| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Google öffnet sich eigenständigWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.06.2013, 01:17
| #1 | |
 |  Google öffnet sich eigenständig Hey Leute, Ich habe bei der Erstellung dieses Threads bewusst die Wenn Du Dir nicht sicher bist, ob Du ein Virenproblem hast-Abteilung gewählt. Folgendes: März 2012 hatte ich einen Trojaner auf dem PC. Der konnte erfolgreich entfernt werden und seitdem bin ich etwas paranoid geworden. Kurz: Ich kümmere mich seitdem stärker um die PC-Sicherheit, update meine Firefox-Plugins regelmäßig und werfe im Zweifelsfall liebe einmal mehr Sandboxie an. Auch gucke ich so oft in den Taskmanager, dass ich die Prozesse mittlerweile beinahe auswendig kenne. Seit meinem Fund 2012 ist auch an sich nichts Problematisches mehr passiert. Höchstens das hier: Vor ca. 2 Monaten fand ich in meinem Local/Temp-Ordner eine seltsame Skypesetup.exe-Datei. Obwohl sowohl Avast als auch MWB mir keine Malware meldeten, machte mich die Datei so misstrauisch, dass ich sie bei Virustotal hochgeladen habe. Dort schlugen eine Menge Scanner an, sodass ich die Datei sofort gelöscht habe. Skype übrigens kurz danach auch. Passiert ist aber sonst nichts... ---------- Das aber nur am Rande. Mein momentanes Problem ist ganz anderer Natur: Seit ca. 1 Woche (kann auch schon länger sein, es ist mir aber jetzt erst aufgefallen) öffnet sich hin und wieder - ca. 1x/Tag - in meinem bereits geöffneten Firefox eine Seite: https://www.google.de. Die normale Googleseite mit eingeloggtem Account also. An der Seite ist nichts ungewöhnliches, sie unterscheidet sich von einer selbst aufgerufenen Googleseite in keinem Pixel. Aber sie ruft sich einfach selbst auf - in einem neuen Tab oder sie ersetzt die aktuelle Seite. Das Problem ist auch schon einmal "offline" passiert. Ein Redirect-Trojaner dürfte es nicht sein, da keiner meiner Aufrufe umgeleitet wird. Ansonsten habe ich keinerlei Schwierigkeiten oder seltsame Ereignisse bemerkt, aber das beunruhigt mich schon ein wenig. Ich poste hier mal mein OTL-File (das Programm hat keine Extras.txt generiert) und das durch GMER generierte (Anhang). Das einzige, jemals fündige MWB-Logfile poste hier auch mal, falls es jemanden interessiert - man beachte das Datum. Ansonsten hat MWB niemals etwas gefunden (meist aber nur Quickscans, muss ich dazu sagen). Zitat:
Gruß PS: Chrome habe ich kürzlich deinstalliert, den IE benutze ich praktisch niemals. |
|
09.06.2013, 06:32
| #2 |
| /// the machine /// TB-Ausbilder    | Google öffnet sich eigenständig Hi,
__________________Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
 So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
09.06.2013, 13:39
| #3 |
| | Google öffnet sich eigenständig Hallo,
__________________erst einmal danke für die schnelle Antwort. Hier ist das Log, um das du mich gebeten hast: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-06-2013
Ran by **** (ATTENTION: The logged in user is not administrator) on 09-06-2013 14:28:20
Running from C:\Users\****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(SANDBOXIE L.T.D) C:\Program Files\Sandboxie\SbieCtrl.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
(AVAST Software) C:\Program Files (x86)\AVAST\AvastUI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2370856 2010-09-24] (Synaptics Incorporated)
HKLM\...\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1933584 2010-12-17] (Intel(R) Corporation)
HKLM\...\Run: [QuickSet] c:\Program Files\Dell\QuickSet\QuickSet.exe [4479648 2011-01-25] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-11-29] ()
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX3 [1212560 2012-06-13] (Realtek Semiconductor)
HKLM-x32\...\RunOnce: [aswAhAScr.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files (x86)\AVAST\AhAScr.dll" [140544 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files (x86)\AVAST\asOutExt.dll" [303248 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt64.dll] "C:\Program Files (x86)\AVAST\aswRegSvr64.exe" "C:\Program Files (x86)\AVAST\asOutExt64.dll" [477336 2013-05-09] (AVAST Software)
HKCU\...\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe" [694032 2012-05-31] (SANDBOXIE L.T.D)
HKLM-x32\...\RunOnce: [aswAhAScr.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files (x86)\AVAST\AhAScr.dll" [140544 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files (x86)\AVAST\asOutExt.dll" [303248 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt64.dll] "C:\Program Files (x86)\AVAST\aswRegSvr64.exe" "C:\Program Files (x86)\AVAST\asOutExt64.dll" [477336 2013-05-09] (AVAST Software)
MountPoints2: {4058c5db-332e-11e2-bacf-806e6f6e6963} - D:\SDISTART.EXE
HKLM-x32\...\Run: [avast] "C:\Program Files (x86)\AVAST\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [250504 2013-02-10] (NVIDIA Corporation)
Startup: C:\ProgramData\Start Menu\Programs\Startup\LOLRecorder.lnk
ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay)
==================== Internet (Whitelisted) ====================
ProxyServer: 0.0.0.0:80
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
HKCU SearchScopes: DefaultScope {9DDEF137-963F-47C9-8094-944CC48F1DF4} URL = hxxp://www.google.de.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E64652F7365617263683F713D7B7365617263685465726D737D&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&k=0
SearchScopes: HKCU - {1227474B-5800-4971-AEBC-0C62C1B03868} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {1C40F450-D6BA-4A28-8D09-23BB5479134F} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {21546096-0B89-4439-89D5-D7E0D803C0F0} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {59319B5B-7707-4E26-AC60-C7970B0F6ED6} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {75F443E1-F114-4309-ACC5-E8B1DCCF6A46} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {9DDEF137-963F-47C9-8094-944CC48F1DF4} URL = hxxp://www.google.de.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E64652F7365617263683F713D7B7365617263685465726D737D&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&k=0
SearchScopes: HKCU - {9DEF9C91-C0A2-4ABD-A575-09466B4BADEA} URL =
SearchScopes: HKCU - {FF56538F-F03E-446A-A066-42DEC935CFC9} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\AVAST\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\AVAST\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\AVAST\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\AVAST\aswWebRepIE.dll (AVAST Software)
DPF: HKLM {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd64.cab
DPF: HKLM-x32 {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions\ich@maltegoetz.de
FF Extension: WOT - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: info - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions\info@virustotal.com.xpi
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2012-09-14] (SUPERAntiSpyware.com)
R2 avast! Antivirus; C:\Program Files (x86)\AVAST\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] ()
R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [229392 2012-09-13] (Nitro PDF Software)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-01-20] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [98576 2012-05-31] (SANDBOXIE L.T.D)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 SearchAnonymizer; C:\Users\****\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2011-09-17] ()
==================== Drivers (Whitelisted) ====================
S3 ASPI; C:\Windows\SysWow64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1025808 2013-05-09] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378432 2013-05-09] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-05-09] ()
S3 MEMSWEEP2; C:\Windows\system32\99D0.tmp [6144 2009-06-18] (Sophos Plc)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-02-10] (NVIDIA Corporation)
S3 NvStUSB; C:\Windows\system32\DRIVERS\nvstusb.sys [121960 2011-01-31] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [166576 2012-05-31] (SANDBOXIE L.T.D)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-09 14:28 - 2013-06-09 14:28 - 00000000 ____D C:\FRST
2013-06-09 14:27 - 2013-06-09 14:27 - 01919210 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-06-09 02:05 - 2013-06-09 02:05 - 00019870 ____A C:\Users\****\Desktop\Logs.zip
2013-06-09 01:33 - 2013-06-09 02:05 - 00150401 ____A C:\Users\****\Desktop\GMER.txt
2013-06-09 01:22 - 2013-06-09 01:22 - 00075596 ____A C:\Users\MASTER.Master\Desktop\OTL.Txt
2013-06-09 01:21 - 2013-06-09 02:05 - 00075596 ____A C:\Users\****\Desktop\OTL.Txt
2013-06-08 23:07 - 2013-06-08 23:07 - 00000154 ____A C:\Users\****\Desktop\liste.txt
2013-06-08 16:00 - 2013-06-08 16:00 - 23959201 ____A C:\Users\****\Desktop\Fotos.zip
2013-06-08 15:59 - 2013-06-08 16:11 - 00003766 ____A C:\Users\****\Desktop\artikel.txt
2013-06-08 15:48 - 2013-06-08 15:57 - 00000000 ____D C:\Users\****\Desktop\Fotos
2013-06-08 00:22 - 2013-06-08 15:45 - 00003968 ____A C:\Users\****\Desktop\bericht.txt
2013-06-04 18:27 - 2013-06-04 19:13 - 00029004 ____A C:\Users\****\Downloads\layla.aup
2013-06-04 18:27 - 2013-06-04 18:27 - 00000000 ____D C:\Users\****\Downloads\layla_data
2013-06-04 18:13 - 2013-06-04 18:13 - 00007249 ____A C:\Users\****\Downloads\crossroads (2).mp3.aup
2013-06-04 18:13 - 2013-06-04 18:13 - 00000000 ____D C:\Users\****\Downloads\crossroads (2).mp3_data
2013-06-03 18:38 - 2013-06-03 18:38 - 00012057 ____A C:\Users\****\Downloads\fear.aup
2013-06-03 18:38 - 2013-06-03 18:38 - 00000000 ____D C:\Users\****\Downloads\fear_data
2013-06-03 15:17 - 2013-06-03 15:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Users\MASTER.Master\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Program Files (x86)\AkaiPro
2013-06-01 16:39 - 2013-06-01 16:39 - 00001149 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-01 15:04 - 2013-06-01 15:25 - 00000000 ____D C:\Users\****\Documents\Photos
2013-05-31 00:19 - 2013-05-26 15:18 - 00001672 ____A C:\Users\****\Desktop\battle isle 3 units.txt
2013-05-30 20:10 - 2013-05-30 20:10 - 00018953 ____A C:\Users\****\Documents\gysi.odt
2013-05-27 16:50 - 2013-05-27 16:50 - 02959376 ____A (Microsoft Corporation) C:\Users\****\Downloads\dotnetfx35setup.exe
2013-05-27 16:48 - 2013-05-27 16:48 - 01582608 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.1.exe
2013-05-25 17:45 - 2013-05-25 17:45 - 00004482 ____A C:\Users\****\Desktop\follow.gp5
2013-05-25 16:29 - 2013-05-26 15:18 - 00001672 ____A C:\Users\****\Documents\battle isle 3 units.txt
2013-05-24 21:19 - 2013-05-24 21:19 - 00005525 ____A C:\Users\****\Downloads\sail away.aup
2013-05-24 21:19 - 2013-05-24 21:19 - 00000000 ____D C:\Users\****\Downloads\sail away_data
2013-05-23 23:11 - 2013-05-23 23:11 - 00014551 ____A C:\Users\****\Desktop\delix.odt
2013-05-23 18:56 - 2013-05-24 21:43 - 00019893 ____A C:\Users\****\Downloads\sail away.gp5
2013-05-22 23:26 - 2013-05-22 23:26 - 00020012 ____A C:\Users\****\Documents\cc_20130522_232630.reg
2013-05-22 20:43 - 2013-05-22 22:18 - 00005029 ____A C:\Users\****\Downloads\angel.gp5
2013-05-22 19:50 - 2013-05-22 19:50 - 00004115 ____A C:\Users\****\Downloads\Ready for Action.gp5
2013-05-21 17:55 - 2013-05-21 17:55 - 01582626 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.exe
2013-05-20 14:26 - 2013-05-20 14:26 - 00000558 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung (2).lnk
2013-05-20 01:06 - 2013-05-20 01:06 - 00000007 ____A C:\Users\****\Documents\BI3codes.txt
2013-05-20 00:37 - 2013-05-20 00:38 - 00001121 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung.lnk
2013-05-20 00:30 - 2013-06-04 00:28 - 00000503 ____A C:\Windows\SDI.ini
2013-05-20 00:22 - 1993-09-22 02:00 - 00092208 ___RA (Microsoft Corporation) C:\Windows\SysWOW64\WING.DLL
2013-05-20 00:21 - 1993-09-22 02:00 - 00092208 ___RA (Microsoft Corporation) C:\Windows\System32\WING.DLL
2013-05-19 23:54 - 2013-05-19 23:54 - 00001848 ____A C:\Users\****\Desktop\so in etwa.gp5
2013-05-19 22:48 - 2013-05-19 22:48 - 00042543 ____A C:\Users\****\Desktop\bi3.txt
2013-05-19 21:10 - 2013-05-19 21:10 - 00000041 ____A C:\Users\****\Desktop\bi2code.txt
2013-05-19 20:38 - 2013-05-19 20:40 - 99077904 ____A (Oracle Corporation) C:\Users\****\Downloads\VirtualBox-4.2.12-84980-Win.exe
2013-05-19 15:49 - 2013-05-19 18:05 - 00000178 ____A C:\Users\****\Desktop\BI2.txt
2013-05-18 23:35 - 2013-05-18 23:40 - 00000000 ____D C:\Users\****\Downloads\BI32
2013-05-18 23:29 - 2013-05-18 23:33 - 00000000 ____D C:\Users\****\Downloads\BI3
2013-05-18 20:55 - 2013-05-18 20:55 - 00000245 ____A C:\Users\****\Downloads\regupdate.ini
2013-05-18 20:54 - 2013-05-18 20:54 - 13154452 ____A C:\Users\****\Downloads\SIV_1516a.exe
2013-05-17 22:59 - 2013-05-17 22:59 - 00102194 ____A C:\Users\****\Downloads\Ezreal _ League of Legends.htm
2013-05-17 22:58 - 2013-05-17 22:59 - 00000000 ____D C:\Users\****\Downloads\Ezreal _ League of Legends-Dateien
2013-05-17 13:38 - 2013-05-17 13:39 - 17993632 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\AdobeAIRInstaller.exe
2013-05-16 22:26 - 2013-05-16 22:27 - 16785637 ____A C:\Users\****\Downloads\Der Aufzug (Comedy-Hörspiel).flv
2013-05-15 23:07 - 2013-05-15 23:07 - 00000000 ____A C:\Windows\SysWOW64\sho4DA.tmp
2013-05-15 22:50 - 2013-05-05 23:36 - 17818624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-15 22:50 - 2013-05-05 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-15 22:50 - 2013-05-05 21:25 - 12324864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-15 22:50 - 2013-05-05 21:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-15 22:48 - 2013-04-05 03:19 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-15 22:48 - 2013-04-05 03:08 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-15 22:48 - 2013-04-05 03:01 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-15 22:48 - 2013-04-05 03:00 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-15 22:48 - 2013-04-05 02:59 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-15 22:48 - 2013-04-05 02:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-15 22:48 - 2013-04-05 02:57 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-15 22:48 - 2013-04-05 02:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-15 22:48 - 2013-04-05 02:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-15 22:48 - 2013-04-05 02:55 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-15 22:48 - 2013-04-05 02:54 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-15 22:48 - 2013-04-05 02:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-15 22:48 - 2013-04-05 02:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-15 22:48 - 2013-04-05 02:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 22:48 - 2013-04-05 00:11 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-15 22:48 - 2013-04-05 00:09 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-15 22:48 - 2013-04-05 00:02 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-15 22:48 - 2013-04-05 00:02 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-15 22:48 - 2013-04-05 00:02 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-15 22:48 - 2013-04-05 00:01 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-15 22:48 - 2013-04-04 23:59 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-15 22:48 - 2013-04-04 23:58 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-15 22:48 - 2013-04-04 23:58 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-15 22:48 - 2013-04-04 23:57 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-15 22:48 - 2013-04-04 23:56 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-15 22:48 - 2013-04-04 23:55 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-15 22:48 - 2013-04-04 23:54 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-15 22:48 - 2013-04-04 23:50 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-15 22:17 - 2013-05-15 22:17 - 00001296 ____A C:\Users\****\Desktop\blah.txt
