Jump to content

Booker

Members
  • Posts

    9
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Given possible language problems (German messages), we have turned yesterday for the Tencent issue to a German speaking forum. As soon as this is solved, we may come back and aks for help with the connection to the update server. So for the time being, please regard this request as on hold. @dallaslewis : please open your own thread, as your situation might be different regarding environment, infection status, versions or other parameters. Thanks Booker
  2. Thank you, daledoc1. Does this mean, we have reached the end here, regarding the issue of "no connection to the update Server" ? Or is there anything more, we can do ? Or is this issue of no connection to the update server, shifted to the "Malware Removel Help" Forum as well ? Thanks Booker
  3. Thank you daledoc1. In your firt reply you directed us to : https://forums.malwarebytes.org/index.php?/topic/148004-mbam-pro-makes-avira-gui-very-slow/?p=826365 In there, at the end of " Note: If using a software firewall besides the built in Windows Firewall you'll need to exclude them from it as well For Windows XP: C:\Program Files\Malwarebytes Anti-Malware\mbam.exeC:\Program Files\Malwarebytes Anti-Malware\mbamdor.exeC:\Program Files\Malwarebytes Anti-Malware\mbampt.exeC:\Program Files\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exeFor Windows Vista or Windows 7 & 8: C:\Program Files\Malwarebytes Anti-Malware\mbam.exeC:\Program Files\Malwarebytes Anti-Malware\mbamdor.exeC:\Program Files\Malwarebytes Anti-Malware\mbampt.exeC:\Program Files\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exeFor 64 bit versions of Windows Vista or Windows 7 & 8: C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamdor.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbampt.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware \mbamscheduler.exeNote: If using a software firewall besides the built in Windows Firewall you'll need to exclude MBAM.EXE and MBAMSERVICE.EXE from it as well Note: Once that's done, please make sure that if either of those programs has any sort of web filter, that you add the following as a trusted site: data-cdn.mbamupdates.com The FAQ contains examples of setting file exclusions for some known AV products " Is a link to the FAQ, namely : https://forums.malwarebytes.org//index.php?showtopic=10138 which gives a firefox browser message " network timeout". Regarding Avira, it may be the case, that there is in the Fee Avira product no software firewall. Hopefully someone can confirm this. Thanks Booker
  4. Hi, we are in the Malwarebyte Forum "Malwarebytes Anti-Malware Help" in contact with a member trying to resolve the "#2 unable to access server" problem. We are not successfull yet, but had run already the FRST tool. So suggestion there was, to post this here in order to solve issue "#1 Tencent" which we are not able to remove. We don't know at this point in time, if both issues are linked. Therefor the introductory words about the issue #2. In addition we have a geographic problem, as the infected machine is a German Win 8.1 machine with AntiMalwareBateyPro located inthe UK, while I write out of Germany. So logs are in German. We hope that this is not a problem and you could help us anyhow. If not, please let us know where to turn to. Please be patient also with us, as we need to transmit to the UK for follow-up. FRST : see attached file ADDITIONS : see attached file CHECKRESULTS see attached file Thanks for your support. Booker CheckResults.txt additions.txt FRST_log.txt
  5. Thank you DaleDoc for clarification. We will follow accordingly. The link to the exclusion of programs worked fine. What still doesn't come to an end, is the link to the FAQ, reason "Network Timeout". Then, in Avira, we just don't know where the exclusiosn are to be entered (and we thought that would have been described in the FAQ). Therefor, any hint how to do that ? Same question for the Web Filter. We will post in the other section after having read the provided link. Thanks Booker
  6. Just to check : Is it more, that we have to provide ? Or is the German language a problem ? Please lt us know. Thanks Booker
