Infected, but only none-malware detected

5tefan · January 5, 2015

Hi

I just searched and found software for my old sound blaster pci 128 sound card, but apparently the install caused malware infection - unwanted start page, Firefox add ons and installed programs. I've now uninstalled them all, I think, and run the Anti-malware software twice. First time it found two malware files, as the software removed, and a lot of non-malware. Second time no malware, but still a lot of non-malware (243).

Although my pc seems to work fine, it seems like there're still at least small problems.

I've just installed Win 7 from scratch a few days ago as I, among other desired changes, wanted to get rid of an other malware infection. So I hope this is not a big infection.

Attached are the two files you have asked for. Thanks for helping.

Stefan

FRST.txt

Addition.txt

Psychotic · January 5, 2015

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Important: To help me reviewing your logs, please post them in code boxes. You can create them by clicking on the <>-symbol on top of the reply window.

Scan with Gmer rootkit scanner

Please download Gmer from here by clicking on the "Download EXE" Button.

Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Show All ( should be unchecked by default )
[*]Leave everything else as it is. [*]Close all other running programs as well as your Browser. [*]Click the Scan button & wait for it to finish. [*]Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. [*]Save it where you can easily find it, such as your desktop. [*]Please post the content of the ark.txt here.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Scan with TDSS-Killer

Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.zip and extract to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Copy to quarantine. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please attach this file to your next reply.

5tefan · January 5, 2015

Hi

Thank you.

Below is the GMER code

I couldn't download the TDSSKiller as the link seems dead.

Btw, I may have installed/uninstalled a few things during this day, as I've almost just reinstalled Windows, but I will try not to during this process, if it's a problem?

Stefan

GMER 2.1.19357 - http://www.gmer.netRootkit scan 2015-01-05 17:30:29Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3 WDC_WD10EZEX-00RKKA0 rev.80.00A80 931,51GBRunning: GMER.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\kxdiqpob.sys---- Threads - GMER 2.1 ----Thread   C:\Program Files\Windows Media Player\wmpnetwk.exe [4872:6656]                                                                                                                                                                                                               000007fefb032bf8Thread   C:\Program Files\Windows Media Player\wmpnetwk.exe [4872:5008]                                                                                                                                                                                                               000007feef454830Thread   C:\Program Files\Windows Media Player\wmpnetwk.exe [4872:3532]                                                                                                                                                                                                               000007fef3225124Thread   C:\Windows\System32\svchost.exe [5748:5224]                                                                                                                                                                                                                                  000007fef0669688---- Processes - GMER 2.1 ----Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ D:\Programmer\DriverMax\drivermax.exe [1104] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                                00000000648b0000Process  C:\Users\Stefan\AppData\Roaming\Google\Google Talk\googletalk.exe (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Google\Google Talk\googletalk.exe [432] (Google Talk/Google)(2007-01-01 21:22:02)                                                                   0000000000400000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Google\Google Talk\googletalk.exe [432] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)     00000000648b0000Process  C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [1576] (WindowsProtectManger Service/Fuyu LIMITED)(2015-01-05 04:12:27)                                                   0000000000ae0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ C:\Program Files (x86)\Skype\Phone\Skype.exe [2068] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                         00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2440] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                   00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ D:\Programmer\ClipCache\clipc.exe [2600] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                                    00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ D:\Programmer\Launchy\Launchy.exe [2856] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                                    00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)              00000000648b0000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:46)                         0000000062c70000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                             0000000062970000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008](2015-01-03 20:38:46)                                                                                                         00000000628b0000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                            00000000624c0000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (ICU I18N DLL/The ICU Project)(2015-01-03 20:38:46)                                                                            000000004a900000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (ICU Common DLL/The ICU Project)(2015-01-03 20:38:46)                                                                          0000000004020000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (ICU Data DLL/The ICU Project)(2015-01-03 20:38:46)                                                                            000000004ad00000Library  c:\users\stefan\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpu3wcdq.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008](2015-01-05 16:10:23)                                                        00000000041f0000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                         000000005cb90000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:46)                          00000000590e0000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                           000000005c750000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                             000000005ae60000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                             000000005ed70000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008](2015-01-03 20:38:46)                                                                                                            0000000060bc0000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:46)                   000000005ed40000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                          000000005e800000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-01-03 20:38:45)                    000000005e330000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008](2015-01-03 20:38:46)                                                                                        000000005cab0000Library  C:\Users\Stefan\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3008](2015-01-03 20:38:46)                                                                                        000000005e3c0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ D:\Programmer\Qliner Hotkeys\HotKeys.exe [2308] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                             00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ D:\Programmer\ForceShutdown\fsd.exe [992] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                                   00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ D:\Ekstra\HTGBack (Få Windows 7 til at gå op i mappestrukturen).exe [1888] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)  00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ D:\Ekstra\ZoomIt.exe [3088] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)                                                 00000000648b0000Library  C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (*** suspicious ***) @ C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe [3224] (RealPlayer Chrome Browser Helper/RealNetworks, Inc.)(2015-01-04 01:46:28)        00000000648b0000---- Registry - GMER 2.1 ----Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0009dd502900                                                                                                                                                                                                  Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0009dd502900 (not active ControlSet)                                                                                                                                                                              ---- EOF - GMER 2.1 ----