2013-05-15 14:06 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 14:06 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 14:06 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 14:06 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 14:06 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 14:06 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 14:06 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 14:06 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 14:06 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 14:06 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 14:06 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 14:06 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 14:06 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-15 14:06 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-14 22:31 - 2013-05-19 20:14 - 00045342 ____A C:\Users\****\Desktop\pantera_cowboys_from_hell.gp5
2013-05-12 22:28 - 2013-06-01 15:27 - 00000000 ___SD C:\Users\****\Google Drive
2013-05-12 22:28 - 2013-05-12 22:28 - 00001714 ____A C:\Users\****\Desktop\Google Drive.lnk
2013-05-12 22:28 - 2013-05-12 22:28 - 00000000 ____D C:\Users\****\AppData\LocalGoogle
2013-05-12 22:25 - 2013-05-12 22:25 - 00000000 ____D C:\Users\MASTER.Master\AppData\LocalGoogle
2013-05-12 22:24 - 2013-06-09 03:29 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-12 22:24 - 2013-05-12 22:29 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-12 22:24 - 2013-05-12 22:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-12 22:23 - 2013-05-12 22:23 - 00781760 ____A (Google Inc.) C:\Users\****\Downloads\googledrivesync.exe
2013-05-12 18:58 - 2013-05-19 20:00 - 00000000 ____D C:\Users\****\AppData\Local\LogMeIn Hamachi
==================== One Month Modified Files and Folders =======
2013-06-09 14:28 - 2013-06-09 14:28 - 00000000 ____D C:\FRST
2013-06-09 14:27 - 2013-06-09 14:27 - 01919210 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-06-09 14:24 - 2012-06-19 03:54 - 00073236 ____A C:\Windows\setupact.log
2013-06-09 14:24 - 2011-03-13 03:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-09 14:24 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-09 03:40 - 2012-06-11 00:51 - 01453505 ____A C:\Windows\WindowsUpdate.log
2013-06-09 03:29 - 2013-05-12 22:24 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-09 02:41 - 2011-04-17 01:25 - 00000000 ____D C:\Users\****\AppData\Roaming\gtk-2.0
2013-06-09 02:41 - 2011-04-17 01:22 - 00000000 ____D C:\Users\****\.gimp-2.6
2013-06-09 02:05 - 2013-06-09 02:05 - 00019870 ____A C:\Users\****\Desktop\Logs.zip
2013-06-09 02:05 - 2013-06-09 01:33 - 00150401 ____A C:\Users\****\Desktop\GMER.txt
2013-06-09 02:05 - 2013-06-09 01:21 - 00075596 ____A C:\Users\****\Desktop\OTL.Txt
2013-06-09 01:42 - 2009-07-14 06:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-09 01:42 - 2009-07-14 06:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-09 01:39 - 2009-07-14 19:58 - 00708018 ____A C:\Windows\System32\perfh007.dat
2013-06-09 01:39 - 2009-07-14 19:58 - 00153320 ____A C:\Windows\System32\perfc007.dat
2013-06-09 01:39 - 2009-07-14 07:13 - 01643900 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-09 01:22 - 2013-06-09 01:22 - 00075596 ____A C:\Users\MASTER.Master\Desktop\OTL.Txt
2013-06-08 23:24 - 2012-04-20 03:50 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc
2013-06-08 23:07 - 2013-06-08 23:07 - 00000154 ____A C:\Users\****\Desktop\liste.txt
2013-06-08 20:05 - 2011-03-28 19:06 - 00000000 ____D C:\Users\****\AppData\Roaming\Audacity
2013-06-08 16:11 - 2013-06-08 15:59 - 00003766 ____A C:\Users\****\Desktop\artikel.txt
2013-06-08 16:00 - 2013-06-08 16:00 - 23959201 ____A C:\Users\****\Desktop\Fotos.zip
2013-06-08 15:57 - 2013-06-08 15:48 - 00000000 ____D C:\Users\****\Desktop\Fotos
2013-06-08 15:45 - 2013-06-08 00:22 - 00003968 ____A C:\Users\****\Desktop\bericht.txt
2013-06-08 04:24 - 2012-09-15 02:32 - 00000000 ____D C:\Users\****\AppData\Roaming\TS3Client
2013-06-06 22:48 - 2012-05-31 22:48 - 00000000 ____D C:\Users\****\Desktop\nice
2013-06-06 01:26 - 2012-03-21 02:57 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-06-06 01:20 - 2013-02-11 23:29 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-05 21:53 - 2011-08-25 00:35 - 00022166 ____A C:\Users\****\Downloads\hold the line (2).aup
2013-06-04 19:13 - 2013-06-04 18:27 - 00029004 ____A C:\Users\****\Downloads\layla.aup
2013-06-04 18:27 - 2013-06-04 18:27 - 00000000 ____D C:\Users\****\Downloads\layla_data
2013-06-04 18:13 - 2013-06-04 18:13 - 00007249 ____A C:\Users\****\Downloads\crossroads (2).mp3.aup
2013-06-04 18:13 - 2013-06-04 18:13 - 00000000 ____D C:\Users\****\Downloads\crossroads (2).mp3_data
2013-06-04 00:28 - 2013-05-20 00:30 - 00000503 ____A C:\Windows\SDI.ini
2013-06-04 00:24 - 2011-03-16 18:12 - 00000000 ____D C:\Users\****\AppData\Roaming\.minecraft
2013-06-03 23:30 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-03 18:38 - 2013-06-03 18:38 - 00012057 ____A C:\Users\****\Downloads\fear.aup
2013-06-03 18:38 - 2013-06-03 18:38 - 00000000 ____D C:\Users\****\Downloads\fear_data
2013-06-03 15:17 - 2013-06-03 15:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Users\MASTER.Master\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Program Files (x86)\AkaiPro
2013-06-01 19:43 - 2012-04-25 14:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-01 16:39 - 2013-06-01 16:39 - 00001149 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-01 16:39 - 2011-04-01 05:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-01 15:27 - 2013-05-12 22:28 - 00000000 ___SD C:\Users\****\Google Drive
2013-06-01 15:25 - 2013-06-01 15:04 - 00000000 ____D C:\Users\****\Documents\Photos
2013-05-30 20:10 - 2013-05-30 20:10 - 00018953 ____A C:\Users\****\Documents\gysi.odt
2013-05-27 16:50 - 2013-05-27 16:50 - 02959376 ____A (Microsoft Corporation) C:\Users\****\Downloads\dotnetfx35setup.exe
2013-05-27 16:48 - 2013-05-27 16:48 - 01582608 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.1.exe
2013-05-27 16:48 - 2013-02-13 21:11 - 00001903 ____A C:\Users\Public\Desktop\LOL Recorder.lnk
2013-05-27 16:48 - 2012-12-05 12:29 - 00000000 ____D C:\Program Files (x86)\LOLReplay
2013-05-26 15:18 - 2013-05-31 00:19 - 00001672 ____A C:\Users\****\Desktop\battle isle 3 units.txt
2013-05-26 15:18 - 2013-05-25 16:29 - 00001672 ____A C:\Users\****\Documents\battle isle 3 units.txt
2013-05-26 15:10 - 2013-03-31 16:01 - 00000000 ____D C:\dosprogs
2013-05-26 15:07 - 2012-06-12 21:42 - 00001886 ____A C:\Windows\Sandboxie.ini
2013-05-25 23:22 - 2011-03-17 19:37 - 00000000 ____D C:\Users\****\AppData\Roaming\ICQ
2013-05-25 17:45 - 2013-05-25 17:45 - 00004482 ____A C:\Users\****\Desktop\follow.gp5
2013-05-24 21:43 - 2013-05-23 18:56 - 00019893 ____A C:\Users\****\Downloads\sail away.gp5
2013-05-24 21:42 - 2013-03-08 05:18 - 00062201 ____A C:\Users\****\Desktop\misc_unsigned_bands_league_of_legends_-_here_comes_vi.gp5
2013-05-24 21:28 - 2013-05-24 21:28 - 00016246 ____A C:\Users\****\Documents\Lykke Li - I follow rivers (Lyrics).aup
2013-05-24 21:28 - 2013-05-24 21:28 - 00016227 ____A C:\Users\****\Documents\I follow rivers2.aup
2013-05-24 21:28 - 2013-05-24 21:28 - 00000000 ____D C:\Users\****\Documents\Lykke Li - I follow rivers (Lyrics)_data
2013-05-24 21:28 - 2013-05-24 21:28 - 00000000 ____D C:\Users\****\Documents\I follow rivers2_data
2013-05-24 21:19 - 2013-05-24 21:19 - 00005525 ____A C:\Users\****\Downloads\sail away.aup
2013-05-24 21:19 - 2013-05-24 21:19 - 00000000 ____D C:\Users\****\Downloads\sail away_data
2013-05-23 23:11 - 2013-05-23 23:11 - 00014551 ____A C:\Users\****\Desktop\delix.odt
2013-05-23 19:24 - 2012-04-10 18:17 - 00000000 ____D C:\users\MASTER.Master
2013-05-22 23:26 - 2013-05-22 23:26 - 00020012 ____A C:\Users\****\Documents\cc_20130522_232630.reg
2013-05-22 22:18 - 2013-05-22 20:43 - 00005029 ____A C:\Users\****\Downloads\angel.gp5
2013-05-22 19:50 - 2013-05-22 19:50 - 00004115 ____A C:\Users\****\Downloads\Ready for Action.gp5
2013-05-21 18:06 - 2012-04-28 00:23 - 00000000 ____D C:\Program Files (x86)\AVAST
2013-05-21 18:00 - 2012-04-28 00:03 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2013-05-21 17:56 - 2012-04-13 17:12 - 00117336 ____A C:\Users\MASTER.Master\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-21 17:55 - 2013-05-21 17:55 - 01582626 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.exe
2013-05-20 14:26 - 2013-05-20 14:26 - 00000558 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung (2).lnk
2013-05-20 01:06 - 2013-05-20 01:06 - 00000007 ____A C:\Users\****\Documents\BI3codes.txt
2013-05-20 00:38 - 2013-05-20 00:37 - 00001121 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung.lnk
2013-05-20 00:18 - 2011-05-10 16:01 - 00000000 ____D C:\BlueByte
2013-05-19 23:54 - 2013-05-19 23:54 - 00001848 ____A C:\Users\****\Desktop\so in etwa.gp5
2013-05-19 22:48 - 2013-05-19 22:48 - 00042543 ____A C:\Users\****\Desktop\bi3.txt
2013-05-19 21:10 - 2013-05-19 21:10 - 00000041 ____A C:\Users\****\Desktop\bi2code.txt
2013-05-19 20:40 - 2013-05-19 20:38 - 99077904 ____A (Oracle Corporation) C:\Users\****\Downloads\VirtualBox-4.2.12-84980-Win.exe
2013-05-19 20:14 - 2013-05-14 22:31 - 00045342 ____A C:\Users\****\Desktop\pantera_cowboys_from_hell.gp5
2013-05-19 20:00 - 2013-05-12 18:58 - 00000000 ____D C:\Users\****\AppData\Local\LogMeIn Hamachi
2013-05-19 18:05 - 2013-05-19 15:49 - 00000178 ____A C:\Users\****\Desktop\BI2.txt
2013-05-19 01:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-05-19 01:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-05-18 23:40 - 2013-05-18 23:35 - 00000000 ____D C:\Users\****\Downloads\BI32
2013-05-18 23:33 - 2013-05-18 23:29 - 00000000 ____D C:\Users\****\Downloads\BI3
2013-05-18 20:55 - 2013-05-18 20:55 - 00000245 ____A C:\Users\****\Downloads\regupdate.ini
2013-05-18 20:54 - 2013-05-18 20:54 - 13154452 ____A C:\Users\****\Downloads\SIV_1516a.exe
2013-05-18 16:24 - 2011-05-06 01:15 - 00000000 ____D C:\Users\****\AppData\Local\S2
2013-05-17 22:59 - 2013-05-17 22:59 - 00102194 ____A C:\Users\****\Downloads\Ezreal _ League of Legends.htm
2013-05-17 22:59 - 2013-05-17 22:58 - 00000000 ____D C:\Users\****\Downloads\Ezreal _ League of Legends-Dateien
2013-05-17 22:51 - 2012-06-17 23:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-17 22:51 - 2012-06-17 23:29 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-17 22:51 - 2011-03-13 09:53 - 00000000 ____D C:\ProgramData\Adobe
2013-05-17 13:39 - 2013-05-17 13:38 - 17993632 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\AdobeAIRInstaller.exe
2013-05-17 13:24 - 2013-04-12 19:21 - 00000000 ____D C:\Users\****\Downloads\Enigma_Item_Changer_3.2.2
2013-05-16 22:27 - 2013-05-16 22:26 - 16785637 ____A C:\Users\****\Downloads\Der Aufzug (Comedy-Hörspiel).flv
2013-05-16 11:10 - 2009-07-14 06:45 - 00447640 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 23:07 - 2013-05-15 23:07 - 00000000 ____A C:\Windows\SysWOW64\sho4DA.tmp
2013-05-15 23:00 - 2011-04-06 15:41 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-05-15 22:57 - 2011-03-21 19:13 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 22:17 - 2013-05-15 22:17 - 00001296 ____A C:\Users\****\Desktop\blah.txt
2013-05-12 22:29 - 2013-05-12 22:24 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-12 22:28 - 2013-05-12 22:28 - 00001714 ____A C:\Users\****\Desktop\Google Drive.lnk
2013-05-12 22:28 - 2013-05-12 22:28 - 00000000 ____D C:\Users\****\AppData\LocalGoogle
2013-05-12 22:28 - 2011-03-16 17:58 - 00000000 ____D C:\users\****
2013-05-12 22:25 - 2013-05-12 22:25 - 00000000 ____D C:\Users\MASTER.Master\AppData\LocalGoogle
2013-05-12 22:25 - 2013-01-21 14:52 - 00000000 ____D C:\Users\MASTER.Master\AppData\Local\Google
2013-05-12 22:25 - 2011-05-06 15:40 - 00000000 ____D C:\Users\****\AppData\Local\Google
2013-05-12 22:24 - 2013-05-12 22:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-12 22:23 - 2013-05-12 22:23 - 00781760 ____A (Google Inc.) C:\Users\****\Downloads\googledrivesync.exe
2013-05-12 18:55 - 2013-02-09 03:19 - 03857920 ____A C:\Users\****\Downloads\hamachi210166.msi
2013-05-12 01:44 - 2013-01-15 17:05 - 00137062 ____A C:\Users\****\Desktop\A Moment Filled With Emptynessexp.mid
Files to move or delete:
====================