  7. To the first point : we checked the time, and it isi the same, except for the usual 1 hour time zone difference between UK and Germany To the second point : need help, as the link to th FAQ is not working. To the third point, the log files : FRST: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01Ran by Standard (administrator) on TOSHIBA1LQ on 05-03-2015 19:46:41Running from C:\Users\Standard\DesktopLoaded Profiles: Standard (Available profiles: Standard & Gast1)Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)Internet Explorer Version 11 (Default browser: FF)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Microsoft Corporation) C:\Windows\System32\dasHost.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe(Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Desktop.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor)HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] ()HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-17] (Avira Operations GmbH & Co. KG)HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnkShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://toshiba13.msn.comHKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba13.msn.comSearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3542363699-1958347893-1633341002-1001 -> {150061C0-7294-4CF2-8645-F3A0BB55B4BA} URL = BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1FireFox:========FF ProfilePath: C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.defaultFF Homepage: google.comFF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npactivex.dll No FileFF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\Ver_247.312\npQQPhotoDrawEx.dll No FileFF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll No FileFF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll (Tencent)FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll (Tencent Technology (Shenzhen) Company Limited)FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Extension: Avira Browser Safety - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\abs@avira.com [2015-02-03]FF Extension: CNTVLive2 plugin for Firefox Chrome - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\CNTVLive2@www.cntv.cn [2014-07-08]FF Extension: WOT - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-01]FF Extension: Block site - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2014-02-16]FF Extension: Adblock Plus - C:\Users\Standard\AppData\Roaming\Mozilla\Firefox\Profiles\qwzk26nt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-09]FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSKChrome: =======CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG)R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-17] (Avira Operations GmbH & Co. KG)S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-12-17] (Avira Operations GmbH & Co. KG)R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor)R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S1 ASPI32; No ImagePathR2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43064 2014-10-14] (Avira Operations GmbH & Co. KG)R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2015-03-05] (Malwarebytes Corporation)S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)S3 MWAC; \??\C:\WINDOWS\system32\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)S3 MWAC; \??\C:\WINDOWS\SysWOW64\drivers\ [0 ] () <==== ATTENTION (zero size file/folder)R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider)S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2015-03-05 19:46 - 2015-03-05 19:47 - 00014187 _____ () C:\Users\Standard\Desktop\FRST.txt2015-03-05 19:45 - 2015-03-05 19:46 - 00000000 ____D () C:\FRST2015-03-05 19:38 - 2015-03-05 19:38 - 00448512 _____ (OldTimer Tools) C:\Users\Standard\Desktop\TFC.exe2015-03-05 19:36 - 2015-03-05 19:36 - 02092544 _____ (Farbar) C:\Users\Standard\Desktop\FRST64.exe2015-03-03 15:12 - 2015-03-03 15:12 - 00001596 _____ () C:\Users\Standard\Desktop\mbam - Verknüpfung.lnk2015-03-03 14:54 - 2015-03-03 14:55 - 01388333 _____ (Thisisu) C:\Users\Standard\Downloads\JRT.exe2015-03-03 14:18 - 2014-12-26 05:55 - 00867240 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll2015-03-03 14:18 - 2014-12-26 05:55 - 00789416 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll2015-03-03 14:01 - 2015-03-03 14:01 - 02126848 _____ () C:\Users\Standard\Desktop\adwcleaner_4.111.exe2015-03-03 13:34 - 2015-03-03 13:34 - 00285784 _____ () C:\WINDOWS\Minidump\030315-29093-01.dmp2015-03-03 13:34 - 2015-03-03 13:34 - 00000000 ____D () C:\WINDOWS\Minidump2015-03-03 13:33 - 2015-03-03 13:33 - 752739038 _____ () C:\WINDOWS\MEMORY.DMP2015-02-27 20:36 - 2015-03-05 19:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls2015-02-24 21:57 - 2014-12-13 21:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls2015-02-24 21:57 - 2014-10-29 01:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll2015-02-24 21:57 - 2014-10-29 01:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll2015-02-24 21:57 - 2014-10-29 01:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll2015-02-24 21:57 - 2014-10-29 01:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll2015-02-12 22:04 - 2015-01-23 04:41 - 06041600 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll2015-02-12 22:04 - 2015-01-23 03:17 - 04300800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll2015-02-11 22:20 - 2015-02-03 23:38 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll2015-02-11 22:20 - 2015-02-03 23:08 - 00761856 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll2015-02-11 