Psychotic · January 6, 2015

As you have made modifications to your system, please create and post new logs with FRST:

Please rescan with FRST (create a new addition.txt as well) and post the logs.

Also, try to download TDSS-Killer from here and run it as explained.

5tefan · January 8, 2015

Sorry for late reply. Must have deleted your mail response as it looked like spam.

Ok, in the next posts I've pasted in new logs for both FRST and Addition. I still can't access the TDSS-Killer

5tefan · January 8, 2015

I can't post the logs, as it says "This reply has not been added as it has been posted too quickly"

5tefan · January 8, 2015

Now it says the post (the FRST log) is too long.

5tefan · January 8, 2015

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015

Ran by Stefan at 2015-01-08 04:04:48

Running from D:\Ekstra

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.2.443 - Adobe Systems Incorporated)

Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9120 - Adobe Systems Inc.)

Adobe Anchor Service x64 CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe CMaps x64 CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)

Adobe Creative Suite 4 Master Collection (HKLM-x32\...\Adobe_b2d6abde968e6f277ddbfd501383e02) (Version: 4.0 - Adobe Systems Incorporated)

Adobe Creative Suite 5 Production Premium (HKLM-x32\...\{626B3D60-A661-4444-AAF5-6C75E55936E8}) (Version: 5.0 - Adobe Systems Incorporated)

Adobe CSI CS4 x64 (Version: 1 - Adobe Systems Incorporated) Hidden

Adobe Drive CS4 x64 (Version: 1 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)

Adobe Fonts All x64 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe InDesign CS4 Icon Handler x64 (Version: 6.0 - Adobe Systems Incorporated) Hidden

Adobe Linguistics CS4 x64 (Version: 4.0.0 - Adobe Systems Incorporated) Hidden

Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)

Adobe PDF Library Files x64 CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

Adobe Photoshop CS4 (64 Bit) (Version: 11.0 - Adobe Systems Incorporated) Hidden

Adobe Reader XI (11.0.10) - Dansk (HKLM-x32\...\{AC76BA86-7AD7-1030-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Adobe Type Support x64 CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

Adobe WinSoft Linguistics Plugin x64 (Version: 1.1 - Adobe Systems Incorporated) Hidden

AltMove 1.0 (HKLM-x32\...\AltMove 1.0) (Version: 1.0 - NTE)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)

CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM-x32\...\CANON iMAGE GATEWAY Task) (Version: 1.6.0.12 - Canon Inc.)

Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\Canon Internet Library for ZoomBrowser EX) (Version: 1.6.2.7 - Canon Inc.)

Canon MOV Decoder (HKLM-x32\...\Canon MOV Decoder) (Version: 1.1.0.31 - Canon Inc.)

Canon Utilities CameraWindow (HKLM-x32\...\CameraWindowLauncher) (Version: 7.1.0.2 - Canon Inc.)

Canon Utilities CameraWindow DC (HKLM-x32\...\CameraWindowDC) (Version: 7.3.0.4 - Canon Inc.)

Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (HKLM-x32\...\CameraWindowDVC6) (Version: 6.4.2.16 - Canon Inc.)

Canon Utilities Digital Photo Professional 3.6 (HKLM-x32\...\DPP) (Version: 3.6.0.0 - Canon Inc.)

Canon Utilities MyCamera (HKLM-x32\...\MyCamera) (Version: 7.1.0.1 - Canon Inc.)

Canon Utilities MyCamera DC (HKLM-x32\...\MyCameraDC) (Version: 7.1.0.4 - Canon Inc.)