C:\Users\MASTER\Launch Fix*it.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-06-2013 Ran by **** at 2013-06-09 14:29:22 Run: Running from C:\Users\****\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 7-Zip 9.20 (x64 edition) (Version: 9.20.00.0) AccelerometerP11 (Version: 2.00.11.22) Adobe AIR (Version: 3.7.0.1860) Adobe Flash Player 11 Plugin (Version: 11.7.700.202) Adobe Shockwave Player 12.0 (Version: 12.0.2.122) Advanced Audio FX Engine (Version: 1.12.05) Age of Empires II - The Conquerors - 1.0e Patch FINAL (Version: 1.0e) Amazon MP3-Downloader 1.0.9 Amnesia - The Dark Descent (Version: 1.2) Audacity 1.3.12 Audacity 2.0.3 (Version: 2.0.3) avast! Free Antivirus (Version: 8.0.1489.0) Baldur's Gate Baldur's Gate Enhanced Edition (Version: 0.2.3.0) Baldurs Gate(TM) II - Thron des Bhaal (TM) Ballerburg Battlefield 1942 Battlefield 2(TM) Battlefield 2142 Burger Mania (Version: ) Camouflage Cannon Hill (Version: ) CanoScan LiDE 110 Scanner Driver CCleaner (Version: 3.17) CDBurnerXP (Version: 4.4.0.2838) Civilization III Civilization III: Conquests D3DX10 (Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition Dell DataSafe Online (Version: 2.1.19634) Dell Edoc Viewer (Version: 1.0.0) Dell Getting Started Guide (Version: 1.00.0000) Dell VideoStage (Version: 1.1.0.1011) Dell Webcam Central (Version: 2.00.35) Desura (Version: 100.53) Dev-C++ 5 beta 9 release (4.9.9.2) Die Siedler 2 - Die nächste Generation (Version: 1.00.0000) Die Siedler IV DLTC Editor Pro (remove only) DVDStyler v2.2 eBay (Version: 1.4.0) Elite Force Falafel King (Version: 1.00.0000) FFmpeg for Audacity on Windows FireJump 1.0 Free Alarm Clock 2.5.0 (Version: 2.5) Free YouTube Download 3 version 3.0.12.804 Free YouTube Download version 3.1.37.918 (Version: 3.1.37.918) Frets On Fire (Version: 1.3.110-win32) Fritz 7 (Version: 1.00.000) Führerschein-Trainer GIMP 2.6.11 (Version: 2.6.11) Gmail Backup GoldGun (Version: 1.00.0000) Google Drive (Version: 1.9.4536.8202) Google Update Helper (Version: 1.3.21.145) Guitar Pro 5.2 Hitblock (Version: 1.00.0000) HyperCam 2 ICQ7.5 (Version: 7.5) ImgBurn (Version: 2.5.7.0) Intel PROSet Wireless Intel(R) Control Center (Version: 1.2.1.1007) Intel(R) Management Engine Components (Version: 7.0.0.1144) Intel(R) Processor Graphics (Version: 8.15.10.2272) Intel(R) PROSet/Wireless WiFi-Software (Version: 14.00.1000) Java Auto Updater (Version: 2.1.6.0) Java(TM) 6 Update 22 (64-bit) (Version: 6.0.220) Java(TM) 6 Update 22 (Version: 6.0.220) Java(TM) 6 Update 31 (Version: 6.0.310) Java(TM) 7 Update 5 (Version: 7.0.50) JavaFX 2.1.1 (Version: 2.1.1) Junk Mail filter update (Version: 15.4.3502.0922) LAME v3.98.3 for Audacity League of Legends (Version: 1.02.0000) Little Big Adventure Little Big Adventure for Windows 0.8.1 LOLReplay (Version: 0.8.2.1) Löwenzahn 4 Löwenzahn 5 (Version: 1.00.0000) Löwenzahn 6 (Version: 1.00.0000) Magic Lernprogramm (Version: 2.00.0000) Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Melodyne Runtime 4.1 (x64) (Version: 1.0.1) Mesh Runtime (Version: 15.4.5722.2) Messenger Companion (Version: 15.4.3502.0922) Microsoft .NET Framework 1.1 (Version: 1.1.4322) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Multi-Targeting Pack (Version: 4.0.30319) Microsoft Age of Empires II Microsoft Age of Empires II: The Conquerors Expansion Microsoft Application Error Reporting (Version: 12.0.6012.5000) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Help Viewer 1.0 (Version: 1.0.30319) Microsoft Help Viewer 1.0 Language Pack - DEU (Version: 1.0.30319) Microsoft Office 2010 (Version: 14.0.4763.1000) Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Professional 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (Version: 14.0.6029.1000) Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000) Microsoft SQL Server Compact 3.5 SP2 DEU (Version: 3.5.8080.0) Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU (Version: 10.0.30319) Mozilla Firefox 21.0 (x86 de) (Version: 21.0) Mozilla Maintenance Service (Version: 21.0) MSVCRT (Version: 15.4.2862.0708) MSVCRT_amd64 (Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0) MusicStage (Version: 1.3.31.0) Nitro Reader 2 (Version: 2.5.0.45) NVIDIA 3D Vision Treiber 314.07 (Version: 314.07) NVIDIA Grafiktreiber 314.07 (Version: 314.07) NVIDIA HD-Audiotreiber 1.3.23.1 (Version: 1.3.23.1) NVIDIA Install Application (Version: 2.1002.109.706) NVIDIA Optimus 1.12.12 (Version: 1.12.12) NVIDIA PhysX (Version: 9.12.1031) NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031) NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1407) NVIDIA Systemsteuerung 314.07 (Version: 314.07) NVIDIA Update 1.12.12 (Version: 1.12.12) NVIDIA Update Components (Version: 1.12.12) OpenAL OpenOffice.org 3.3 (Version: 3.3.9567) PANZERS - Phase1 Portal Portal 2 Portal 2 Authoring Tools - Beta Portal 2 Publishing Tool Project64 1.6 (Version: 1.6) Quickset64 (Version: 11.0.10) Realtek High Definition Audio Driver (Version: 6.0.1.6662) Reman Rebellion Robin Hood - Die Legende von Sherwood RollerCoaster Tycoon 3 (Version: 1.00.000) Rush for Berlin (Version: 1.24) Sandboxie 3.70 (64-bit) (Version: 3.70) Schmidt Interaktivspaß Skat Spybot - Search & Destroy (Version: 1.6.2) Star Trek Armada II Star Trek Elite Force II Star Trek: Armada Steam (Version: 1.0.0.0) SUPERAntiSpyware (Version: 5.0.1146) swMSM (Version: 12.0.0.1) Synaptics Pointing Device Driver (Version: 15.1.15.0) TeamSpeak 3 Client (Version: 3.0.10.1) Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0) Uninstall 1.0.0.1 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1) Update for Microsoft Office 2010 (KB2494150) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition VLC media player 2.0.6 (Version: 2.0.6) Warcraft III Windows Live Communications Platform (Version: 15.4.3502.0922) Windows Live Essentials (Version: 15.4.3502.0922) Windows Live Essentials (Version: 15.4.3555.0308) Windows Live Fotogalerie (Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3555.0308) Windows Live Mail (Version: 15.4.3502.0922) Windows Live Mesh (Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2) Windows Live Messenger (Version: 15.4.3538.0513) Windows Live Messenger Companion Core (Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (Version: 15.4.3502.0922) Windows Live Photo Common (Version: 15.4.3502.0922) Windows Live Photo Gallery (Version: 15.4.3502.0922) Windows Live PIMT Platform (Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (Version: 15.4.3502.0922) Windows Live SOXE Definitions (Version: 15.4.3502.0922) Windows Live UX Platform (Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (Version: 15.4.3508.1109) Windows Live Writer (Version: 15.4.3502.0922) Windows Live Writer Resources (Version: 15.4.3502.0922) Windows Media Player Firefox Plugin (Version: 1.0.0.8) WinLems 1.24 WordToPDF 2.4 (Version: 2.4) Yahoo! Detect ==================== Restore Points ========================= ==================== Hosts content: ========================== 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 www.100888290cs.com 127.0.0.1 100888290cs.com 127.0.0.1 100sexlinks.com There are more than 1000 lines starting with "127.0.0.1" ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (06/08/2013 03:05:13 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LolClient.exe, Version: 2.0.2.12610, Zeitstempel: 0x4c00573a Name des fehlerhaften Moduls: Adobe AIR.dll, Version: 3.6.0.5920, Zeitstempel: 0x510610d1 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0006de2d ID des fehlerhaften Prozesses: 0xb08 Startzeit der fehlerhaften Anwendung: 0xLolClient.exe0 Pfad der fehlerhaften Anwendung: LolClient.exe1 Pfad des fehlerhaften Moduls: LolClient.exe2 Berichtskennung: LolClient.exe3 Error: (06/04/2013 05:57:11 PM) (Source: Application Hang) (User: ) Description: Programm GP5.exe, Version 5.2.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 10f4 Startzeit: 01ce613c14959e2a Endzeit: 10 Anwendungspfad: C:\Program Files (x86)\Guitar Pro 5\GP5.exe Berichts-ID: 6643b041-cd2f-11e2-951b-14feb59a6104 Error: (05/27/2013 10:46:27 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LolClient.exe, Version: 0.0.0.0, Zeitstempel: 0x515663e0 Name des fehlerhaften Moduls: Adobe AIR.dll, Version: 3.7.0.1530, Zeitstempel: 0x5156646c Ausnahmecode: 0xc0000005 Fehleroffset: 0x0006dd76 ID des fehlerhaften Prozesses: 0xe40 Startzeit der fehlerhaften Anwendung: 0xLolClient.exe0 Pfad der fehlerhaften Anwendung: LolClient.exe1 Pfad des fehlerhaften Moduls: LolClient.exe2 Berichtskennung: LolClient.exe3 Error: (05/27/2013 06:34:44 PM) (Source: Application Hang) (User: ) Description: Programm League Of Legends.exe, Version 3.7.0.328 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 149c Startzeit: 01ce5af80a83861a Endzeit: 48 Anwendungspfad: C:\Users\MASTER.Master\Documents\LOLReplay\data\3.7.0.328\League Of Legends.exe Berichts-ID: 4d75b127-c6eb-11e2-9869-14feb59a6104 Error: (05/26/2013 10:37:10 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LolClient.exe, Version: 0.0.0.0, Zeitstempel: 0x515663e0 Name des fehlerhaften Moduls: Adobe AIR.dll, Version: 3.7.0.1530, Zeitstempel: 0x5156646c Ausnahmecode: 0xc0000005 Fehleroffset: 0x0006dd76 ID des fehlerhaften Prozesses: 0xddc Startzeit der fehlerhaften Anwendung: 0xLolClient.exe0 Pfad der fehlerhaften Anwendung: LolClient.exe1 Pfad des fehlerhaften Moduls: LolClient.exe2 Berichtskennung: LolClient.exe3 Error: (05/25/2013 00:17:36 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LolClient.exe, Version: 0.0.0.0, Zeitstempel: 0x515663e0 Name des fehlerhaften Moduls: Adobe AIR.dll, Version: 3.7.0.1530, Zeitstempel: 0x5156646c Ausnahmecode: 0xc0000005 Fehleroffset: 0x0006dd76 ID des fehlerhaften Prozesses: 0x14a0 Startzeit der fehlerhaften Anwendung: 0xLolClient.exe0 Pfad der fehlerhaften Anwendung: LolClient.exe1 Pfad des fehlerhaften Moduls: LolClient.exe2 Berichtskennung: LolClient.exe3 Error: (05/24/2013 10:23:52 PM) (Source: Application Hang) (User: ) Description: Programm audacity.exe, Version 2.0.3.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 12b0 Startzeit: 01ce58b775fc0764 Endzeit: 10 Anwendungspfad: C:\Program Files (x86)\Audacity 2X\audacity.exe Berichts-ID: d807ed80-c4af-11e2-95bf-14feb59a6104 Error: (05/24/2013 09:42:37 PM) (Source: Application Hang) (User: ) Description: Programm audacity.exe, Version 2.0.3.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 91c Startzeit: 01ce58b63b5fae23 Endzeit: 10 Anwendungspfad: C:\Program Files (x86)\Audacity 2X\audacity.exe Berichts-ID: 14938486-c4aa-11e2-95bf-14feb59a6104 Error: (05/24/2013 09:38:07 PM) (Source: Application Hang) (User: ) Description: Programm audacity.exe, Version 2.0.3.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: bc8 Startzeit: 01ce58b59c48bfa0 Endzeit: 10 Anwendungspfad: C:\Program Files (x86)\Audacity 2X\audacity.exe Berichts-ID: 72e73f8a-c4a9-11e2-95bf-14feb59a6104 Error: (05/20/2013 00:56:27 AM) (Source: Application Hang) (User: ) Description: Programm SDI_1R.EXE, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 89c Startzeit: 01ce54e3c82e739c Endzeit: 5 Anwendungspfad: C:\BlueByte\SDI\BIN\SDI_1R.EXE Berichts-ID: 5466a027-c0d7-11e2-9448-14feb59a6104 System errors: ============= Error: (06/09/2013 02:29:10 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (06/09/2013 02:29:10 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (06/09/2013 02:27:07 PM) (Source: Service Control Manager) (User: ) Description: Dienst "SearchAnonymizer" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (06/09/2013 02:24:46 PM) (Source: Microsoft-Windows-TaskScheduler) (User: NT-AUTORITÄT) Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147549183. Error: (06/09/2013 01:37:18 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (06/09/2013 01:37:18 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (06/09/2013 01:35:11 AM) (Source: Service Control Manager) (User: ) Description: Dienst "SearchAnonymizer" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (06/09/2013 01:34:20 AM) (Source: Microsoft-Windows-TaskScheduler) (User: NT-AUTORITÄT) Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147549183. Error: (06/09/2013 00:07:57 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (06/09/2013 00:07:57 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Microsoft Office Sessions: ========================= Error: (06/08/2013 03:05:13 AM) (Source: Application Error)(User: ) Description: LolClient.exe2.0.2.126104c00573aAdobe AIR.dll3.6.0.5920510610d1c00000050006de2db0801ce63dc1e618bbcC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.26\deploy\LolClient.exeC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.26\deploy\Adobe AIR\Versions\1.0\Adobe AIR.dll78d17fd7-cfd7-11e2-929d-14feb59a6104 Error: (06/04/2013 05:57:11 PM) (Source: Application Hang)(User: ) Description: GP5.exe5.2.0.010f401ce613c14959e2a10C:\Program Files (x86)\Guitar Pro 5\GP5.exe6643b041-cd2f-11e2-951b-14feb59a6104 Error: (05/27/2013 10:46:27 PM) (Source: Application Error)(User: ) Description: LolClient.exe0.0.0.0515663e0Adobe AIR.dll3.7.0.15305156646cc00000050006dd76e4001ce5ae9e0ca4357C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.21\deploy\LolClient.exeC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.21\deploy\Adobe AIR\Versions\1.0\Adobe AIR.dll7fe3dd50-c70e-11e2-9869-14feb59a6104 Error: (05/27/2013 06:34:44 PM) (Source: Application Hang)(User: ) Description: League Of Legends.exe3.7.0.328149c01ce5af80a83861a48C:\Users\MASTER.Master\Documents\LOLReplay\data\3.7.0.328\League Of Legends.exe4d75b127-c6eb-11e2-9869-14feb59a6104 Error: (05/26/2013 10:37:10 PM) (Source: Application Error)(User: ) Description: LolClient.exe0.0.0.0515663e0Adobe AIR.dll3.7.0.15305156646cc00000050006dd76ddc01ce5a3799be2d05C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.21\deploy\LolClient.exeC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.21\deploy\Adobe AIR\Versions\1.0\Adobe AIR.dll0942aa94-c644-11e2-9374-14feb59a6104 Error: (05/25/2013 00:17:36 AM) (Source: Application Error)(User: ) Description: LolClient.exe0.0.0.0515663e0Adobe AIR.dll3.7.0.15305156646cc00000050006dd7614a001ce58bd5d0c2a39C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.20\deploy\LolClient.exeC:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.20\deploy\Adobe AIR\Versions\1.0\Adobe AIR.dllbc417c4b-c4bf-11e2-96a5-14feb59a6104 Error: (05/24/2013 10:23:52 PM) (Source: Application Hang)(User: ) Description: audacity.exe2.0.3.012b001ce58b775fc076410C:\Program Files (x86)\Audacity 2X\audacity.exed807ed80-c4af-11e2-95bf-14feb59a6104 Error: (05/24/2013 09:42:37 PM) (Source: Application Hang)(User: ) Description: audacity.exe2.0.3.091c01ce58b63b5fae2310C:\Program Files (x86)\Audacity 2X\audacity.exe14938486-c4aa-11e2-95bf-14feb59a6104 Error: (05/24/2013 09:38:07 PM) (Source: Application Hang)(User: ) Description: audacity.exe2.0.3.0bc801ce58b59c48bfa010C:\Program Files (x86)\Audacity 2X\audacity.exe72e73f8a-c4a9-11e2-95bf-14feb59a6104 Error: (05/20/2013 00:56:27 AM) (Source: Application Hang)(User: ) Description: SDI_1R.EXE0.0.0.089c01ce54e3c82e739c5C:\BlueByte\SDI\BIN\SDI_1R.EXE5466a027-c0d7-11e2-9448-14feb59a6104 CodeIntegrity Errors: =================================== Date: 2012-03-21 01:44:43.278 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\99D0.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-03-21 01:44:43.228 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\99D0.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-03-21 01:34:40.096 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\99D0.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-03-21 01:34:40.038 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\99D0.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-03-21 01:30:34.449 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\99D0.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-03-21 01:30:34.390 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\99D0.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. ==================== Memory info =========================== Percentage of memory in use: 53% Total physical RAM: 4010.17 MB Available physical RAM: 1851.54 MB Total Pagefile: 8018.53 MB Available Pagefile: 5893.06 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:532.6 GB) (Free:218.37 GB) NTFS (Disk=0 Partition=3) Drive d: (BI3_CD1) (CDROM) (Total:0.6 GB) (Free:0 GB) CDFS Drive z: (OS II) (Fixed) (Total:48.83 GB) (Free:47.61 GB) NTFS (Disk=0 Partition=4) ==================== MBR & Partition Table ================== ==================== End Of Log ============================ Geändert von Cellix (09.06.2013 um 14:37 Uhr) |
|
09.06.2013, 15:17
| #4 | |
| /// the machine /// TB-Ausbilder | Google öffnet sich eigenständigCombofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.06.2013, 15:46
| #5 |
| | Google öffnet sich eigenständig Ok, bitteschön: Code:
ATTFilter ComboFix 13-06-08.02 - MASTER 09.06.2013 16:30:46.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4010.1741 [GMT 2:00]
ausgeführt von:: c:\users\****\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\users\****\AppData\Roaming\mIRC\logs\status.log
c:\users\****\Documents\~WRL2532.tmp
c:\windows\IsUn0407.exe
c:\windows\SysWow64\frapsvid.dll
c:\windows\SysWow64\WSPDll.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-05-09 bis 2013-06-09 ))))))))))))))))))))))))))))))
.
