GVU Virus, Dienste lassen sich nicht aktivieren, pc langsam, Abstürze etc..!

kevinanthony · 08.07.2013, 11:49

guten morgen,

hier mal der erste scan:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org

Database version: v2013.07.07.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16618
kevin :: KEVIN-PC [administrator]

07.07.2013 22:28:21
mbar-log-2013-07-07 (22-28-21).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 297521
Time elapsed: 1 hour(s), 19 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 2
c:\Windows\Installer\{fd72f31c-638f-0885-e43c-e044e4f81431}\L (Backdoor.0Access) -> Delete on reboot.
c:\Windows\Installer\{fd72f31c-638f-0885-e43c-e044e4f81431}\U (Backdoor.0Access) -> Delete on reboot.

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Kontrollscan:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org

Database version: v2013.07.07.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16618
kevin :: KEVIN-PC [administrator]

08.07.2013 03:13:34
mbar-log-2013-07-08 (03-13-34).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 296934
Time elapsed: 1 hour(s), 8 minute(s), 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

mfg kevin anthony

Aneri · 08.07.2013, 16:49

Hi Kevinanthony

da haben wir ja noch Reste vom ZeroAccess gefunden... du must etwas besser auf dein System achten... Absicherung machen wir am Ende noch mit.

Schritt 1:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 2:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3:

Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus. Es wird nur eine FRST.txt erzeugt. Poste mir diese.

kevinanthony · 09.07.2013, 01:48

hay, mir ist ebend was merkwürdiges passiert.

der Eset scan lief seit 3 Stunden... plötzlich schließen sich alle offenen Fenster und es erscheint dieses Programm :

[IMG]

[/IMG]

ich konnte keine Programme öffnen, habe das Internet gekappt 5 min gewartet und dann konnte ich es auch wegklicken und Programme normal öffnen.. HILFE!!!!

desweiteren hat sich eine Datei auf meinem Desktop erstellt die sich " Internet security PRO.ink " ich fass die Datei lieber nicht an wer weiß

Okay habe mich selbst etwas hier im Forum erkundigt und rkill geladen und gestartet, welcher den Prozess sofort beendet hat.
SORRY es sind nicht die Anweisungen gewesen aber vielleicht erleichtert es die ganze Sache.

rkill log :

Code:

ATTFilter

Rkill 2.5.3 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
 hxxp://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 07/09/2013 03:46:20 AM in x86 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * ALERT: ZEROACCESS Reparse Point/Junction found!

     * C:\Program Files\Microsoft Security Client\Backup => c:\windows\system32\config\ [Dir]
     * C:\Program Files\Microsoft Security Client\DbgHelp.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\de-de => c:\windows\system32\config\ [Dir]
     * C:\Program Files\Microsoft Security Client\Drivers => c:\windows\system32\config\ [Dir]
     * C:\Program Files\Microsoft Security Client\en-us => c:\windows\system32\config\ [Dir]
     * C:\Program Files\Microsoft Security Client\EppManifest.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MpAsDesc.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MpClient.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MpCmdRun.exe => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MpCommu.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\mpevmsg.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MpOAv.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MpRTP.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MpSvc.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MSESysprep.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MsMpCom.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MsMpEng.exe => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MsMpLics.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MsMpRes.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\msseces.exe => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\msseoobe.exe => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\msseooberes.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\MsseWat.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\NisIpsPlugin.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\NisLog.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\NisSrv.exe => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\NisWFP.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\Setup.exe => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\SetupRes.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\shellext.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\SqmApi.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\SymSrv.dll => c:\windows\system32\config [File]
     * C:\Program Files\Microsoft Security Client\SymSrv.yes => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\de-DE => c:\windows\system32\config\ [Dir]
     * C:\Program Files\Windows Defender\MpAsDesc.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MpClient.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MpCmdRun.exe => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MpCommu.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MpEvMsg.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MpOAV.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MpRTP.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MpSvc.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MSASCui.exe => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MsMpCom.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MsMpLics.dll => c:\windows\system32\config [File]
     * C:\Program Files\Windows Defender\MsMpRes.dll => c:\windows\system32\config [File]

 * Reparse Point/Junctions Found (Most likely legitimate)!