22:20 - 2015-02-03 23:08 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll2015-02-11 22:20 - 2015-02-02 23:11 - 01098752 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll2015-02-11 22:20 - 2015-02-02 23:11 - 00894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll2015-02-11 22:20 - 2015-02-02 23:11 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll2015-02-11 22:20 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll2015-02-11 22:20 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll2015-02-11 22:20 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll2015-02-11 22:20 - 2014-12-08 23:12 - 00391526 _____ () C:\WINDOWS\system32\ApnDatabase.xml2015-02-11 22:01 - 2015-02-11 22:01 - 00007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfg2015-02-11 20:14 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys2015-02-11 20:14 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys2015-02-11 20:14 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll2015-02-11 20:14 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll2015-02-11 20:14 - 2015-01-13 22:11 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll2015-02-11 20:14 - 2015-01-13 22:04 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll2015-02-11 20:14 - 2015-01-10 09:10 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe2015-02-11 20:14 - 2015-01-10 09:10 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll2015-02-11 20:14 - 2015-01-10 08:28 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll2015-02-11 20:14 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scesrv.dll2015-02-11 20:14 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\scesrv.dll2015-02-11 20:14 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msaudite.dll2015-02-11 20:14 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll2015-02-11 20:14 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll2015-02-11 20:14 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msaudite.dll2015-02-11 20:14 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll2015-02-11 20:14 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll2015-02-11 20:14 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll2015-02-11 20:14 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll2015-02-11 20:14 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll2015-02-11 20:14 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wow32.dll2015-02-11 20:14 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe2015-02-11 20:14 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe2015-02-11 20:14 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\instnm.exe2015-02-11 20:13 - 2015-01-12 03:09 - 25056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll2015-02-11 20:13 - 2015-01-12 02:48 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll2015-02-11 20:13 - 2015-01-12 02:48 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll2015-02-11 20:13 - 2015-01-12 02:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll2015-02-11 20:13 - 2015-01-12 02:34 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll2015-02-11 20:13 - 2015-01-12 02:25 - 19740160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll2015-02-11 20:13 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll2015-02-11 20:13 - 2015-01-12 02:08 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll2015-02-11 20:13 - 2015-01-12 02:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll2015-02-11 20:13 - 2015-01-12 02:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll2015-02-11 20:13 - 2015-01-12 02:02 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll2015-02-11 20:13 - 2015-01-12 01:58 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll2015-02-11 20:13 - 2015-01-12 01:55 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll2015-02-11 20:13 - 2015-01-12 01:51 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll2015-02-11 20:13 - 2015-01-12 01:48 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll2015-02-11 20:13 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe2015-02-11 20:13 - 2015-01-12 01:48 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll2015-02-11 20:13 - 2015-01-12 01:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl2015-02-11 20:13 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll2015-02-11 20:13 - 2015-01-12 01:43 - 14401024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll2015-02-11 20:13 - 2015-01-12 01:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll2015-02-11 20:13 - 2015-01-12 01:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll2015-02-11 20:13 - 2015-01-12 01:27 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll2015-02-11 20:13 - 2015-01-12 01:27 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll2015-02-11 20:13 - 2015-01-12 01:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll2015-02-11 