.
2013-06-09 14:39 . 2013-06-09 14:39 -------- d-----w- c:\users\MASTER~1~MAS\AppData\Local\temp
2013-06-09 14:39 . 2013-06-09 14:39 -------- d-----w- c:\users\MASTER.Master\AppData\Local\temp
2013-06-09 12:28 . 2013-06-09 12:28 -------- d-----w- C:\FRST
2013-06-03 13:17 . 2013-06-03 13:17 -------- d-----w- c:\users\****\AppData\Roaming\Cycling '74
2013-06-03 13:15 . 2013-06-03 13:15 -------- d-----w- c:\users\MASTER.Master\AppData\Roaming\Cycling '74
2013-06-03 13:15 . 2013-06-03 13:15 -------- d-----w- c:\program files (x86)\AkaiPro
2013-06-01 14:39 . 2013-05-11 22:27 262552 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-06-01 14:39 . 2013-05-11 22:26 26520 ----a-w- c:\program files (x86)\Mozilla Firefox\plugin-hang-ui.exe
2013-05-19 22:22 . 1993-09-22 00:00 92208 ----a-r- c:\windows\SysWow64\WING.DLL
2013-05-19 22:21 . 1993-09-22 00:00 92208 ----a-r- c:\windows\system32\WING.DLL
2013-05-15 21:07 . 2013-05-15 21:07 0 ----a-w- c:\windows\SysWow64\sho4DA.tmp
2013-05-15 20:50 . 2013-05-05 21:36 17818624 ----a-w- c:\windows\system32\mshtml.dll
2013-05-15 20:50 . 2013-05-05 21:16 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2013-05-15 20:50 . 2013-05-05 19:12 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-05-15 12:06 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-12 20:28 . 2013-06-01 13:27 -------- d-s---w- c:\users\****\Google Drive
2013-05-12 20:24 . 2013-05-12 20:24 -------- d-----w- c:\program files (x86)\Google
2013-05-12 16:58 . 2013-05-19 18:00 -------- d-----w- c:\users\****\AppData\Local\LogMeIn Hamachi
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-17 20:51 . 2012-06-17 21:29 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-17 20:51 . 2012-06-17 21:29 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-15 20:57 . 2011-03-21 17:13 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-13 13:42 . 2012-04-25 18:56 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-09 08:59 . 2013-03-10 00:24 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-05-09 08:59 . 2013-03-10 00:24 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2012-04-27 22:23 378432 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-05-09 08:59 . 2012-04-27 22:23 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-05-09 08:59 . 2012-04-27 22:23 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2012-04-27 22:23 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-05-09 08:59 . 2012-04-27 22:23 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:59 . 2012-04-27 22:23 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:58 . 2012-04-27 22:23 41664 ----a-w- c:\windows\avastSS.scr
2013-05-09 08:58 . 2012-04-27 22:03 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-05-07 02:54 . 2013-05-07 02:54 2253282 ----a-r- c:\users\MASTER.Master\AppData\Roaming\Microsoft\Installer\{E70C67ED-4592-11D6-85CC-00A0CC603DBA}\Löwenzahn6.exe
2013-05-06 16:35 . 2013-05-06 16:35 2255386 ----a-r- c:\users\MASTER.Master\AppData\Roaming\Microsoft\Installer\{DE470016-1C64-11D5-982A-0050DA602C65}\Löwenzahn5.exe
2013-05-06 16:19 . 2013-05-06 16:19 43520 ----a-w- c:\windows\SysWow64\CmdLineExt03.dll
2013-04-28 13:10 . 2013-04-28 13:10 45056 ----a-r- c:\users\MASTER.Master\AppData\Roaming\Microsoft\Installer\{0AA3AF26-2FA7-4719-9A97-664CD6D332F6}\NewShortcut3_0AA3AF262FA747199A97664CD6D332F6.exe
2013-04-28 13:10 . 2013-04-28 13:10 45056 ----a-r- c:\users\MASTER.Master\AppData\Roaming\Microsoft\Installer\{0AA3AF26-2FA7-4719-9A97-664CD6D332F6}\NewShortcut1_0AA3AF262FA747199A97664CD6D332F6.exe
2013-04-28 13:10 . 2013-04-28 13:10 45056 ----a-r- c:\users\MASTER.Master\AppData\Roaming\Microsoft\Installer\{0AA3AF26-2FA7-4719-9A97-664CD6D332F6}\ARPPRODUCTICON.exe
2013-04-13 05:49 . 2013-05-15 12:06 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 12:06 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 12:06 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 12:06 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 12:06 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 12:06 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 12:17 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-08 11:42 . 2013-04-19 13:38 12800 ----a-w- c:\windows\system\Wing32.dll
2013-04-08 11:42 . 2013-04-08 11:44 12800 ----a-w- c:\windows\SysWow64\Wing32.dll
2013-04-08 11:42 . 2013-04-08 11:43 12800 ----a-w- c:\windows\system32\Wing32.dll
2013-04-04 12:50 . 2012-03-20 20:24 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-19 06:04 . 2013-04-10 10:23 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 10:23 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 10:23 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 10:23 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 10:23 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 10:23 112640 ----a-w- c:\windows\system32\smss.exe
2013-03-18 22:09 . 2013-03-18 22:09 0 ----a-w- c:\windows\SysWow64\shoBFEC.tmp
2013-03-14 23:40 . 2013-03-14 23:40 0 ----a-w- c:\windows\SysWow64\sho342.tmp
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files (x86)\AVAST\avastUI.exe" [2013-05-09 4858968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"aswAhAScr.dll"="c:\program files (x86)\AVAST\aswRegSvr.exe" [2013-05-09 51880]
"aswasOutExt.dll"="c:\program files (x86)\AVAST\aswRegSvr.exe" [2013-05-09 51880]
"aswasOutExt64.dll"="c:\program files (x86)\AVAST\aswRegSvr64.exe" [2013-05-09 50904]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
LOLRecorder.lnk - c:\program files (x86)\LOLReplay\LOLRecorder.exe [2013-5-27 526336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SearchAnonymizer;SearchAnonymizer;c:\users\****\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe;c:\users\****\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys;c:\windows\SYSNATIVE\DRIVERS\ASPI32.sys [x]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\99D0.tmp;c:\windows\SYSNATIVE\99D0.tmp [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\DRIVERS\nvstusb.sys;c:\windows\SYSNATIVE\DRIVERS\nvstusb.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R4 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe;c:\program files (x86)\Common Files\Desura\desura_service.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [x]
S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 qicflt;upper Device Filter Driver;c:\windows\system32\DRIVERS\qicflt.sys;c:\windows\SYSNATIVE\DRIVERS\qicflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-12 20:24]
.
2013-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-12 20:24]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files (x86)\AVAST\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-01-04 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-01-04 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-01-04 418328]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-12 6548112]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-06-13 1212560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\MASTER.Master\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
FF - ProfilePath - c:\users\MASTER.Master\AppData\Roaming\Mozilla\Firefox\Profiles\e26fddc7.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/webhp?hl=de&tab=ww
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Baldur's Gate - c:\windows\IsUn0407.exe
AddRemove-Camouflage - c:\program files (x86)\Camouflage\Uninst.isu
AddRemove-Elite Force - c:\windows\IsUn0407.exe
AddRemove-Free YouTube Download 3_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-Free YouTube Download_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-Little Big Adventure - c:\lba\uninstall.exe
AddRemove-Loewe4 - c:\windows\IsUn0407.exe
AddRemove-S4Uninst - c:\windows\IsUn0407.exe
AddRemove-Schmidt Interaktivspaß Skat - c:\windows\IsUn0407.exe
AddRemove-Star Trek Armada II - c:\windows\IsUn0407.exe
AddRemove-Star Trek Voyager Elite Force - c:\windows\IsUn0407.exe
AddRemove-Uninstall_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\unins000.exe
AddRemove-{54B7A3C7-0940-4C16-A509-FC3C3758D22A}_is1 - z:\programme\Amnesia - The Dark Descent\unins000.exe
AddRemove-{BAB1B719-79D5-4EC0-A41B-76E197F3BA44}_is1 - c:\lba\LBAWIN\unins000.exe
AddRemove-Reman Rebellion - c:\program files (x86)\Activision\Star Trek Armada II\RR-Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\99D0.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{27B4851A-3207-45A2-B947-BE8AFE6163AB}"=hex:51,66,7a,6c,4c,1d,38,12,74,86,a7,
23,35,7c,cc,00,c6,51,fd,ca,fb,3f,27,bf
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{7DB2D5A0-7241-4E79-B68D-6309F01C5231}"=hex:51,66,7a,6c,4c,1d,38,12,ce,d6,a1,
79,73,3c,17,0b,c9,9b,20,49,f5,42,16,25
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce,
9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:ea,ae,ff,01,a6,61,cc,01
.
[HKEY_USERS\S-1-5-21-3451624900-134464093-325942916-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:5b,cd,52,80,c8,02,45,c9,85,91,1c,e2,b0,05,29,81,6d,cd,40,5b,41,0c,5b,
05,ef,db,b1,b7,b2,7f,a2,3c,5e,37,ae,29,37,b7,9c,fa,65,bd,b0,d3,52,6e,36,c6,\
"??"=hex:7f,16,8d,a1,6e,9f,32,39,52,2e,13,29,07,be,92,5b
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-09 16:43:10
ComboFix-quarantined-files.txt 2013-06-09 14:43
.
Vor Suchlauf: 21 Verzeichnis(se), 233.571.483.648 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 233.672.634.368 Bytes frei
.
- - End Of File - - 6E510F3A313C55379E565A670198F492
5C616939100B85E558DA92B899A0FC36
|
|
09.06.2013, 16:14
| #6 |
| /// the machine /// TB-Ausbilder | Google öffnet sich eigenständig Hi, Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
__________________ --> Google öffnet sich eigenständig |
|
09.06.2013, 16:52
| #7 |
| | Google öffnet sich eigenständig Soo, hier kommen die nächsten Logs  danke nochmals für die schnelle Antwort.MWB hat wie erwartet nichts gefunden: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.06.09.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 **** :: **** [Administrator] 09.06.2013 17:22:39 mbam-log-2013-06-09 (17-22-39).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P Deaktivierte Suchlaufeinstellungen: Durchsuchte Objekte: 297860 Laufzeit: 5 Minute(n), 30 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v2.303 - Datei am 09/06/2013 um 17:29:38 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : MASTER - ****
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\****\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
Gestoppt & Gelöscht : SearchAnonymizer
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v21.0 (de)
-\\ Google Chrome v [Version kann nicht ermittelt werden]
*************************
AdwCleaner[S1].txt - [1126 octets] - [09/06/2013 17:29:38]
########## EOF - \AdwCleaner[S1].txt - [1186 octets] ##########
Nebenbei bemerkt hat sich das Log nicht geöffnet, ich musste es selbst öffnen. Und noch JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by **** on 09.06.2013 at 17:36:57,25
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\sho25D2.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho3146.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho342.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho3B31.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho45FA.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho4614.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho4DA.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho4EE5.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho6E18.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8196.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8260.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8475.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8826.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8864.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoBFEC.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoC43B.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoD1BE.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoE0AD.tmp
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\**** (in GROSS).**** (in Klein)\AppData\Roaming\mozilla\firefox\profiles\e26fddc7.default\minidumps [3 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.06.2013 at 17:42:41,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
09.06.2013, 18:14
| #8 |
| /// the machine /// TB-Ausbilder | Google öffnet sich eigenständig Jede menge Adware und anderer Kram war drauf. Immer noch probleme? ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST LOg bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.06.2013, 21:40
| #9 |
| | Google öffnet sich eigenständig Adware, hm... Dabei bin ich beim Surfen eigentlich achtsam und benutze im FFox auch Adblock, NoScript und WoT. Wie dem auch sei, hier noch einmal die Logs: ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ebd3095ebb020143a365864381e7ab20
# engine=14033
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-09 08:29:08
# local_time=2013-06-09 10:29:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 1 35244503 35244503 0 0
# compatibility_mode=5893 16776574 100 94 35244243 122439598 0 0
# scanned=521494
# found=0
# cleaned=0
# scan_time=10950
Code:
ATTFilter Results of screen317's Security Check version 0.99.64 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 JavaFX 2.1.1 Java(TM) 6 Update 22 Java(TM) 6 Update 31 Java(TM) 7 Update 5 Java version out of Date! Adobe Flash Player 11.7.700.202 Mozilla Firefox (21.0) ````````Process Check: objlist.exe by Laurent```````` AVAST AvastSvc.exe AVAST AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` 09.06.2013 17:33:46 Erlaubt (based on user decision) value "UserInit" (new data: "C:\Windows\system32\userinit.exe,") geändert in Winlogon! 09.06.2013 17:33:53 Erlaubt (based on user decision) value "DisableRegistryTools" (new data: "0") hinzugefügt in Disable Registrytool! Wieso wurde DisableRegistryTools angelegt, wenn es dann eh auf 0 gesetzt wird? (Sorry, Laienfrage) Ob das Problem behoben ist, wird sich zeigen... auf jeden Fall bedanke ich mich jetzt schon für deine Hilfe. Achso, habe das letzte Log übersehen: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-06-2013
Ran by **** (ATTENTION: The logged in user is not administrator) on 09-06-2013 22:41:20
Running from C:\Users\****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(SANDBOXIE L.T.D) C:\Program Files\Sandboxie\SbieCtrl.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVAST Software) C:\Program Files (x86)\AVAST\AvastUI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2370856 2010-09-24]
(Synaptics Incorporated)
HKLM\...\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel
Wireless Tray [1933584 2010-12-17] (Intel(R) Corporation)
HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost
\RunTBGadgetOnce.vbs" [4526 2010-11-29] ()
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6548112 2012-06-12]
(Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX3 [1212560 2012-06-13]
(Realtek Semiconductor)
HKLM-x32\...\RunOnce: [aswAhAScr.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files
(x86)\AVAST\AhAScr.dll" [140544 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files
(x86)\AVAST\asOutExt.dll" [303248 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt64.dll] "C:\Program Files (x86)\AVAST\aswRegSvr64.exe" "C:\Program
Files (x86)\AVAST\asOutExt64.dll" [477336 2013-05-09] (AVAST Software)
HKCU\...\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480
2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe" [694032 2012-05-31]
(SANDBOXIE L.T.D)
HKLM-x32\...\RunOnce: [aswAhAScr.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files
(x86)\AVAST\AhAScr.dll" [140544 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt.dll] "C:\Program Files (x86)\AVAST\aswRegSvr.exe" "C:\Program Files
(x86)\AVAST\asOutExt.dll" [303248 2013-05-09] (AVAST Software)
HKLM-x32\...\RunOnce: [aswasOutExt64.dll] "C:\Program Files (x86)\AVAST\aswRegSvr64.exe" "C:\Program
Files (x86)\AVAST\asOutExt64.dll" [477336 2013-05-09] (AVAST Software)
MountPoints2: {4058c5db-332e-11e2-bacf-806e6f6e6963} - D:\SDISTART.EXE
HKLM-x32\...\Run: [avast] "C:\Program Files (x86)\AVAST\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST
Software)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [250504 2013-02-10] (NVIDIA Corporation)
Startup: C:\ProgramData\Start Menu\Programs\Startup\LOLRecorder.lnk
ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay)
==================== Internet (Whitelisted) ====================
ProxyServer: 0.0.0.0:80
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {1227474B-5800-4971-AEBC-0C62C1B03868} URL =
hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-
4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {1C40F450-D6BA-4A28-8D09-23BB5479134F} URL =
hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}
&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {21546096-0B89-4439-89D5-D7E0D803C0F0} URL =
hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-
910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {59319B5B-7707-4E26-AC60-C7970B0F6ED6} URL = hxxp://www.otto.de.anonymize-
me.de/?to=6F74746F2E6465&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-
7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {75F443E1-F114-4309-ACC5-E8B1DCCF6A46} URL =
hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}
&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
SearchScopes: HKCU - {9DDEF137-963F-47C9-8094-944CC48F1DF4} URL =
hxxp://www.google.de.anonymize-me.de/?