Canon Utilities RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\RemoteCaptureTask) (Version: 1.7.1.9 - Canon Inc.)

Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 6.2.1.31 - Canon Inc.)

Canon ZoomBrowser EX Memory Card Utility (HKLM-x32\...\ZoomBrowser EX Memory Card Utility) (Version: 1.2.0.9 - Canon Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)

Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)

Connect (x32 Version: 1.0.0.1 - Adobe Systems Incorporated) Hidden

Creative PCI Audio Drivers (HKLM-x32\...\SBPCIUnInstall) (Version: - )

DriverMax 7 (HKLM-x32\...\DMX5_is1) (Version: 7.47.0.998 - Innovative Solutions)

Dropbox (HKU\S-1-5-21-2479822835-2867536027-2880494365-1000\...\Dropbox) (Version: 3.0.4 - Dropbox, Inc.)

Dropbox (HKU\S-1-5-21-2479822835-2867536027-2880494365-1003\...\Dropbox) (Version: 3.0.4 - Dropbox, Inc.)

Emagic Logic Audio Platinum v5.30 (HKLM-x32\...\Emagic Logic Audio Platinum v5.30) (Version: - )

FastPreview (HKLM\...\{D60450AF-C09A-47A4-A6BE-03FAC101B780}) (Version: 4.1.0 - Nils Maier)

File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC)

File Extension Changer 3.3.1 (HKLM-x32\...\File Extension Changer_is1) (Version: - Abhishek)

FileMenu Tools (HKLM\...\FileMenu Tools_is1) (Version: 6.6 - LopeSoft)

FileZilla Client 3.3.4.1 (HKLM-x32\...\FileZilla Client) (Version: 3.3.4.1 - )

Force Shutdown (HKLM-x32\...\ForceShutdown) (Version: - )

FormatFactory 3.3.5.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.5.0 - Format Factory)

Free Desktop Clock 3.0 (HKLM\...\Free Desktop Clock_is1) (Version: - Drive Software Company)

GOM Player (HKLM-x32\...\GOM Player) (Version: 2.2.62.5207 - Gretech Corporation)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google Talk (remove only) (HKU\S-1-5-21-2479822835-2867536027-2880494365-1000\...\{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk) (Version: - )

Google Talk (remove only) (HKU\S-1-5-21-2479822835-2867536027-2880494365-1003\...\{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk) (Version: - )

HP Deskjet 2540 series - basissoftware til enheden (HKLM\...\{0B7D5271-F528-4AB0-B6AE-3AEC2F7501E2}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)

HP Deskjet 2540 series Hjælp (HKLM-x32\...\{AFE53CF9-FD24-4B8C-81B8-D6EA60A0B541}) (Version: 30.0.0 - Hewlett Packard)

Icon Restore 1.0 (HKLM-x32\...\Icon Restore_is1) (Version: - Tim Taylor)

Kompatibilitetspakke til Office 2007-systemet (HKLM-x32\...\{90120000-0020-0406-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

kuler (x32 Version: 2.0 - Adobe Systems Incorporated) Hidden

Launchy 2.5 (HKLM-x32\...\Launchy_21344213_is1) (Version: - Code Jelly)

Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)

MAGIX Goya burnR 1.3.1.3 (UK) (HKLM-x32\...\MAGIX Goya burnR UK) (Version: 1.3.1.3 - MAGIX AG)

MAGIX Movies on DVD 7 7.0.3.5 (UK) (HKLM-x32\...\MAGIX Movies on DVD 7 UK) (Version: 7.0.3.5 - MAGIX AG)

MAGIX Screenshare 4.3.6.1987 (UK) (HKLM-x32\...\MAGIX Screenshare UK) (Version: 4.3.6.1987 - MAGIX AG)

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (dansk) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1030) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Word 2000 (HKLM-x32\...\{00170406-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)

Microsoft Works 2000 (HKLM-x32\...\{37294132-74E4-11D3-AF54-00C04F443448}) (Version: 1.0.0.0000 - Microsoft Corporation)

MioToolbox (HKLM-x32\...\MioToolbox) (Version: - Mioplanet)

Mozilla Firefox 34.0.5 (x86 da) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 da)) (Version: 34.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)

Mozilla Thunderbird 31.3.0 (x86 da) (HKLM-x32\...\Mozilla Thunderbird 31.3.0 (x86 da)) (Version: 31.3.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Mufin MusicFinder Base 1.5.3.247 (UK) (HKLM-x32\...\Mufin MusicFinder Base UK) (Version: 1.5.3.247 - MAGIX AG)