20:13 - 2015-01-12 01:23 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl2015-02-11 20:13 - 2015-01-12 01:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll2015-02-11 20:13 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll2015-02-11 20:13 - 2015-01-12 01:14 - 12829184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll2015-02-11 20:13 - 2015-01-12 01:14 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll2015-02-11 20:13 - 2015-01-12 01:02 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll2015-02-11 20:13 - 2015-01-12 01:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll2015-02-11 20:13 - 2015-01-12 00:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll2015-02-11 20:13 - 2015-01-12 00:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll2015-02-11 20:13 - 2015-01-10 07:00 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll2015-02-11 20:13 - 2015-01-10 06:38 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll2015-02-11 20:11 - 2015-01-10 08:22 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2015-03-05 19:45 - 2014-06-25 18:24 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys2015-03-05 19:34 - 2013-10-29 14:53 - 01559257 _____ () C:\WINDOWS\WindowsUpdate.log2015-03-05 19:20 - 2013-08-17 16:59 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3542363699-1958347893-1633341002-10012015-03-05 19:15 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\AppReadiness2015-03-05 19:11 - 2013-09-30 04:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI2015-03-05 19:11 - 2013-09-30 03:56 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat2015-03-05 19:11 - 2013-09-30 03:56 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat2015-03-05 19:10 - 2013-08-23 07:44 - 00000000 ____D () C:\NN Data2015-03-05 19:09 - 2013-08-17 18:18 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job2015-03-05 19:08 - 2013-12-04 14:46 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{09393E4E-62A8-46AB-A5D8-95BD51DD04D6}2015-03-05 19:07 - 2013-08-22 14:46 - 00315945 _____ () C:\WINDOWS\setupact.log2015-03-05 19:05 - 2013-10-18 10:03 - 00000000 ____D () C:\Users\Standard\AppData\Local\FreePDF_XP2015-03-05 19:04 - 2013-10-29 15:22 - 00000000 __RDO () C:\Users\Standard\SkyDrive2015-03-05 01:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\sru2015-03-03 15:01 - 2013-08-22 14:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT2015-03-03 15:00 - 2014-11-05 14:04 - 00000000 ____D () C:\AdwCleaner2015-03-03 14:48 - 2013-08-22 13:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI2015-03-03 14:18 - 2014-12-26 06:04 - 00000000 ____D () C:\ProgramData\Oracle2015-03-03 14:18 - 2014-12-26 05:55 - 00000000 ____D () C:\Program Files (x86)\Java2015-03-03 14:17 - 2014-12-26 05:55 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe2015-03-03 14:17 - 2014-12-26 05:55 - 00176552 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe2015-03-03 14:17 - 2014-12-26 05:55 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll2015-03-03 14:07 - 2013-10-29 14:38 - 00000000 ____D () C:\Users\Standard2015-03-03 13:33 - 2013-08-17 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2015-02-24 23:09 - 2012-07-26 07:59 - 00000000 ____D () C:\WINDOWS\CbsTemp2015-02-13 01:09 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\rescache2015-02-12 09:24 - 2013-08-22 14:44 - 00362792 _____ () C:\WINDOWS\system32\FNTCACHE.DAT2015-02-12 09:23 - 2013-09-29 19:04 - 00032246 _____ () C:\WINDOWS\PFRO.log2015-02-12 00:38 - 2014-09-06 19:09 - 00000000 ____D () C:\Users\Gast12015-02-12 00:38 - 2013-08-19 01:13 - 00000000 ____D () C:\WINDOWS\system32\MRT2015-02-12 00:37 - 2014-12-12 05:05 - 00000000 ____D () C:\WINDOWS\system32\appraiser2015-02-12 00:37 - 2014-07-09 13:24 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel2015-02-12 00:37 - 2013-08-19 01:13 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe2015-02-11 20:49 - 2014-08-05 17:16 - 00000000 ____D () C:\ProgramData\Package Cache2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira2015-02-11 20:49 - 2013-08-19 20:27 - 00000000 ____D () C:\Program Files (x86)\Avira2015-02-04 23:09 - 2013-08-17 18:18 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater2015-02-03 19:31 - 2014-12-12 11:05 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe2015-02-03 19:31 - 2014-12-12 11:05 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl==================== Files in the root of some directories =======2015-02-11 22:01 - 2015-02-11 22:01 - 0007605 _____ () C:\Users\Standard\AppData\Local\Resmon.ResmonCfgSome content of TEMP:====================C:\Users\Standard\AppData\Local\Temp\avgnt.exe==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-03-03 21:39==================== End Of Log ============================Then ADDITIONS: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-03-2015 01Ran by Standard at 2015-03-05 19:47:46Running from C:\Users\Standard\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) HiddenAvira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) HiddenAvira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) HiddenChuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) HiddenEmpress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) HiddenFreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.4.1.0 - International GeoGebra Institute)GPL Ghostscript (HKLM\...