anonymto=687474703A2F2F7777772E676F6F676C652E64652F7365617263683F713D7B73656172636854
65726D737D&st={searchTerms}&clid=fb1d5b3d-7fb2-4fe2-910f-7268faeb7b57&pid=murb&k=0
SearchScopes: HKCU - {9DEF9C91-C0A2-4ABD-A575-09466B4BADEA} URL =
SearchScopes: HKCU - {FF56538F-F03E-446A-A066-42DEC935CFC9} URL =
hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=fb1d5b3d-
7fb2-4fe2-910f-7268faeb7b57&pid=murb&mode=bounce&k=0
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\AVAST
\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files
\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files
(x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:
\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java
\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:
\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files
(x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\AVAST
\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:
\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:
\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:
\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files
(x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files
(x86)\AVAST\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files
(x86)\AVAST\aswWebRepIE.dll (AVAST Software)
DPF: HKLM {682C59F5-478C-4421-9070-AD170D143B77}
hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd64.cab
DPF: HKLM-x32 {682C59F5-478C-4421-9070-AD170D143B77}
hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems,
Inc.)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll (
Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL
(Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash
\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director
\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle
Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin
\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight
\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
(Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:
\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo
Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo
Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo
Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
(NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision
\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media
Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update
\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update
\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\****\AppData\Roaming\Mozilla
\Firefox\Profiles\fvnjmdo9.default\Extensions\ich@maltegoetz.de
FF Extension: WOT - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions
\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: info - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions
\info@virustotal.com.xpi
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions
\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions
\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\fvnjmdo9.default\Extensions
\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2012-09-14]
(SUPERAntiSpyware.com)
R2 avast! Antivirus; C:\Program Files (x86)\AVAST\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] ()
R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader
\2.0\NitroPDFReaderDriverService2x64.exe [229392 2012-09-13] (Nitro PDF Software)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-01-20] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [98576 2012-05-31] (SANDBOXIE L.T.D)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26]
(Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
S3 ASPI; C:\Windows\SysWow64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1025808 2013-05-09] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378432 2013-05-09] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-05-09] ()
S3 MEMSWEEP2; C:\Windows\system32\99D0.tmp [6144 2009-06-18] (Sophos Plc)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-02-10] (NVIDIA Corporation)
S3 NvStUSB; C:\Windows\system32\DRIVERS\nvstusb.sys [121960 2011-01-31] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22]
(SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12]
(SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [166576 2012-05-31] (SANDBOXIE L.T.D)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-09 22:30 - 2013-06-09 22:30 - 00890839 ____A C:\Users\****\Desktop\SecurityCheck.exe
2013-06-09 21:11 - 2013-06-09 21:11 - 00003425 ____A C:\Users\****\.recently-used.xbel
2013-06-09 19:23 - 2013-06-09 19:23 - 00000000 ____D C:\Program Files (x86)\ESET
2013-06-09 19:21 - 2013-06-09 19:21 - 02347384 ____A (ESET) C:\Users\****\Desktop
\esetsmartinstaller_enu.exe
2013-06-09 17:42 - 2013-06-09 17:42 - 00001958 ____A C:\Users\MASTER.Master\Desktop\JRT.txt
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\JRT
2013-06-09 17:29 - 2013-06-09 17:29 - 00001253 ____A C:\AdwCleaner[S1].txt
2013-06-09 17:26 - 2013-06-09 19:01 - 02263299 ____A C:\Users\****\Documents\Unbenannt.xcf
2013-06-09 17:22 - 2013-06-09 17:22 - 00648201 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-06-09 17:22 - 2013-06-09 17:22 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\****\Desktop\JRT.exe
2013-06-09 16:43 - 2013-06-09 16:43 - 00021867 ____A C:\ComboFix.txt
2013-06-09 16:27 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-09 16:27 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-09 16:27 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-09 16:26 - 2013-06-09 16:43 - 00000000 ____D C:\Qoobox
2013-06-09 16:26 - 2013-06-09 16:41 - 00000000 ____D C:\Windows\erdnt
2013-06-09 16:24 - 2013-06-09 16:25 - 05078680 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2013-06-09 15:32 - 2013-06-09 15:32 - 01842255 ____A C:\Users\****\Desktop\soraka2pic.xcf
2013-06-09 15:09 - 2013-06-09 15:09 - 00197937 ____A C:\Users\****\Documents\GNU Image Manipulation
Program.htm
2013-06-09 15:09 - 2013-06-09 15:09 - 00000000 ____D C:\Users\****\Documents\GNU Image Manipulation
Program-Dateien
2013-06-09 14:29 - 2013-06-09 14:29 - 00027422 ____A C:\Users\****\Desktop\Addition.txt
2013-06-09 14:28 - 2013-06-09 14:28 - 00000000 ____D C:\FRST
2013-06-09 14:27 - 2013-06-09 14:27 - 01919210 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-06-09 02:05 - 2013-06-09 02:05 - 00019870 ____A C:\Users\****\Desktop\Logs.zip
2013-06-09 01:33 - 2013-06-09 02:05 - 00150401 ____A C:\Users\****\Desktop\GMER.txt
2013-06-09 01:22 - 2013-06-09 01:22 - 00075596 ____A C:\Users\MASTER.Master\Desktop\OTL.Txt
2013-06-09 01:21 - 2013-06-09 02:05 - 00075596 ____A C:\Users\****\Desktop\OTL.Txt
2013-06-08 23:07 - 2013-06-08 23:07 - 00000154 ____A C:\Users\****\Desktop\liste.txt
2013-06-08 16:00 - 2013-06-08 16:00 - 23959201 ____A C:\Users\****\Desktop\Fotos.zip
2013-06-08 15:59 - 2013-06-08 16:11 - 00003766 ____A C:\Users\****\Desktop\artikel.txt
2013-06-08 15:48 - 2013-06-08 15:57 - 00000000 ____D C:\Users\****\Desktop\Fotos
2013-06-08 00:22 - 2013-06-08 15:45 - 00003968 ____A C:\Users\****\Desktop\bericht.txt
2013-06-04 18:27 - 2013-06-04 19:13 - 00029004 ____A C:\Users\****\Downloads\layla.aup
2013-06-04 18:27 - 2013-06-04 18:27 - 00000000 ____D C:\Users\****\Downloads\layla_data
2013-06-04 18:13 - 2013-06-04 18:13 - 00007249 ____A C:\Users\****\Downloads\crossroads (2).mp3.aup
2013-06-04 18:13 - 2013-06-04 18:13 - 00000000 ____D C:\Users\****\Downloads\crossroads (2).mp3_data
2013-06-03 18:38 - 2013-06-03 18:38 - 00012057 ____A C:\Users\****\Downloads\fear.aup
2013-06-03 18:38 - 2013-06-03 18:38 - 00000000 ____D C:\Users\****\Downloads\fear_data
2013-06-03 15:17 - 2013-06-03 15:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Users\MASTER.Master\AppData\Roaming\Cycling
'74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Program Files (x86)\AkaiPro
2013-06-01 16:39 - 2013-06-01 16:39 - 00001149 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-01 15:04 - 2013-06-01 15:25 - 00000000 ____D C:\Users\****\Documents\Photos
2013-05-31 00:19 - 2013-05-26 15:18 - 00001672 ____A C:\Users\****\Desktop\battle isle 3 units.txt
2013-05-30 20:10 - 2013-05-30 20:10 - 00018953 ____A C:\Users\****\Documents\gysi.odt
2013-05-27 16:50 - 2013-05-27 16:50 - 02959376 ____A (Microsoft Corporation) C:\Users\****\Downloads
\dotnetfx35setup.exe
2013-05-27 16:48 - 2013-05-27 16:48 - 01582608 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.1.exe
2013-05-25 17:45 - 2013-05-25 17:45 - 00004482 ____A C:\Users\****\Desktop\follow.gp5
2013-05-25 16:29 - 2013-05-26 15:18 - 00001672 ____A C:\Users\****\Documents\battle isle 3 units.txt
2013-05-24 21:19 - 2013-05-24 21:19 - 00005525 ____A C:\Users\****\Downloads\sail away.aup
2013-05-24 21:19 - 2013-05-24 21:19 - 00000000 ____D C:\Users\****\Downloads\sail away_data
2013-05-23 23:11 - 2013-05-23 23:11 - 00014551 ____A C:\Users\****\Desktop\delix.odt
2013-05-23 18:56 - 2013-05-24 21:43 - 00019893 ____A C:\Users\****\Downloads\sail away.gp5
2013-05-22 23:26 - 2013-05-22 23:26 - 00020012 ____A C:\Users\****\Documents\cc_20130522_232630.reg
2013-05-22 20:43 - 2013-05-22 22:18 - 00005029 ____A C:\Users\****\Downloads\angel.gp5
2013-05-22 19:50 - 2013-05-22 19:50 - 00004115 ____A C:\Users\****\Downloads\Ready for Action.gp5
2013-05-21 17:55 - 2013-05-21 17:55 - 01582626 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.exe
2013-05-20 14:26 - 2013-05-20 14:26 - 00000558 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung
(2).lnk
2013-05-20 01:06 - 2013-05-20 01:06 - 00000007 ____A C:\Users\****\Documents\BI3codes.txt
2013-05-20 00:37 - 2013-05-20 00:38 - 00001121 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung.lnk
2013-05-20 00:30 - 2013-06-04 00:28 - 00000503 ____A C:\Windows\SDI.ini
2013-05-20 00:22 - 1993-09-22 02:00 - 00092208 ___RA (Microsoft Corporation) C:\Windows
\SysWOW64\WING.DLL
2013-05-20 00:21 - 1993-09-22 02:00 - 00092208 ___RA (Microsoft Corporation) C:\Windows
\System32\WING.DLL
2013-05-19 23:54 - 2013-05-19 23:54 - 00001848 ____A C:\Users\****\Desktop\so in etwa.gp5
2013-05-19 22:48 - 2013-05-19 22:48 - 00042543 ____A C:\Users\****\Desktop\bi3.txt
2013-05-19 21:10 - 2013-05-19 21:10 - 00000041 ____A C:\Users\****\Desktop\bi2code.txt
2013-05-19 20:38 - 2013-05-19 20:40 - 99077904 ____A (Oracle Corporation) C:\Users\****\Downloads
\VirtualBox-4.2.12-84980-Win.exe
2013-05-19 15:49 - 2013-05-19 18:05 - 00000178 ____A C:\Users\****\Desktop\BI2.txt
2013-05-18 23:35 - 2013-05-18 23:40 - 00000000 ____D C:\Users\****\Downloads\BI32
2013-05-18 23:29 - 2013-05-18 23:33 - 00000000 ____D C:\Users\****\Downloads\BI3
2013-05-18 20:55 - 2013-05-18 20:55 - 00000245 ____A C:\Users\****\Downloads\regupdate.ini
2013-05-18 20:54 - 2013-05-18 20:54 - 13154452 ____A C:\Users\****\Downloads\SIV_1516a.exe
2013-05-17 22:59 - 2013-05-17 22:59 - 00102194 ____A C:\Users\****\Downloads\Ezreal _ League of
Legends.htm
2013-05-17 22:58 - 2013-05-17 22:59 - 00000000 ____D C:\Users\****\Downloads\Ezreal _ League of
Legends-Dateien
2013-05-17 13:38 - 2013-05-17 13:39 - 17993632 ____A (Adobe Systems Inc.) C:\Users\****\Downloads
\AdobeAIRInstaller.exe
2013-05-16 22:26 - 2013-05-16 22:27 - 16785637 ____A C:\Users\****\Downloads\Der Aufzug (Comedy-
Hörspiel).flv
2013-05-15 22:50 - 2013-05-05 23:36 - 17818624 ____A (Microsoft Corporation) C:\Windows
\System32\mshtml.dll
2013-05-15 22:50 - 2013-05-05 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows
\System32\mshtml.tlb
2013-05-15 22:50 - 2013-05-05 21:25 - 12324864 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\mshtml.dll
2013-05-15 22:50 - 2013-05-05 21:12 - 02382848 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\mshtml.tlb
2013-05-15 22:48 - 2013-04-05 03:19 - 10926080 ____A (Microsoft Corporation) C:\Windows
\System32\ieframe.dll
2013-05-15 22:48 - 2013-04-05 03:08 - 02312704 ____A (Microsoft Corporation) C:\Windows
\System32\jscript9.dll
2013-05-15 22:48 - 2013-04-05 03:01 - 01346560 ____A (Microsoft Corporation) C:\Windows
\System32\urlmon.dll
2013-05-15 22:48 - 2013-04-05 03:00 - 01392128 ____A (Microsoft Corporation) C:\Windows
\System32\wininet.dll
2013-05-15 22:48 - 2013-04-05 02:59 - 01494528 ____A (Microsoft Corporation) C:\Windows
\System32\inetcpl.cpl
2013-05-15 22:48 - 2013-04-05 02:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-15 22:48 - 2013-04-05 02:57 - 00085504 ____A (Microsoft Corporation) C:\Windows
\System32\jsproxy.dll
2013-05-15 22:48 - 2013-04-05 02:56 - 00173056 ____A (Microsoft Corporation) C:\Windows
\System32\ieUnatt.exe
2013-05-15 22:48 - 2013-04-05 02:55 - 00816640 ____A (Microsoft Corporation) C:\Windows
\System32\jscript.dll
2013-05-15 22:48 - 2013-04-05 02:55 - 00599040 ____A (Microsoft Corporation) C:\Windows
\System32\vbscript.dll
2013-05-15 22:48 - 2013-04-05 02:54 - 02147840 ____A (Microsoft Corporation) C:\Windows
\System32\iertutil.dll
2013-05-15 22:48 - 2013-04-05 02:54 - 00729088 ____A (Microsoft Corporation) C:\Windows
\System32\msfeeds.dll
2013-05-15 22:48 - 2013-04-05 02:51 - 00096768 ____A (Microsoft Corporation) C:\Windows
\System32\mshtmled.dll
2013-05-15 22:48 - 2013-04-05 02:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 22:48 - 2013-04-05 00:11 - 01800704 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\jscript9.dll
2013-05-15 22:48 - 2013-04-05 00:09 - 09738752 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\ieframe.dll
2013-05-15 22:48 - 2013-04-05 00:02 - 01427968 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\inetcpl.cpl
2013-05-15 22:48 - 2013-04-05 00:02 - 01129472 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\wininet.dll
2013-05-15 22:48 - 2013-04-05 00:02 - 01104384 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\urlmon.dll
2013-05-15 22:48 - 2013-04-05 00:01 - 00231936 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\url.dll
2013-05-15 22:48 - 2013-04-04 23:59 - 00065024 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\jsproxy.dll
2013-05-15 22:48 - 2013-04-04 23:58 - 00717824 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\jscript.dll