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team)

NVIDIA Grafikdriver 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)

NVIDIA Opdateringer 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)

OpenOffice 4.1.1 (HKLM-x32\...\{FC226097-EED7-4560-BDCD-BD7136F74C07}) (Version: 4.11.9775 - Apache Software Foundation)

PC On Off Time 1.0 (HKLM-x32\...\PC On Off Time 1.0) (Version: 1.0 - Neuber Software)

PDF Settings CS4 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden

PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden

Photoshop Camera Raw (x32 Version: 5.0 - Adobe Systems Incorporated) Hidden

Photoshop Camera Raw_x64 (Version: 5.0 - Adobe Systems Incorporated) Hidden

Qliner Hotkeys 2.0 (HKLM-x32\...\Qliner Hotkeys) (Version: 2.0 - Qliner)

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealPlayer (HKLM-x32\...\RealPlayer 12.0) (Version: - RealNetworks)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Suite Shared Configuration CS4 (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden

SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1168 - SUPERAntiSpyware.com)

TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)

Tilføjelsesprogrammet Word i Works Suite (HKLM-x32\...\{581FC672-8089-11D3-A823-0060085EC379}) (Version: 1.0.0.0000 - Microsoft Corporation)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

WinZip 19.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E5}) (Version: 19.0.11293 - WinZip Computing, S.L. )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2479822835-2867536027-2880494365-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Stefan\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

06-01-2015 00:16:49 DMX_DriverMax Driver Installation

06-01-2015 00:18:26 Installation af enhedsdriverpakke: AMD Systemenheder

06-01-2015 00:19:12 Installation af enhedsdriverpakke: Advanced Micro Devices IDE ATA/ATAPI-controllere

06-01-2015 01:49:01 Windows Update

06-01-2015 03:04:58 Windows Update

06-01-2015 03:32:49 Installeret Realtek Ethernet Controller Driver

06-01-2015 03:55:43 Installerede Microsoft Word 2000

06-01-2015 04:01:22 Installerede Kompatibilitetspakke til Office 2007-systemet

07-01-2015 03:00:20 Windows Update

08-01-2015 03:00:19 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {009DFF3A-FAAD-4529-82B7-7F9FBB4233D0} - System32\Tasks\avast! Emergency Update => D:\Programmer\Avast\AvastEmUpdate.exe [2015-01-03] (AVAST Software)

Task: {027F1A3E-2532-490B-A021-643DDCF08470} - System32\Tasks\AdobeAAMUpdater-1.0-Stefan-pc-Stefan => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)

Task: {089139D4-637D-4034-990B-4A59EAA86A08} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-03] (Google Inc.)

Task: {0A6F0D4F-53B5-4F87-AF82-2AAA3B6A1429} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-03] (Google Inc.)

Task: {0E8F63CD-D346-4E27-94E0-BD6B87422C4D} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2479822835-2867536027-2880494365-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2010-11-05] (RealNetworks, Inc.)

Task: {10CB8A8F-7268-4C68-A483-4193AF8B662D} - System32\Tasks\{A7305DA2-DDB3-4CC6-814D-6FE8984398A8} => pcalua.exe -a D:\Ekstra\CS4\Install\payloads\AdobeAIR1.0\AdobeAIRInstaller.exe -d "C:\Program Files (x86)\Common Files\Adobe\Installers\b2d6abde968e6f277ddbfd501383e02" -c -silent

Task: {17BE0702-6A64-4DA9-AE99-320A68BDAEE0} - System32\Tasks\Application Starter - 23874b61bee8854887e47a14f281248c => D:\Programmer\DriverMax\innostp.exe [2014-12-17] (Innovative Solutions)

Task: {2E161715-7E1F-4AC6-9455-42A7BE13392F} - System32\Tasks\upfs7235 => C:\PROGRA~2\Flwsrf\upfs7235.exe

Task: {6D8334D1-6441-43A2-9E9F-7A9DCC102FA1} - System32\Tasks\{B2367033-1915-497C-A480-EA00D315A17F} => Firefox.exe http://www.skype.com/go/downloading?source=lightinstaller&ver=6.18.0.105&LastError=404

Task: {87F69817-3A26-4A00-B72F-C3E8E3C5DC6A} - System32\Tasks\FWDQY => C:\Users\Stefan\AppData\Roaming\FWDQY.exe <==== ATTENTION

Task: {921A95EE-C357-40F3-8F16-F5CBC68E4ED3} - System32\Tasks\{7A53AE84-DB93-48E2-9A94-5B7F4D176F1E} => pcalua.exe -a D:\Ekstra\PowerNap.exe -d D:\Ekstra

Task: {9D152152-7884-4DB9-A1AF-7F4395506D30} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2479822835-2867536027-2880494365-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2010-11-05] (RealNetworks, Inc.)

