 7 boot disk. That did not fix it. I tried sfc scannow and it found problems but was unable to fix them. Then I decided to do the In-place upgrade. It was working, copying and rebooting for 90 minutes or so. Then it said that the in-place upgrade had failed and that my system has been restored to its previous state. It did not give me a reason why it was unable to finish the in-place upgrade. Anything else I could do to try and solve the problem? Thanks a lot for the reply and the help!

[nasdaq]

Try this tool.

 

Tweaking.com - Windows Repair (All In One) Tips

 

Go to this page and download the Installer from one of the recommended sites.

http://www.tweaking....all_in_one.html

 

Un-zip the file tweaking.com_windows_repair_aio.zip to the default folder.

 

Close all running Windows and programs.

 

Run the application and referring to the image on the site select all the items execept the 3 referring to Windows 8.

 

 

 

Click the Start Repair button.

Let it finish.

 

Restart the computer normally.

 

How is the computer running now?

[HorusI]

Sorry again for the super late reply. After several failed starts and repairs, the Tweaking repairs went through. Unfortunately they still did not fix my problem.

Any other ideas what I might be able to do to fix this short of reinstalling Windows? Thank you for the help so far!

[nasdaq]

This problem is no longer associated with Malware and not my forte.

 

I suggest you start a new topic in this forum.

 

http://www.bleepingc.../167/windows-7/

 

An expert will be able to help you better than I can.

 

I will leave this topic open ir you need to return please do.

[HorusI]

Alright, thank you very much! I will try it over there. Maybe the easiest will just be to reinstall. Thank you!

[nasdaq]

Since the issue appears to be resolved this Topic is closed.

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.