     * C:\Windows\System32\config\systemprofile\Anwendungsdaten => C:\Windows\system32\config\systemprofile\AppData\Roaming [Dir]
     * C:\Windows\System32\config\systemprofile\AppData\Local\Anwendungsdaten => C:\Windows\system32\config\systemprofile\AppData\Local [Dir]
     * C:\Windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files => C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files [Dir]
     * C:\Windows\System32\config\systemprofile\AppData\Local\Verlauf => C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History [Dir]
     * C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programme => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs [Dir]
     * C:\Windows\System32\config\systemprofile\Documents\Eigene Bilder => C:\Windows\system32\config\systemprofile\Pictures [Dir]
     * C:\Windows\System32\config\systemprofile\Documents\Eigene Musik => C:\Windows\system32\config\systemprofile\Music [Dir]
     * C:\Windows\System32\config\systemprofile\Documents\Eigene Videos => C:\Windows\system32\config\systemprofile\Videos [Dir]
     * C:\Windows\System32\config\systemprofile\Druckumgebung => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts [Dir]
     * C:\Windows\System32\config\systemprofile\Eigene Dateien => C:\Windows\system32\config\systemprofile\Documents [Dir]
     * C:\Windows\System32\config\systemprofile\Lokale Einstellungen => C:\Windows\system32\config\systemprofile\AppData\Local [Dir]
     * C:\Windows\System32\config\systemprofile\Netzwerkumgebung => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts [Dir]
     * C:\Windows\System32\config\systemprofile\Recent => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent [Dir]
     * C:\Windows\System32\config\systemprofile\SendTo => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo [Dir]
     * C:\Windows\System32\config\systemprofile\Startmenü => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu [Dir]
     * C:\Windows\System32\config\systemprofile\Vorlagen => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates [Dir]

Checking Windows Service Integrity: 

 * No issues found.

Searching for Missing Digital Signatures: 

 * No issues found.

Checking HOSTS File: 

 * HOSTS file entries found: 

  127.0.0.1       localhost

Program finished at: 07/09/2013 03:46:36 AM
Execution time: 0 hours(s), 0 minute(s), and 16 seconds(s)

Aneri · 09.07.2013, 08:36

Hallo Kevinanthony

Dann fangen wir mal wieder von vorn an.
Bitte halte dich an meine Anweisungen. Führe keine Tools ohne Anweisung durch. Installiere und deinstalliere nichts ohne meine Anweisung. Hast du den Internet Security (Malware) selbst installiert?

Da hast du dein System direkt neu Infiziert.

Schritt 1

Hast du das MBAM Logfile, dann bitte Posten, falls nicht lass es nochmal laufen.

Schritt 2

Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus.Setze bitte den Haken bei addition.txt. Es werden zwei Dateien FRST.txt und addition.txt erzeugt. Poste mir diese.

kevinanthony · 09.07.2013, 12:20

hey,

nein habe ich nicht, wie gesagt habe den eset scanner 3 stunden (!) schon laufen lassen. Plötzlich schließen sich ALLE Sachen, eine Datei namens Internet security PRO erstellt sich aufm Desktop und startet sich.

nunja der erneute eset scan lief jetzt 9 stunden, den Inhalt poste ich jetzt einfach mal und entschuldige mich dafür das ich selbstinitiative ergriffen habe.

Code:

ATTFilter

C:\Dokumente und Einstellungen\kevin\AppData\Local\temp\01373330415963.exe	a variant of Win32/Kryptik.BFGL trojan
C:\Dokumente und Einstellungen\kevin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3ab0d83b-5408f364	a variant of Java/Exploit.Agent.OUS trojan
C:\Dokumente und Einstellungen\kevin\Desktop\Programme\handy dateien\Memory Stick\Download\SuperOneClickv2.zip	multiple threats
C:\Dokumente und Einstellungen\kevin\Documents\Downloads\MsgPlusLive-485.exe	a variant of Win32/Adware.CiDHelp application
C:\Program Files\Unlockroot\tools\rootutility	Android/Exploit.Lotoor.DC trojan
C:\Program Files\Unlockroot\tools\Superusers.apk	a variant of Android/Adware.Kuguo.B application
C:\Users\kevin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3ab0d83b-5408f364	a variant of Java/Exploit.Agent.OUS trojan
C:\Users\kevin\Desktop\Programme\handy dateien\Memory Stick\Download\SuperOneClickv2.zip	multiple threats
C:\Users\kevin\Documents\Downloads\MsgPlusLive-485.exe	a variant of Win32/Adware.CiDHelp application