Task: {A52AE83E-9398-49D6-BBB5-3E0D682F2AA3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-04] (Adobe Systems Incorporated)

Task: {B5F261A7-7F97-464E-9D80-13653DF05CB4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)

Task: {BDF60AF7-94E3-4538-8336-9733CE96A054} - System32\Tasks\JEHJK => C:\Users\Stefan\AppData\Roaming\JEHJK.exe <==== ATTENTION

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Application Starter - 23874b61bee8854887e47a14f281248c.job => D:\Programmer\DriverMax\innostp.exe

Task: C:\Windows\Tasks\DriverToolkit Autorun.job => D:\Programmer\DriverToolkit\DriverToolkit.exe

Task: C:\Windows\Tasks\FWDQY.job => C:\Users\Stefan\AppData\Roaming\FWDQY.exe <==== ATTENTION

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\JEHJK.job => C:\Users\Stefan\AppData\Roaming\JEHJK.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2015-01-04 21:20 - 2013-01-31 10:25 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-07-15 20:16 - 2013-04-24 19:20 - 02007040 _____ () D:\Programmer\Free Desktop Clock\timeserv.exe

2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () D:\Programmer\FileZilla FTP Client\fzshellext_64.dll

2014-07-15 20:16 - 2013-06-07 20:20 - 01875968 _____ () D:\Programmer\Free Desktop Clock\Clock.dll

2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 _____ () D:\Programmer\Notepad++\NppShell_06.dll

2014-07-15 20:16 - 2013-06-27 23:07 - 04652544 _____ () D:\Programmer\Free Desktop Clock\FreeDesktopClock.exe

2014-06-30 09:27 - 2006-09-23 21:35 - 00081920 _____ () D:\Programmer\AltMove\AltMove.exe

2014-06-30 09:28 - 2010-04-03 14:05 - 00380928 _____ () D:\Programmer\Launchy\Launchy.exe

2014-06-30 06:52 - 2010-01-11 03:35 - 00207333 _____ () D:\Ekstra\HTGBack (Få Windows 7 til at gå op i mappestrukturen).exe

2010-01-03 18:27 - 2010-01-03 18:27 - 00026248 _____ () D:\Programmer\StrokeIt\strokeit.exe

2015-01-06 19:07 - 2015-01-06 19:07 - 02909696 _____ () D:\Programmer\Avast\defs\15010601\algo.dll

2015-01-07 10:31 - 2015-01-07 10:31 - 02909696 _____ () D:\Programmer\Avast\defs\15010700\algo.dll

2015-01-07 22:36 - 2015-01-07 22:36 - 02909696 _____ () D:\Programmer\Avast\defs\15010701\algo.dll

2015-01-03 19:14 - 2014-12-17 11:30 - 00009088 _____ () D:\Programmer\DriverMax\sync.dll

2010-01-03 18:27 - 2010-01-03 18:27 - 00011912 _____ () D:\Programmer\StrokeIt\mhook.dll

2015-01-03 23:58 - 2015-01-03 23:58 - 38562088 _____ () D:\Programmer\Avast\libcef.dll

2015-01-04 15:49 - 2015-01-04 15:49 - 00006144 _____ () C:\Users\Stefan\AppData\Local\assembly\dl3\C49XZ94X.VW1\YO69BDTH.EQX\a083c7bd\8bbe6271_2d28d001\tool.DLL

2015-01-04 15:49 - 2015-01-04 15:49 - 00020480 _____ () C:\Users\Stefan\AppData\Local\assembly\dl3\C49XZ94X.VW1\YO69BDTH.EQX\bd4adbc7\71266071_2d28d001\ShellTool.DLL

2014-06-30 09:28 - 2009-12-16 23:13 - 08314880 _____ () D:\Programmer\Launchy\QtGui4.dll