2013-05-15 22:48 - 2013-04-04 23:58 - 00142848 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\ieUnatt.exe
2013-05-15 22:48 - 2013-04-04 23:57 - 00420864 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\vbscript.dll
2013-05-15 22:48 - 2013-04-04 23:56 - 00607744 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\msfeeds.dll
2013-05-15 22:48 - 2013-04-04 23:55 - 01796096 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\iertutil.dll
2013-05-15 22:48 - 2013-04-04 23:54 - 00073216 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\mshtmled.dll
2013-05-15 22:48 - 2013-04-04 23:50 - 00176640 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\ieui.dll
2013-05-15 22:17 - 2013-05-15 22:17 - 00001296 ____A C:\Users\****\Desktop\blah.txt
2013-05-15 14:06 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows
\System32\Drivers\dxgkrnl.sys
2013-05-15 14:06 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows
\System32\Drivers\dxgmms1.sys
2013-05-15 14:06 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows
\System32\win32k.sys
2013-05-15 14:06 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows
\System32\wwansvc.dll
2013-05-15 14:06 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows
\System32\wwanprotdim.dll
2013-05-15 14:06 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows
\System32\consent.exe
2013-05-15 14:06 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows
\System32\shell32.dll
2013-05-15 14:06 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows
\System32\shdocvw.dll
2013-05-15 14:06 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows
\System32\authui.dll
2013-05-15 14:06 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows
\System32\appinfo.dll
2013-05-15 14:06 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\shell32.dll
2013-05-15 14:06 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\shdocvw.dll
2013-05-15 14:06 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows
\SysWOW64\authui.dll
2013-05-15 14:06 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-14 22:31 - 2013-05-19 20:14 - 00045342 ____A C:\Users\****\Desktop
\pantera_cowboys_from_hell.gp5
2013-05-12 22:28 - 2013-06-01 15:27 - 00000000 ___SD C:\Users\****\Google Drive
2013-05-12 22:28 - 2013-05-12 22:28 - 00001714 ____A C:\Users\****\Desktop\Google Drive.lnk
2013-05-12 22:28 - 2013-05-12 22:28 - 00000000 ____D C:\Users\****\AppData\LocalGoogle
2013-05-12 22:25 - 2013-05-12 22:25 - 00000000 ____D C:\Users\MASTER.Master\AppData\LocalGoogle
2013-05-12 22:24 - 2013-06-09 22:29 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-12 22:24 - 2013-05-12 22:29 - 00001106 ____A C:\Windows\Tasks
\GoogleUpdateTaskMachineCore.job
2013-05-12 22:24 - 2013-05-12 22:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-12 22:23 - 2013-05-12 22:23 - 00781760 ____A (Google Inc.) C:\Users\****\Downloads
\googledrivesync.exe
2013-05-12 18:58 - 2013-05-19 20:00 - 00000000 ____D C:\Users\****\AppData\Local\LogMeIn Hamachi
==================== One Month Modified Files and Folders =======
2013-06-09 22:30 - 2013-06-09 22:30 - 00890839 ____A C:\Users\****\Desktop\SecurityCheck.exe
2013-06-09 22:29 - 2013-05-12 22:24 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-09 21:11 - 2013-06-09 21:11 - 00003425 ____A C:\Users\****\.recently-used.xbel
2013-06-09 21:11 - 2011-04-17 01:22 - 00000000 ____D C:\Users\****\.gimp-2.6
2013-06-09 21:11 - 2011-03-16 17:58 - 00000000 ____D C:\users\****
2013-06-09 20:06 - 2012-04-20 03:50 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc
2013-06-09 19:33 - 2011-04-17 01:25 - 00000000 ____D C:\Users\****\AppData\Roaming\gtk-2.0
2013-06-09 19:23 - 2013-06-09 19:23 - 00000000 ____D C:\Program Files (x86)\ESET
2013-06-09 19:21 - 2013-06-09 19:21 - 02347384 ____A (ESET) C:\Users\****\Desktop
\esetsmartinstaller_enu.exe
2013-06-09 19:01 - 2013-06-09 17:26 - 02263299 ____A C:\Users\****\Documents\Unbenannt.xcf
2013-06-09 18:52 - 2011-03-17 19:37 - 00000000 ____D C:\Users\****\AppData\Roaming\ICQ
2013-06-09 18:11 - 2012-06-11 00:51 - 01480132 ____A C:\Windows\WindowsUpdate.log
2013-06-09 17:52 - 2009-07-14 06:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012
-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-09 17:52 - 2009-07-14 06:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012
-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-09 17:44 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-09 17:43 - 2012-06-19 03:54 - 00073348 ____A C:\Windows\setupact.log
2013-06-09 17:43 - 2011-03-13 03:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-09 17:42 - 2013-06-09 17:42 - 00001958 ____A C:\Users\MASTER.Master\Desktop\JRT.txt
2013-06-09 17:39 - 2009-07-14 19:58 - 00708018 ____A C:\Windows\System32\perfh007.dat
2013-06-09 17:39 - 2009-07-14 19:58 - 00153320 ____A C:\Windows\System32\perfc007.dat
2013-06-09 17:39 - 2009-07-14 07:13 - 01643900 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\JRT
2013-06-09 17:31 - 2012-06-30 02:03 - 00364140 ____A C:\Windows\PFRO.log
2013-06-09 17:29 - 2013-06-09 17:29 - 00001253 ____A C:\AdwCleaner[S1].txt
2013-06-09 17:22 - 2013-06-09 17:22 - 00648201 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-06-09 17:22 - 2013-06-09 17:22 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\****\Desktop\JRT.exe
2013-06-09 16:43 - 2013-06-09 16:43 - 00021867 ____A C:\ComboFix.txt
2013-06-09 16:43 - 2013-06-09 16:26 - 00000000 ____D C:\Qoobox
2013-06-09 16:43 - 2009-07-14 05:20 - 00000000 __RHD C:\users\Default
2013-06-09 16:41 - 2013-06-09 16:26 - 00000000 ____D C:\Windows\erdnt
2013-06-09 16:39 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-06-09 16:25 - 2013-06-09 16:24 - 05078680 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2013-06-09 15:32 - 2013-06-09 15:32 - 01842255 ____A C:\Users\****\Desktop\soraka2pic.xcf
2013-06-09 15:09 - 2013-06-09 15:09 - 00197937 ____A C:\Users\****\Documents\GNU Image Manipulation
Program.htm
2013-06-09 15:09 - 2013-06-09 15:09 - 00000000 ____D C:\Users\****\Documents\GNU Image Manipulation
Program-Dateien
2013-06-09 14:29 - 2013-06-09 14:29 - 00027422 ____A C:\Users\****\Desktop\Addition.txt
2013-06-09 14:28 - 2013-06-09 14:28 - 00000000 ____D C:\FRST
2013-06-09 14:27 - 2013-06-09 14:27 - 01919210 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-06-09 02:05 - 2013-06-09 02:05 - 00019870 ____A C:\Users\****\Desktop\Logs.zip
2013-06-09 02:05 - 2013-06-09 01:33 - 00150401 ____A C:\Users\****\Desktop\GMER.txt
2013-06-09 02:05 - 2013-06-09 01:21 - 00075596 ____A C:\Users\****\Desktop\OTL.Txt
2013-06-09 01:22 - 2013-06-09 01:22 - 00075596 ____A C:\Users\MASTER.Master\Desktop\OTL.Txt
2013-06-08 23:07 - 2013-06-08 23:07 - 00000154 ____A C:\Users\****\Desktop\liste.txt
2013-06-08 20:05 - 2011-03-28 19:06 - 00000000 ____D C:\Users\****\AppData\Roaming\Audacity
2013-06-08 16:11 - 2013-06-08 15:59 - 00003766 ____A C:\Users\****\Desktop\artikel.txt
2013-06-08 16:00 - 2013-06-08 16:00 - 23959201 ____A C:\Users\****\Desktop\Fotos.zip
2013-06-08 15:57 - 2013-06-08 15:48 - 00000000 ____D C:\Users\****\Desktop\Fotos
2013-06-08 15:45 - 2013-06-08 00:22 - 00003968 ____A C:\Users\****\Desktop\bericht.txt
2013-06-08 04:24 - 2012-09-15 02:32 - 00000000 ____D C:\Users\****\AppData\Roaming\TS3Client
2013-06-06 22:48 - 2012-05-31 22:48 - 00000000 ____D C:\Users\****\Desktop\nice
2013-06-06 01:26 - 2012-03-21 02:57 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-06-06 01:20 - 2013-02-11 23:29 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-05 21:53 - 2011-08-25 00:35 - 00022166 ____A C:\Users\****\Downloads\hold the line (2).aup
2013-06-04 19:13 - 2013-06-04 18:27 - 00029004 ____A C:\Users\****\Downloads\layla.aup
2013-06-04 18:27 - 2013-06-04 18:27 - 00000000 ____D C:\Users\****\Downloads\layla_data
2013-06-04 18:13 - 2013-06-04 18:13 - 00007249 ____A C:\Users\****\Downloads\crossroads (2).mp3.aup
2013-06-04 18:13 - 2013-06-04 18:13 - 00000000 ____D C:\Users\****\Downloads\crossroads (2).mp3_data
2013-06-04 00:28 - 2013-05-20 00:30 - 00000503 ____A C:\Windows\SDI.ini
2013-06-04 00:24 - 2011-03-16 18:12 - 00000000 ____D C:\Users\****\AppData\Roaming\.minecraft
2013-06-03 23:30 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-03 18:38 - 2013-06-03 18:38 - 00012057 ____A C:\Users\****\Downloads\fear.aup
2013-06-03 18:38 - 2013-06-03 18:38 - 00000000 ____D C:\Users\****\Downloads\fear_data
2013-06-03 15:17 - 2013-06-03 15:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Users\MASTER.Master\AppData\Roaming\Cycling
'74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Program Files (x86)\AkaiPro
2013-06-01 19:43 - 2012-04-25 14:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-01 16:39 - 2013-06-01 16:39 - 00001149 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-01 16:39 - 2011-04-01 05:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-01 15:27 - 2013-05-12 22:28 - 00000000 ___SD C:\Users\****\Google Drive
2013-06-01 15:25 - 2013-06-01 15:04 - 00000000 ____D C:\Users\****\Documents\Photos
2013-05-30 20:10 - 2013-05-30 20:10 - 00018953 ____A C:\Users\****\Documents\gysi.odt
2013-05-27 16:50 - 2013-05-27 16:50 - 02959376 ____A (Microsoft Corporation) C:\Users\****\Downloads
\dotnetfx35setup.exe
2013-05-27 16:48 - 2013-05-27 16:48 - 01582608 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.1.exe
2013-05-27 16:48 - 2013-02-13 21:11 - 00001903 ____A C:\Users\Public\Desktop\LOL Recorder.lnk
2013-05-27 16:48 - 2012-12-05 12:29 - 00000000 ____D C:\Program Files (x86)\LOLReplay
2013-05-26 15:18 - 2013-05-31 00:19 - 00001672 ____A C:\Users\****\Desktop\battle isle 3 units.txt
2013-05-26 15:18 - 2013-05-25 16:29 - 00001672 ____A C:\Users\****\Documents\battle isle 3 units.txt
2013-05-26 15:10 - 2013-03-31 16:01 - 00000000 ____D C:\dosprogs
2013-05-26 15:07 - 2012-06-12 21:42 - 00001886 ____A C:\Windows\Sandboxie.ini
2013-05-25 17:45 - 2013-05-25 17:45 - 00004482 ____A C:\Users\****\Desktop\follow.gp5
2013-05-24 21:43 - 2013-05-23 18:56 - 00019893 ____A C:\Users\****\Downloads\sail away.gp5
2013-05-24 21:42 - 2013-03-08 05:18 - 00062201 ____A C:\Users\****\Desktop
\misc_unsigned_bands_league_of_legends_-_here_comes_vi.gp5
2013-05-24 21:28 - 2013-05-24 21:28 - 00016246 ____A C:\Users\****\Documents\Lykke Li - I follow rivers
(Lyrics).aup
2013-05-24 21:28 - 2013-05-24 21:28 - 00016227 ____A C:\Users\****\Documents\I follow rivers2.aup
2013-05-24 21:28 - 2013-05-24 21:28 - 00000000 ____D C:\Users\****\Documents\Lykke Li - I follow rivers
(Lyrics)_data
2013-05-24 21:28 - 2013-05-24 21:28 - 00000000 ____D C:\Users\****\Documents\I follow rivers2_data
2013-05-24 21:19 - 2013-05-24 21:19 - 00005525 ____A C:\Users\****\Downloads\sail away.aup
2013-05-24 21:19 - 2013-05-24 21:19 - 00000000 ____D C:\Users\****\Downloads\sail away_data
2013-05-23 23:11 - 2013-05-23 23:11 - 00014551 ____A C:\Users\****\Desktop\delix.odt
2013-05-23 19:24 - 2012-04-10 18:17 - 00000000 ____D C:\users\MASTER.Master
2013-05-22 23:26 - 2013-05-22 23:26 - 00020012 ____A C:\Users\****\Documents\cc_20130522_232630.reg
2013-05-22 22:18 - 2013-05-22 20:43 - 00005029 ____A C:\Users\****\Downloads\angel.gp5
2013-05-22 19:50 - 2013-05-22 19:50 - 00004115 ____A C:\Users\****\Downloads\Ready for Action.gp5
2013-05-21 18:06 - 2012-04-28 00:23 - 00000000 ____D C:\Program Files (x86)\AVAST
2013-05-21 18:00 - 2012-04-28 00:03 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2013-05-21 17:56 - 2012-04-13 17:12 - 00117336 ____A C:\Users\MASTER.Master\AppData\Local
\GDIPFONTCACHEV1.DAT
2013-05-21 17:55 - 2013-05-21 17:55 - 01582626 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.exe
2013-05-20 14:26 - 2013-05-20 14:26 - 00000558 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung
(2).lnk
2013-05-20 01:06 - 2013-05-20 01:06 - 00000007 ____A C:\Users\****\Documents\BI3codes.txt
2013-05-20 00:38 - 2013-05-20 00:37 - 00001121 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung.lnk
2013-05-20 00:18 - 2011-05-10 16:01 - 00000000 ____D C:\BlueByte
2013-05-19 23:54 - 2013-05-19 23:54 - 00001848 ____A C:\Users\****\Desktop\so in etwa.gp5
2013-05-19 22:48 - 2013-05-19 22:48 - 00042543 ____A C:\Users\****\Desktop\bi3.txt
2013-05-19 21:10 - 2013-05-19 21:10 - 00000041 ____A C:\Users\****\Desktop\bi2code.txt
2013-05-19 20:40 - 2013-05-19 20:38 - 99077904 ____A (Oracle Corporation) C:\Users\****\Downloads
\VirtualBox-4.2.12-84980-Win.exe
2013-05-19 20:14 - 2013-05-14 22:31 - 00045342 ____A C:\Users\****\Desktop
\pantera_cowboys_from_hell.gp5
2013-05-19 20:00 - 2013-05-12 18:58 - 00000000 ____D C:\Users\****\AppData\Local\LogMeIn Hamachi
2013-05-19 18:05 - 2013-05-19 15:49 - 00000178 ____A C:\Users\****\Desktop\BI2.txt
2013-05-19 01:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-05-19 01:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-05-18 23:40 - 2013-05-18 23:35 - 00000000 ____D C:\Users\****\Downloads\BI32
2013-05-18 23:33 - 2013-05-18 23:29 - 00000000 ____D C:\Users\****\Downloads\BI3
2013-05-18 20:55 - 2013-05-18 20:55 - 00000245 ____A C:\Users\****\Downloads\regupdate.ini
2013-05-18 20:54 - 2013-05-18 20:54 - 13154452 ____A C:\Users\****\Downloads\SIV_1516a.exe
2013-05-18 16:24 - 2011-05-06 01:15 - 00000000 ____D C:\Users\****\AppData\Local\S2
2013-05-17 22:59 - 2013-05-17 22:59 - 00102194 ____A C:\Users\****\Downloads\Ezreal _ League of
Legends.htm
2013-05-17 22:59 - 2013-05-17 22:58 - 00000000 ____D C:\Users\****\Downloads\Ezreal _ League of
Legends-Dateien
2013-05-17 22:51 - 2012-06-17 23:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows
\SysWOW64\FlashPlayerApp.exe
2013-05-17 22:51 - 2012-06-17 23:29 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows
\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-17 22:51 - 2011-03-13 09:53 - 00000000 ____D C:\ProgramData\Adobe
2013-05-17 13:39 - 2013-05-17 13:38 - 17993632 ____A (Adobe Systems Inc.) C:\Users\****\Downloads
\AdobeAIRInstaller.exe
2013-05-17 13:24 - 2013-04-12 19:21 - 00000000 ____D C:\Users\****\Downloads
\Enigma_Item_Changer_3.2.2
2013-05-16 22:27 - 2013-05-16 22:26 - 16785637 ____A C:\Users\****\Downloads\Der Aufzug (Comedy-