\GPL Ghostscript 9.10) (Version: 9.10 - Artifex Software Inc.)Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)Island Tribe (x32 Version: 2.2.0.98 - WildTangent) HiddenJava 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) HiddenMagic Academy (x32 Version: 2.2.0.98 - WildTangent) HiddenMalwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6219.1000 - Microsoft Corporation)Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) HiddenPlants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) HiddenPolar Bowler (x32 Version: 2.2.0.97 - WildTangent) HiddenPremium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6794 - Realtek Semiconductor Corp.)Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29480 - TeamViewer)TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.6.0 - Toshiba Europe GmbH)TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.21-A - Toshiba Corporation)Update for CHS Microsoft IME HAP Dictionary (Version: 16.0.1402.1 - Microsoft Corporation) HiddenUpdate for Korean Microsoft IME Standard Dictionary (HKLM\...\{75A54180-CA5E-47B8-AFBB-29337B976B21}) (Version: 16.0.662.1 - Microsoft Corporation)Update Installer for WildTangent Games App (x32 Version: - WildTangent) HiddenVirtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) HiddenVLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)==================== Restore Points =========================11-02-2015 20:53:45 Windows Update19-02-2015 22:58:54 Geplanter Prüfpunkt24-02-2015 23:09:15 Windows Update04-03-2015 00:04:32 Geplanter Prüfpunkt==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {04744BE8-EBC7-424F-A5ED-1884F3B9F8BA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)Task: {6076E911-59E8-4259-9ED2-595929FDDE32} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)Task: {8FA1E5A9-B0CA-4008-866E-DD2EA6C866CE} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)Task: {FF0E375C-CD76-479B-B2E8-6EC4AD9208C4} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe==================== Loaded Modules (whitelisted) ==============2011-10-13 20:38 - 2011-10-13 20:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe2013-10-13 09:20 - 2010-06-17 19:56 - 00087040 _____ () C:\WINDOWS\System32\redmonnt.dll2012-10-31 22:15 - 2012-10-31 22:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe2012-07-19 01:38 - 2012-07-19 01:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll2012-07-19 01:38 - 2012-07-19 01:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll2012-08-14 02:13 - 2012-08-14 02:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll2013-04-10 14:49 - 2012-06-25 17:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)AlternateDataStreams: C:\ProgramData\TEMP:88050731AlternateDataStreams: C:\Users\Standard\SkyDrive:ms-properties==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) ===============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-3542363699-1958347893-1633341002-1001\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.1.1==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)HKLM\...\StartupApproved\StartupFolder: => "JonDo.lnk"==================== Accounts: =============================Administrator (S-1-5-21-3542363699-1958347893-1633341002-500 - Administrator - Disabled)Gast (S-1-5-21-3542363699-1958347893-1633341002-501 - Limited - Disabled)Gast1 (S-1-5-21-3542363699-1958347893-1633341002-1002 - Limited - Enabled) => C:\Users\Gast1Standard (S-1-5-21-3542363699-1958347893-1633341002-1001 - Administrator - Enabled) => C:\Users\Standard==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Ausnahmecode: 0x40000015Fehleroffset: 0x0007da8aID des fehlerhaften Prozesses: 0xa34Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0Pfad der fehlerhaften Anwendung: mbamservice.exe1Pfad des fehlerhaften Moduls: mbamservice.exe2Berichtskennung: mbamservice.exe3Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5Error: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Ausnahmecode: 0x40000015Fehleroffset: 0x0007da8aID des fehlerhaften Prozesses: 0xecStartzeit der fehlerhaften Anwendung: 0xmbamservice.exe0Pfad der fehlerhaften Anwendung: mbamservice.exe1Pfad des fehlerhaften Moduls: mbamservice.exe2Berichtskennung: mbamservice.exe3Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5Error: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Ausnahmecode: 0x40000015Fehleroffset: 0x0007da8aID des fehlerhaften