2014-06-30 09:28 - 2009-12-16 22:54 - 02236416 _____ () D:\Programmer\Launchy\QtCore4.dll

2014-06-30 09:28 - 2009-12-16 22:56 - 00712704 _____ () D:\Programmer\Launchy\QtNetwork4.dll

2014-06-30 09:28 - 2009-12-17 01:18 - 00233472 _____ () D:\Programmer\Launchy\imageformats\qmng4.dll

2014-06-30 09:28 - 2010-04-03 14:06 - 00081920 _____ () D:\Programmer\Launchy\plugins\calcy.dll

2014-06-30 09:28 - 2010-04-03 14:05 - 00090112 _____ () D:\Programmer\Launchy\plugins\controly.dll

2014-06-30 09:28 - 2010-04-03 14:06 - 00024064 _____ () D:\Programmer\Launchy\plugins\gcalc.dll

2014-06-30 09:28 - 2010-04-03 14:06 - 00094208 _____ () D:\Programmer\Launchy\plugins\runner.dll

2014-06-30 09:28 - 2010-04-03 14:05 - 00057344 _____ () D:\Programmer\Launchy\plugins\verby.dll

2014-06-30 09:28 - 2010-04-03 14:05 - 00122880 _____ () D:\Programmer\Launchy\plugins\weby.dll

2015-01-03 21:23 - 2014-11-26 17:40 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2015-01-03 21:18 - 2014-11-28 01:09 - 03339376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll

2015-01-03 21:18 - 2014-11-28 01:09 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll

2015-01-03 21:18 - 2014-11-28 01:09 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll

2015-01-03 21:38 - 2014-12-16 23:22 - 00750080 _____ () C:\Users\Stefan\AppData\Roaming\Dropbox\bin\libGLESv2.dll

2015-01-07 10:32 - 2015-01-07 10:32 - 00043008 _____ () c:\users\stefan\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpy2tkbe.dll

2015-01-03 21:38 - 2014-12-16 23:22 - 00047616 _____ () C:\Users\Stefan\AppData\Roaming\Dropbox\bin\libEGL.dll

2015-01-03 21:38 - 2014-12-16 23:22 - 00863744 _____ () C:\Users\Stefan\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll

2015-01-03 21:38 - 2014-12-16 23:22 - 00200704 _____ () C:\Users\Stefan\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00016520 _____ () D:\Programmer\StrokeIt\Plugins\exec.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00018056 _____ () D:\Programmer\StrokeIt\Plugins\keys.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00013448 _____ () D:\Programmer\StrokeIt\Plugins\msg.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00013448 _____ () D:\Programmer\StrokeIt\Plugins\multimon.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00012936 _____ () D:\Programmer\StrokeIt\Plugins\OSD.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00010376 _____ () D:\Programmer\StrokeIt\Plugins\siControl.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00013960 _____ () D:\Programmer\StrokeIt\Plugins\utilities.dll

2010-01-03 18:28 - 2010-01-03 18:28 - 00016520 _____ () D:\Programmer\StrokeIt\Plugins\win.dll

2009-09-14 01:06 - 2015-01-04 03:13 - 00204800 _____ () D:\Programmer\Notepad++\plugins\ComparePlugin.dll

2011-07-18 22:07 - 2011-07-18 22:07 - 00014336 _____ () D:\Programmer\Notepad++\plugins\NppExport.dll

2014-01-07 00:42 - 2014-01-07 00:42 - 01611264 _____ () D:\Programmer\Notepad++\plugins\NppFTP.dll

2007-08-05 02:10 - 2007-08-05 02:10 - 00250368 _____ () D:\Programmer\Notepad++\plugins\Config\tidy\libTidy.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

========================= Accounts: ==========================

Administrator (S-1-5-21-2479822835-2867536027-2880494365-500 - Administrator - Disabled)

Gæst (S-1-5-21-2479822835-2867536027-2880494365-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2479822835-2867536027-2880494365-1002 - Limited - Enabled)

Stefan (S-1-5-21-2479822835-2867536027-2880494365-1000 - Administrator - Enabled) => C:\Users\Stefan

UpdatusUser (S-1-5-21-2479822835-2867536027-2880494365-1003 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: CSR Bluetooth Chip

Description: CSR Bluetooth Chip

Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}

Manufacturer: Realtek Semiconductor Corp.

Service: BTHUSB

Problem: : Windows has stopped this device because it has reported problems. (Code 43)

Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.