Hörspiel).flv
2013-05-16 11:10 - 2009-07-14 06:45 - 00447640 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 23:00 - 2011-04-06 15:41 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-05-15 22:57 - 2011-03-21 19:13 - 75016696 ____A (Microsoft Corporation) C:\Windows
\System32\MRT.exe
2013-05-15 22:17 - 2013-05-15 22:17 - 00001296 ____A C:\Users\****\Desktop\blah.txt
2013-05-12 22:29 - 2013-05-12 22:24 - 00001106 ____A C:\Windows\Tasks
\GoogleUpdateTaskMachineCore.job
2013-05-12 22:28 - 2013-05-12 22:28 - 00001714 ____A C:\Users\****\Desktop\Google Drive.lnk
2013-05-12 22:28 - 2013-05-12 22:28 - 00000000 ____D C:\Users\****\AppData\LocalGoogle
2013-05-12 22:25 - 2013-05-12 22:25 - 00000000 ____D C:\Users\MASTER.Master\AppData\LocalGoogle
2013-05-12 22:25 - 2013-01-21 14:52 - 00000000 ____D C:\Users\MASTER.Master\AppData\Local\Google
2013-05-12 22:25 - 2011-05-06 15:40 - 00000000 ____D C:\Users\****\AppData\Local\Google
2013-05-12 22:24 - 2013-05-12 22:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-12 22:23 - 2013-05-12 22:23 - 00781760 ____A (Google Inc.) C:\Users\****\Downloads
\googledrivesync.exe
2013-05-12 18:55 - 2013-02-09 03:19 - 03857920 ____A C:\Users\****\Downloads\hamachi210166.msi
2013-05-12 01:44 - 2013-01-15 17:05 - 00137062 ____A C:\Users\****\Desktop\A Moment Filled With
Emptynessexp.mid
Files to move or delete:
====================
C:\Users\MASTER\Launch Fix*it.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
Geändert von Cellix (09.06.2013 um 21:46 Uhr) |
|
10.06.2013, 07:09
| #10 | |
| /// the machine /// TB-Ausbilder | Google öffnet sich eigenständigZitat:
Teste mal nen Tag und melde dich wieder
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.06.2013, 08:21
| #11 |
| | Google öffnet sich eigenständig Heyho, Ich bin ehrlich gesagt nicht 100% sicher, ob das Problem behoben ist. Gestern ist ein Fenster der Deutschen Bahn, während ich eine Eingabe machte, auf google zurückgesprungen. Allerdings kann ich nicht ausschließen, dass da ein Bedienungsfehler oder Firefoxfehler im Spiel war. Ich hatte auch das Gefühl, dass mein Internet gestern etwas langsamer war... das kann aber an allem möglichen gelegen haben. Was meinst du... wäre vllt generell mal eine Neuinstallation ratsam? Ich habe das schon öfter erwogen, hab mich aber bisher nie getraut. Sorry, dass ich solche Umstände mache. |
|
11.06.2013, 13:30
| #12 |
| /// the machine /// TB-Ausbilder | Google öffnet sich eigenständig Neuinstallation find ich in so Fällen unnötig, aber ist deine ENtscheidung. Poste mal bitte ein frisches FRST Log, aber bitte aus einem Konto mit Adminrechten
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.06.2013, 15:51
| #13 |
| | Google öffnet sich eigenständig Gerne: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-06-2013
Ran by ****(administrator) on 11-06-2013 16:40:27
Running from C:\Users\****.****\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(SANDBOXIE L.T.D) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files (x86)\AVAST\AvastSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(LOL Replay) C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVAST Software) C:\Program Files (x86)\AVAST\AvastUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2370856 2010-09-24] (Synaptics Incorporated)
HKLM\...\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1933584 2010-12-17] (Intel(R) Corporation)
HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-11-29] ()
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX3 [1212560 2012-06-13] (Realtek Semiconductor)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [avast] "C:\Program Files (x86)\AVAST\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKU\****\...\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\****\...\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe" [694032 2012-05-31] (SANDBOXIE L.T.D)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [250504 2013-02-10] (NVIDIA Corporation)
Startup: C:\ProgramData\Start Menu\Programs\Startup\LOLRecorder.lnk
ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\AVAST\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\AVAST\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files (x86)\AVAST\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\AVAST\aswWebRepIE.dll (AVAST Software)
DPF: HKLM {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd64.cab
DPF: HKLM-x32 {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\MASTER.Master\AppData\Roaming\Mozilla\Firefox\Profiles\e26fddc7.default
FF Homepage: hxxp://www.google.de/webhp?hl=de&tab=ww
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Extension: WOT - C:\Users\MASTER.Master\AppData\Roaming\Mozilla\Firefox\Profiles\e26fddc7.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\MASTER.Master\AppData\Roaming\Mozilla\Firefox\Profiles\e26fddc7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\MASTER.Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\MASTER.Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\MASTER.Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\MASTER.Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (avast! WebRep) - C:\Users\MASTER.Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0
CHR Extension: (Gmail) - C:\Users\MASTER.Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2012-09-14] (SUPERAntiSpyware.com)
R2 avast! Antivirus; C:\Program Files (x86)\AVAST\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] ()
R2 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [229392 2012-09-13] (Nitro PDF Software)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-01-20] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [98576 2012-05-31] (SANDBOXIE L.T.D)
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
S3 ASPI; C:\Windows\SysWow64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1025808 2013-05-09] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378432 2013-05-09] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-05-09] ()
S3 MEMSWEEP2; C:\Windows\system32\99D0.tmp [6144 2009-06-18] (Sophos Plc)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-02-10] (NVIDIA Corporation)
S3 NvStUSB; C:\Windows\system32\DRIVERS\nvstusb.sys [121960 2011-01-31] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [166576 2012-05-31] (SANDBOXIE L.T.D)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-11 16:39 - 2013-06-11 16:39 - 00039374 ____A C:\Users\****\Desktop\FRST2.txt
2013-06-11 16:38 - 2013-06-09 14:27 - 01919210 ____A (Farbar) C:\Users\MASTER.Master\Desktop\FRST64.exe
2013-06-11 16:37 - 2013-06-11 16:37 - 00008636 ____A C:\Users\****\Downloads\foxtrot.aup
2013-06-11 16:37 - 2013-06-11 16:37 - 00000000 ____D C:\Users\****\Downloads\foxtrot_data
2013-06-10 01:18 - 2013-06-10 01:18 - 00004039 ____A C:\Users\****\.recently-used.xbel
2013-06-10 00:14 - 2013-06-10 00:14 - 02264007 ____A C:\Users\****\Documents\Fizz.xcf
2013-06-09 23:20 - 2013-06-09 23:38 - 00000000 ____D C:\Users\****\Desktop\bullshit
2013-06-09 22:30 - 2013-06-09 22:30 - 00890839 ____A C:\Users\****\Desktop\SecurityCheck.exe
2013-06-09 19:21 - 2013-06-09 19:21 - 02347384 ____A (ESET) C:\Users\****\Desktop\esetsmartinstaller_enu.exe
2013-06-09 17:42 - 2013-06-09 17:42 - 00001958 ____A C:\Users\****.****\Desktop\JRT.txt
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\JRT
2013-06-09 17:29 - 2013-06-09 17:29 - 00001253 ____A C:\AdwCleaner[S1].txt
2013-06-09 17:26 - 2013-06-09 19:01 - 02263299 ____A C:\Users\****\Documents\Unbenannt.xcf
2013-06-09 17:22 - 2013-06-09 17:22 - 00648201 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-06-09 17:22 - 2013-06-09 17:22 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\****\Desktop\JRT.exe
2013-06-09 16:43 - 2013-06-09 16:43 - 00021867 ____A C:\ComboFix.txt
2013-06-09 16:27 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-09 16:27 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-09 16:27 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-09 16:27 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-09 16:26 - 2013-06-09 16:43 - 00000000 ____D C:\Qoobox
2013-06-09 16:26 - 2013-06-09 16:41 - 00000000 ____D C:\Windows\erdnt
2013-06-09 16:24 - 2013-06-09 16:25 - 05078680 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2013-06-09 15:32 - 2013-06-09 15:32 - 01842255 ____A C:\Users\****\Desktop\soraka2pic.xcf
2013-06-09 15:09 - 2013-06-09 15:09 - 00197937 ____A C:\Users\****\Documents\GNU Image Manipulation Program.htm
2013-06-09 15:09 - 2013-06-09 15:09 - 00000000 ____D C:\Users\****\Documents\GNU Image Manipulation Program-Dateien
2013-06-09 14:28 - 2013-06-09 14:28 - 00000000 ____D C:\FRST
2013-06-09 14:27 - 2013-06-09 14:27 - 01919210 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-06-09 01:22 - 2013-06-09 01:22 - 00075596 ____A C:\Users\MASTER.Master\Desktop\OTL.Txt
2013-06-04 18:27 - 2013-06-04 19:13 - 00029004 ____A C:\Users\****\Downloads\layla.aup
2013-06-04 18:27 - 2013-06-04 18:27 - 00000000 ____D C:\Users\****\Downloads\layla_data
2013-06-03 18:38 - 2013-06-03 18:38 - 00012057 ____A C:\Users\****\Downloads\fear.aup
2013-06-03 18:38 - 2013-06-03 18:38 - 00000000 ____D C:\Users\****\Downloads\fear_data
2013-06-03 15:17 - 2013-06-03 15:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Users\****.****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Program Files (x86)\AkaiPro
2013-06-01 15:04 - 2013-06-01 15:25 - 00000000 ____D C:\Users\****\Documents\Photos
2013-05-30 20:10 - 2013-05-30 20:10 - 00018953 ____A C:\Users\****\Documents\gysi.odt
2013-05-27 16:50 - 2013-05-27 16:50 - 02959376 ____A (Microsoft Corporation) C:\Users\****\Downloads\dotnetfx35setup.exe
2013-05-27 16:48 - 2013-05-27 16:48 - 01582608 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.1.exe
2013-05-25 16:29 - 2013-05-26 15:18 - 00001672 ____A C:\Users\****\Documents\battle isle 3 units.txt
2013-05-24 21:19 - 2013-05-24 21:19 - 00005525 ____A C:\Users\****\Downloads\sail away.aup
2013-05-24 21:19 - 2013-05-24 21:19 - 00000000 ____D C:\Users\****\Downloads\sail away_data
2013-05-23 18:56 - 2013-05-24 21:43 - 00019893 ____A C:\Users\****\Downloads\sail away.gp5
2013-05-22 23:26 - 2013-05-22 23:26 - 00020012 ____A C:\Users\****\Documents\cc_20130522_232630.reg
2013-05-22 20:43 - 2013-05-22 22:18 - 00005029 ____A C:\Users\****\Downloads\angel.gp5
2013-05-22 19:50 - 2013-05-22 19:50 - 00004115 ____A C:\Users\****\Downloads\Ready for Action.gp5
2013-05-21 17:55 - 2013-05-21 17:55 - 01582626 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.exe
2013-05-20 14:26 - 2013-05-20 14:26 - 00000558 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung (2).lnk
2013-05-20 01:06 - 2013-05-20 01:06 - 00000007 ____A C:\Users\****\Documents\BI3codes.txt
2013-05-20 00:37 - 2013-05-20 00:38 - 00001121 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung.lnk
2013-05-20 00:30 - 2013-06-04 00:28 - 00000503 ____A C:\Windows\SDI.ini
2013-05-20 00:22 - 1993-09-22 02:00 - 00092208 ___RA (Microsoft Corporation) C:\Windows\SysWOW64\WING.DLL
2013-05-20 00:21 - 1993-09-22 02:00 - 00092208 ___RA (Microsoft Corporation) C:\Windows\System32\WING.DLL
2013-05-19 20:38 - 2013-05-19 20:40 - 99077904 ____A (Oracle Corporation) C:\Users\****\Downloads\VirtualBox-4.2.12-84980-Win.exe
2013-05-18 23:35 - 2013-05-18 23:40 - 00000000 ____D C:\Users\****\Downloads\BI32
2013-05-18 23:29 - 2013-05-18 23:33 - 00000000 ____D C:\Users\****\Downloads\BI3
2013-05-18 20:55 - 2013-05-18 20:55 - 00000245 ____A C:\Users\****\Downloads\regupdate.ini
2013-05-18 20:54 - 2013-05-18 20:54 - 13154452 ____A C:\Users\****\Downloads\SIV_1516a.exe
2013-05-17 22:59 - 2013-05-17 22:59 - 00102194 ____A C:\Users\****\Downloads\Ezreal _ League of Legends.htm
2013-05-17 22:58 - 2013-05-17 22:59 - 00000000 ____D C:\Users\****\Downloads\Ezreal _ League of Legends-Dateien
2013-05-17 13:38 - 2013-05-17 13:39 - 17993632 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\AdobeAIRInstaller.exe
2013-05-16 22:26 - 2013-05-16 22:27 - 16785637 ____A C:\Users\****\Downloads\Der Aufzug (Comedy-Hörspiel).flv
2013-05-15 22:50 - 2013-05-05 23:36 - 17818624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-15 22:50 - 2013-05-05 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-15 22:50 - 2013-05-05 21:25 - 12324864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-15 22:50 - 2013-05-05 21:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-15 22:48 - 2013-04-05 03:19 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-15 22:48 - 2013-04-05 03:08 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-15 22:48 - 2013-04-05 03:01 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-15 22:48 - 2013-04-05 03:00 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-15 22:48 - 2013-04-05 02:59 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-15 22:48 - 2013-04-05 02:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-15 22:48 - 2013-04-05 02:57 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-15 22:48 - 2013-04-05 02:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-15 22:48 - 2013-04-05 02:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-15 22:48 - 2013-04-05 02:55 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-15 22:48 - 2013-04-05 02:54 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-15 22:48 - 2013-04-05 02:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-15 22:48 - 2013-04-05 02:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-15 22:48 - 2013-04-05 02:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 22:48 - 2013-04-05 00:11 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-15 22:48 - 2013-04-05 00:09 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-15 22:48 - 2013-04-05 00:02 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-15 22:48 - 2013-04-05 00:02 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-15 22:48 - 2013-04-05 00:02 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-15 22:48 - 2013-04-05 00:01 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-15 22:48 - 2013-04-04 23:59 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-15 22:48 - 2013-04-04 23:58 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-15 22:48 - 2013-04-04 23:58 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-15 22:48 - 2013-04-04 23:57 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-15 22:48 - 2013-04-04 23:56 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-15 22:48 - 2013-04-04 23:55 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-15 22:48 - 2013-04-04 23:54 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-15 22:48 - 2013-04-04 23:50 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-15 14:06 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 14:06 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 14:06 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 14:06 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-15 14:06 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-15 14:06 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 14:06 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 14:06 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 14:06 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 14:06 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-05-15 14:06 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-05-15 14:06 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-05-15 14:06 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-05-15 14:06 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-05-12 22:28 - 2013-06-01 15:27 - 00000000 ___SD C:\Users\****\Google Drive