Prozesses: 0x12c4Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0Pfad der fehlerhaften Anwendung: mbamservice.exe1Pfad des fehlerhaften Moduls: mbamservice.exe2Berichtskennung: mbamservice.exe3Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5Error: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363Ausnahmecode: 0x40000015Fehleroffset: 0x0007da8aID des fehlerhaften Prozesses: 0x76cStartzeit der fehlerhaften Anwendung: 0xmbamservice.exe0Pfad der fehlerhaften Anwendung: mbamservice.exe1Pfad des fehlerhaften Moduls: mbamservice.exe2Berichtskennung: mbamservice.exe3Vollständiger Name des fehlerhaften Pakets: mbamservice.exe4Anwendungs-ID, die relativ zum fehlerhaften Paket ist: mbamservice.exe5System errors:=============Error: (03/05/2015 07:45:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 4 Mal passiert.Error: (03/05/2015 07:27:29 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.Error: (03/04/2015 00:05:25 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)Description: 0x8000002a171\??\Volume{0a543ba0-7861-11e2-8d38-d60b12dec0bc}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{84DCEC0C-94C3-49C0-B572-5573AA6F1404}Error: (03/04/2015 00:05:14 AM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)Description: In der Dateisystemstruktur auf Volume "TI31051200A" wurde eine Beschädigung erkannt.In einer Indexstruktur des Dateisystems wurde eine Beschädigung gefunden. Die Dateireferenznummer ist 0x40000000162f1. Der Name der Datei ist "\Windows\System32\DriverStore\FileRepository". Das Attribut des beschädigten Indexes ist ":$I30:$INDEX_ALLOCATION".Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}Error: (03/03/2015 04:02:07 PM) (Source: DCOM) (EventID: 10010) (User: TOSHIBA1LQ)Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}Error: (03/03/2015 03:16:24 PM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)Description: In der Dateisystemstruktur auf Volume "C:" wurde eine Beschädigung erkannt.Die genaue Art der Beschädigung ist unbekannt. Die Dateisystemstrukturen müssen online überprüft werden.Error: (03/03/2015 03:12:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.Error: (03/03/2015 03:02:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.Microsoft Office Sessions:=========================Error: (03/05/2015 07:45:20 PM) (Source: Application Error) (EventID: 1000) (User: )Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aa3401d0577ce9733e01C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe275745ee-c370-11e4-bed7-7c050738016eError: (03/05/2015 07:27:29 PM) (Source: Application Error) (EventID: 1000) (User: )Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8aec01d0577a69f6aa56C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exea8e40698-c36d-11e4-bed7-7c050738016eError: (03/03/2015 03:12:36 PM) (Source: Application Error) (EventID: 1000) (User: )Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a12c401d055c47b2b8440C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeb937cef2-c1b7-11e4-bed7-7c050738016eError: (03/03/2015 03:02:03 PM) (Source: Application Error) (EventID: 1000) (User: )Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a76c01d055c2f82e9b10C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe3fd774c2-c1b6-11e4-bed7-7c050738016e==================== Memory info =========================== Processor: Intel(R) Core(TM) i3-2348M CPU @ 2.30GHzPercentage of memory in use: 23%Total physical RAM: 8073.22 MBAvailable physical RAM: 6151.34 MBTotal Pagefile: 16265.22 MBAvailable Pagefile: 14374.57 MBTotal Virtual: 131072 MBAvailable Virtual: 131071.79 MB==================== Drives ================================Drive c: (TI31051200A) (Fixed) (Total:687.1 GB) (Free:597.87 GB) NTFSDrive d: (TOSHIBA EXT) (Fixed) (Total:465.76 GB) (Free:422.99 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)Partition: GPT Partition Type.========================================================Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: E6615A88)Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)==================== End Of Log ============================CheckResults.txt
  8. Just to add, it all started today with a blue screen "Kernel Data Inpage Error".
  9. Hi, hope to be in the right place here. I have an MBAM Premium installed on a laptop running out of London. Get the message "unable to update access server", although running another MBAM on a different machine from Germany, the update works just fine. Having used ADWCleaner, we noticed a Tencent installation on the UK machine without any Uninstall possibility, althoug not sure if there is a connection. We eliminated 3 Tencent entries in the Firewall, but two of them are not removable. So, in short : a) Why is the update server reported to be unaccessible ? b) Has the Tencent any relation to the problem ? Thanks Booker
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.