==================== Event log errors: =========================

Application errors:

==================

Error: (01/07/2015 10:26:02 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Det lykkedes ikke at oprette aktiveringskontekst for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Der opstod fejl i manifest- eller politikfilen "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" på linje C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

En komponentversion, der er påkrævet af programmet, er i konflikt med en anden komponentversion, der allerede er aktiv.

Komponenter i konflikt er:.

Komponent 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponent 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/07/2015 10:26:02 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Det lykkedes ikke at oprette aktiveringskontekst for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Der opstod fejl i manifest- eller politikfilen "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" på linje C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

En komponentversion, der er påkrævet af programmet, er i konflikt med en anden komponentversion, der allerede er aktiv.

Komponenter i konflikt er:.

Komponent 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponent 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/07/2015 10:32:35 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/07/2015 01:17:46 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Navn på program med fejl: cmdshell.exe, version: 4.0.1.1615, tidsstempel: 0x54a0adf1

Navn på modul med fejl: ole32.DLL, version: 6.1.7601.17514, tidsstempel: 0x4ce7b96f

Undtagelseskode: 0xc0000005

Forskydning med fejl 0x00039342

Proces-id 0xb50

Programmets starttidspunkt 0xcmdshell.exe0

Programsti: cmdshell.exe1

Modulsti: cmdshell.exe2

Rapport-id: cmdshell.exe3

Error: (01/07/2015 01:01:54 AM) (Source: RasClient) (EventID: 20227) (User: )

Description: CoID={597535F1-6A03-4A4D-84B0-EFF30B8934BB}: Brugeren Stefan-pc\Stefan kaldte op til en forbindelse med navnet Bredbåndsforbindelse, men forbindelsen blev ikke oprettet. Den fejlkode, der blev returneret ved fejl, er 651.

Error: (01/06/2015 11:03:36 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/06/2015 03:49:57 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/06/2015 03:18:51 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/06/2015 03:00:21 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/06/2015 02:19:12 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:

=============

Error: (01/07/2015 04:13:46 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der opstod en ukendt fejl i den lokale Bluetooth-adapter og den vil derfor ikke blive brugt. Driveren vil ikke blive indlæst.

Error: (01/07/2015 10:32:10 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Følgende boot-start- eller system-start-driver kunne ikke indlæses:

amdkmafd

Error: (01/06/2015 04:11:51 PM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der opstod en ukendt fejl i den lokale Bluetooth-adapter og den vil derfor ikke blive brugt. Driveren vil ikke blive indlæst.

Error: (01/06/2015 11:03:24 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Følgende boot-start- eller system-start-driver kunne ikke indlæses:

amdkmafd

Error: (01/06/2015 05:30:08 AM) (Source: BTHUSB) (EventID: 17) (User: )

Description: Der opstod en ukendt fejl i den lokale Bluetooth-adapter og den vil derfor ikke blive brugt. Driveren vil ikke blive indlæst.

Error: (01/06/2015 03:50:01 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Følgende boot-start- eller system-start-driver kunne ikke indlæses:

amdkmafd

Error: (01/06/2015 03:36:17 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E}

Error: (01/06/2015 03:20:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Tjenesten globalUpdate Update Service (globalUpdate) kunne ikke starte pga. følgende fejl:

%%2

Error: (01/06/2015 03:20:26 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {4991D34B-80A1-4291-83B6-3328366B9097}

Error: (01/06/2015 03:18:24 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: Følgende boot-start- eller system-start-driver kunne ikke indlæses:

amdkmafd

Microsoft Office Sessions:

=========================

Error: (01/07/2015 10:26:02 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files\CCleaner\CCleaner64.exe

Error: (01/07/2015 10:26:02 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files\CCleaner\CCleaner64.exe

Error: (01/07/2015 10:32:35 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/07/2015 01:17:46 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: cmdshell.exe4.0.1.161554a0adf1ole32.DLL6.1.7601.175144ce7b96fc000000500039342b5001d02997e368cd91C:\Program Files (x86)\XTab\cmdshell.exeC:\Windows\syswow64\ole32.DLL9aabdf2a-9602-11e4-8e3a-6cf0490f7e20

Error: (01/07/2015 01:01:54 AM) (Source: RasClient) (EventID: 20227) (User: )

Description: {597535F1-6A03-4A4D-84B0-EFF30B8934BB}Stefan-pc\StefanBredbåndsforbindelse651