2013-05-12 22:28 - 2013-05-12 22:28 - 00001714 ____A C:\Users\****\Desktop\Google Drive.lnk
2013-05-12 22:28 - 2013-05-12 22:28 - 00000000 ____D C:\Users\****\AppData\LocalGoogle
2013-05-12 22:25 - 2013-05-12 22:25 - 00000000 ____D C:\Users\****.****\AppData\LocalGoogle
2013-05-12 22:24 - 2013-06-11 16:29 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-12 22:24 - 2013-05-12 22:29 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-12 22:24 - 2013-05-12 22:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-12 22:23 - 2013-05-12 22:23 - 00781760 ____A (Google Inc.) C:\Users\****\Downloads\googledrivesync.exe
2013-05-12 18:58 - 2013-05-19 20:00 - 00000000 ____D C:\Users\****\AppData\Local\LogMeIn Hamachi
==================== One Month Modified Files and Folders =======
2013-06-11 16:39 - 2013-06-11 16:39 - 00039374 ____A C:\Users\****\Desktop\FRST2.txt
2013-06-11 16:38 - 2012-06-11 00:51 - 01527990 ____A C:\Windows\WindowsUpdate.log
2013-06-11 16:37 - 2013-06-11 16:37 - 00008636 ____A C:\Users\****\Downloads\foxtrot.aup
2013-06-11 16:37 - 2013-06-11 16:37 - 00000000 ____D C:\Users\****\Downloads\foxtrot_data
2013-06-11 16:37 - 2011-03-28 19:06 - 00000000 ____D C:\Users\****\AppData\Roaming\Audacity
2013-06-11 16:35 - 2012-06-19 03:54 - 00073852 ____A C:\Windows\setupact.log
2013-06-11 16:29 - 2013-05-12 22:24 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-11 16:18 - 2009-07-14 06:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-11 16:18 - 2009-07-14 06:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-11 16:10 - 2011-03-13 03:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-11 16:10 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-10 01:18 - 2013-06-10 01:18 - 00004039 ____A C:\Users\****\.recently-used.xbel
2013-06-10 01:18 - 2011-04-17 01:22 - 00000000 ____D C:\Users\****\.gimp-2.6
2013-06-10 01:18 - 2011-03-16 17:58 - 00000000 ____D C:\users\****
2013-06-10 00:51 - 2013-02-11 23:29 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-10 00:50 - 2012-04-20 03:50 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc
2013-06-10 00:14 - 2013-06-10 00:14 - 02264007 ____A C:\Users\****\Documents\Fizz.xcf
2013-06-10 00:14 - 2011-04-17 01:25 - 00000000 ____D C:\Users\****\AppData\Roaming\gtk-2.0
2013-06-09 23:38 - 2013-06-09 23:20 - 00000000 ____D C:\Users\****\Desktop\bullshit
2013-06-09 23:24 - 2012-06-30 02:03 - 00364966 ____A C:\Windows\PFRO.log
2013-06-09 23:22 - 2013-03-22 00:04 - 00000000 ____D C:\Users\****\Desktop\GP5
2013-06-09 22:30 - 2013-06-09 22:30 - 00890839 ____A C:\Users\****\Desktop\SecurityCheck.exe
2013-06-09 19:21 - 2013-06-09 19:21 - 02347384 ____A (ESET) C:\Users\****\Desktop\esetsmartinstaller_enu.exe
2013-06-09 19:01 - 2013-06-09 17:26 - 02263299 ____A C:\Users\****\Documents\Unbenannt.xcf
2013-06-09 18:52 - 2011-03-17 19:37 - 00000000 ____D C:\Users\****\AppData\Roaming\ICQ
2013-06-09 17:42 - 2013-06-09 17:42 - 00001958 ____A C:\Users\****.****\Desktop\JRT.txt
2013-06-09 17:39 - 2009-07-14 19:58 - 00708018 ____A C:\Windows\System32\perfh007.dat
2013-06-09 17:39 - 2009-07-14 19:58 - 00153320 ____A C:\Windows\System32\perfc007.dat
2013-06-09 17:39 - 2009-07-14 07:13 - 01643900 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\Windows\ERUNT
2013-06-09 17:36 - 2013-06-09 17:36 - 00000000 ____D C:\JRT
2013-06-09 17:29 - 2013-06-09 17:29 - 00001253 ____A C:\AdwCleaner[S1].txt
2013-06-09 17:22 - 2013-06-09 17:22 - 00648201 ____A C:\Users\****\Desktop\adwcleaner.exe
2013-06-09 17:22 - 2013-06-09 17:22 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\****\Desktop\JRT.exe
2013-06-09 16:43 - 2013-06-09 16:43 - 00021867 ____A C:\ComboFix.txt
2013-06-09 16:43 - 2013-06-09 16:26 - 00000000 ____D C:\Qoobox
2013-06-09 16:43 - 2009-07-14 05:20 - 00000000 __RHD C:\users\Default
2013-06-09 16:41 - 2013-06-09 16:26 - 00000000 ____D C:\Windows\erdnt
2013-06-09 16:39 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-06-09 16:25 - 2013-06-09 16:24 - 05078680 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2013-06-09 15:32 - 2013-06-09 15:32 - 01842255 ____A C:\Users\****\Desktop\soraka2pic.xcf
2013-06-09 15:09 - 2013-06-09 15:09 - 00197937 ____A C:\Users\****\Documents\GNU Image Manipulation Program.htm
2013-06-09 15:09 - 2013-06-09 15:09 - 00000000 ____D C:\Users\****\Documents\GNU Image Manipulation Program-Dateien
2013-06-09 14:28 - 2013-06-09 14:28 - 00000000 ____D C:\FRST
2013-06-09 14:27 - 2013-06-11 16:38 - 01919210 ____A (Farbar) C:\Users\****.****\Desktop\FRST64.exe
2013-06-09 14:27 - 2013-06-09 14:27 - 01919210 ____A (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-06-09 01:22 - 2013-06-09 01:22 - 00075596 ____A C:\Users\****.****\Desktop\OTL.Txt
2013-06-08 04:24 - 2012-09-15 02:32 - 00000000 ____D C:\Users\****\AppData\Roaming\TS3Client
2013-06-06 22:48 - 2012-05-31 22:48 - 00000000 ____D C:\Users\****\Desktop\nice
2013-06-06 01:26 - 2012-03-21 02:57 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-06-05 21:53 - 2011-08-25 00:35 - 00022166 ____A C:\Users\****\Downloads\hold the line (2).aup
2013-06-04 19:13 - 2013-06-04 18:27 - 00029004 ____A C:\Users\****\Downloads\layla.aup
2013-06-04 18:27 - 2013-06-04 18:27 - 00000000 ____D C:\Users\****\Downloads\layla_data
2013-06-04 00:28 - 2013-05-20 00:30 - 00000503 ____A C:\Windows\SDI.ini
2013-06-04 00:24 - 2011-03-16 18:12 - 00000000 ____D C:\Users\****\AppData\Roaming\.minecraft
2013-06-03 23:30 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-03 18:38 - 2013-06-03 18:38 - 00012057 ____A C:\Users\****\Downloads\fear.aup
2013-06-03 18:38 - 2013-06-03 18:38 - 00000000 ____D C:\Users\****\Downloads\fear_data
2013-06-03 15:17 - 2013-06-03 15:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Users\****.****\AppData\Roaming\Cycling '74
2013-06-03 15:15 - 2013-06-03 15:15 - 00000000 ____D C:\Program Files (x86)\AkaiPro
2013-06-01 19:43 - 2012-04-25 14:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-01 16:39 - 2011-04-01 05:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-01 15:27 - 2013-05-12 22:28 - 00000000 ___SD C:\Users\****\Google Drive
2013-06-01 15:25 - 2013-06-01 15:04 - 00000000 ____D C:\Users\****\Documents\Photos
2013-05-30 20:10 - 2013-05-30 20:10 - 00018953 ____A C:\Users\****\Documents\gysi.odt
2013-05-27 16:50 - 2013-05-27 16:50 - 02959376 ____A (Microsoft Corporation) C:\Users\****\Downloads\dotnetfx35setup.exe
2013-05-27 16:48 - 2013-05-27 16:48 - 01582608 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.1.exe
2013-05-27 16:48 - 2013-02-13 21:11 - 00001903 ____A C:\Users\Public\Desktop\LOL Recorder.lnk
2013-05-27 16:48 - 2012-12-05 12:29 - 00000000 ____D C:\Program Files (x86)\LOLReplay
2013-05-26 15:18 - 2013-05-25 16:29 - 00001672 ____A C:\Users\****\Documents\battle isle 3 units.txt
2013-05-26 15:10 - 2013-03-31 16:01 - 00000000 ____D C:\dosprogs
2013-05-26 15:07 - 2012-06-12 21:42 - 00001886 ____A C:\Windows\Sandboxie.ini
2013-05-24 21:43 - 2013-05-23 18:56 - 00019893 ____A C:\Users\****\Downloads\sail away.gp5
2013-05-24 21:19 - 2013-05-24 21:19 - 00005525 ____A C:\Users\****\Downloads\sail away.aup
2013-05-24 21:19 - 2013-05-24 21:19 - 00000000 ____D C:\Users\****\Downloads\sail away_data
2013-05-23 19:24 - 2012-04-10 18:17 - 00000000 ____D C:\users\****.****
2013-05-22 23:26 - 2013-05-22 23:26 - 00020012 ____A C:\Users\****\Documents\cc_20130522_232630.reg
2013-05-22 22:18 - 2013-05-22 20:43 - 00005029 ____A C:\Users\****\Downloads\angel.gp5
2013-05-22 19:50 - 2013-05-22 19:50 - 00004115 ____A C:\Users\****\Downloads\Ready for Action.gp5
2013-05-21 18:06 - 2012-04-28 00:23 - 00000000 ____D C:\Program Files (x86)\AVAST
2013-05-21 18:00 - 2012-04-28 00:03 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2013-05-21 17:56 - 2012-04-13 17:12 - 00117336 ____A C:\Users\****.****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-21 17:55 - 2013-05-21 17:55 - 01582626 ____A C:\Users\****\Downloads\LOLReplay-0.8.2.exe
2013-05-20 14:26 - 2013-05-20 14:26 - 00000558 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung (2).lnk
2013-05-20 01:06 - 2013-05-20 01:06 - 00000007 ____A C:\Users\****\Documents\BI3codes.txt
2013-05-20 00:38 - 2013-05-20 00:37 - 00001121 ____A C:\Users\****\Desktop\SDI_1R.EXE - Verknüpfung.lnk
2013-05-20 00:18 - 2011-05-10 16:01 - 00000000 ____D C:\BlueByte
2013-05-19 20:40 - 2013-05-19 20:38 - 99077904 ____A (Oracle Corporation) C:\Users\****\Downloads\VirtualBox-4.2.12-84980-Win.exe
2013-05-19 20:00 - 2013-05-12 18:58 - 00000000 ____D C:\Users\****\AppData\Local\LogMeIn Hamachi
2013-05-19 01:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-05-19 01:29 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-05-18 23:40 - 2013-05-18 23:35 - 00000000 ____D C:\Users\****\Downloads\BI32
2013-05-18 23:33 - 2013-05-18 23:29 - 00000000 ____D C:\Users\****\Downloads\BI3
2013-05-18 20:55 - 2013-05-18 20:55 - 00000245 ____A C:\Users\****\Downloads\regupdate.ini
2013-05-18 20:54 - 2013-05-18 20:54 - 13154452 ____A C:\Users\****\Downloads\SIV_1516a.exe
2013-05-18 16:24 - 2011-05-06 01:15 - 00000000 ____D C:\Users\****\AppData\Local\S2
2013-05-17 22:59 - 2013-05-17 22:59 - 00102194 ____A C:\Users\****\Downloads\Ezreal _ League of Legends.htm
2013-05-17 22:59 - 2013-05-17 22:58 - 00000000 ____D C:\Users\****\Downloads\Ezreal _ League of Legends-Dateien
2013-05-17 22:51 - 2012-06-17 23:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-17 22:51 - 2012-06-17 23:29 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-17 22:51 - 2011-03-13 09:53 - 00000000 ____D C:\ProgramData\Adobe
2013-05-17 13:39 - 2013-05-17 13:38 - 17993632 ____A (Adobe Systems Inc.) C:\Users\****\Downloads\AdobeAIRInstaller.exe
2013-05-17 13:24 - 2013-04-12 19:21 - 00000000 ____D C:\Users\****\Downloads\Enigma_Item_Changer_3.2.2
2013-05-16 22:27 - 2013-05-16 22:26 - 16785637 ____A C:\Users\****\Downloads\Der Aufzug (Comedy-Hörspiel).flv
2013-05-16 11:10 - 2009-07-14 06:45 - 00447640 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 23:00 - 2011-04-06 15:41 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-05-15 22:57 - 2011-03-21 19:13 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-12 22:29 - 2013-05-12 22:24 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-12 22:28 - 2013-05-12 22:28 - 00001714 ____A C:\Users\****\Desktop\Google Drive.lnk
2013-05-12 22:28 - 2013-05-12 22:28 - 00000000 ____D C:\Users\****\AppData\LocalGoogle
2013-05-12 22:25 - 2013-05-12 22:25 - 00000000 ____D C:\Users\****.****\AppData\LocalGoogle
2013-05-12 22:25 - 2013-01-21 14:52 - 00000000 ____D C:\Users\****.****\AppData\Local\Google
2013-05-12 22:25 - 2011-05-06 15:40 - 00000000 ____D C:\Users\****\AppData\Local\Google
2013-05-12 22:24 - 2013-05-12 22:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-05-12 22:23 - 2013-05-12 22:23 - 00781760 ____A (Google Inc.) C:\Users\****\Downloads\googledrivesync.exe
2013-05-12 18:55 - 2013-02-09 03:19 - 03857920 ____A C:\Users\****\Downloads\hamachi210166.msi
Files to move or delete:
====================
C:\Users\MASTER\Launch Fix*it.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-04-14 05:51
==================== End Of Log ============================
--- --- --- --- --- --- Nicht wundern übrigens, ich hab den Desktop meines eingeschränkten Kontos mal aufgeräumt (in Ordner geschoben oder *.lnks gelöscht). Geändert von Cellix (11.06.2013 um 16:08 Uhr) |
|
11.06.2013, 19:09
| #14 |
| /// the machine /// TB-Ausbilder | Google öffnet sich eigenständig Hi, also ich seh nix mehr, sollte alles i.O. sein einfach noch bissl testen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.06.2013, 20:29
| #15 |
| | Google öffnet sich eigenständig Hmm... soweit scheint eig alles in Ordnung zu sein. Wahrscheinlich ist unser Internet nur mal wieder instabil (gg Telekom), denn auf LAN und ohne Facebook im Hintergrund ist die Geschwindigkeit ok. Google hat sich seit gestern Mittag auch noch nicht gemeldet... schätze mal, das Problem ist entweder behoben oder es ist wirklich nur ein harmloser Fehler gewesen. Wäre sonst noch etwas? (Ich weiß, mein Java ist nicht up to date... nach der größeren Lücke neulich hatte ich es in FF abgeschaltet. Als ich keine Änderungen in der Performance bemerkt habe, ließ ich es abgeschaltet, ohne mich weiter drum zu kümmern.) |
|
| Themen zu Google öffnet sich eigenständig |
| administrator, anti-malware, avast, detected, explorer, folge, gelöscht, google, malware, pc-sicherheit, problem, programm, recycle.bin, registry, seite, trojan.xbuild402, trojaner, umgeleitet, update, virenproblem, virustotal, öffnet |
Linear-Darstellung