MBAM log :

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.07.08.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16618
kevin :: KEVIN-PC [Administrator]

09.07.2013 13:03:11
mbam-log-2013-07-09 (13-03-11).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 248083
Laufzeit: 8 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

FRST log

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-07-2013
Ran by kevin (administrator) on 09-07-2013 13:16:15
Running from C:\Users\kevin\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

() c:\Program Files\Microsoft Security Client\MsMpEng.exe
() c:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehshell.exe
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Windows\ehome\ehRec.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe, [x]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess
HKCU\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kevo\...\Run: [Remote Control Server] C:\Program Files\Remote Control Server\Remote Control Server.exe [x]
HKU\Kevo\...\Run: [GPU Tweak Main] C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] ()
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-07-07] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [770432 2013-06-27] (Enigma Software Group USA, LLC.)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2012-06-22] ()
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 hiuhgfdi; C:\Windows\system32\drivers\hiuhgfdi.sys [43600 2013-07-09] (Microsoft Corporation)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKsl1c5ec0e4; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A2EA1476-D2CB-4C23-A58B-7DE1894F977F}\MpKsl1c5ec0e4.sys [29904 2013-07-08] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
U0 osulxlqe; C:\Windows\System32\drivers\kehwxbex.sys [54016 2013-07-09] ()
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 catchme; \??\C:\Users\kevin\AppData\Local\Temp\catchme.sys [x]
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
U3 aswMBR; \??\C:\Users\kevin\AppData\Local\Temp\aswMBR.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 13:15 - 2013-07-09 13:15 - 01216596 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 12:59 - 2013-07-09 12:59 - 00001031 ____A C:\Users\kevin\Desktop\eset.txt
2013-07-09 06:41 - 2013-07-09 06:41 - 00054016 ____A C:\Windows\System32\Drivers\kehwxbex.sys
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:17 - 2013-07-09 06:17 - 00002242 ____A C:\Users\kevin\Desktop\SpyHunter.lnk
2013-07-09 06:16 - 2013-07-09 06:18 - 00000000 ____D C:\sh4ldr
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2013-07-09 06:17 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 05:54 - 2013-07-09 05:54 - 00001747 ____A C:\Users\kevin\Desktop\RKreport[0]_D_07092013_055433.txt
2013-07-09 05:54 - 2013-07-09 05:54 - 00001643 ____A C:\Users\kevin\Desktop\RKreport[0]_S_07092013_055424.txt
2013-07-09 05:51 - 2013-07-09 05:51 - 00004991 ____A C:\Users\kevin\Desktop\RKreport[0]_D_07092013_055113.txt
2013-07-09 05:46 - 2013-07-09 05:46 - 00004696 ____A C:\Users\kevin\Desktop\RKreport[0]_S_07092013_054603.txt
2013-07-09 05:41 - 2013-07-09 05:54 - 00000000 ____D C:\Users\kevin\Desktop\RK_Quarantine
2013-07-09 04:14 - 2013-07-09 04:14 - 00001875 ____A C:\Users\kevin\Desktop\aswMBR.txt
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 05:40 - 00001420 ____A C:\Users\kevin\Desktop\Rkill.txt
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 02:55 - 2013-07-09 02:55 - 00343718 ____A C:\Users\kevin\Desktop\cc_20130709_025521.reg
2013-07-09 02:41 - 2013-07-09 02:41 - 00043600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\hiuhgfdi.sys
2013-07-09 02:40 - 2013-07-09 02:40 - 00855040 ____A (Dexpot GbR) C:\ProgramData\mwdefender.exe
2013-07-09 02:40 - 2013-07-09 02:40 - 00000651 ____A C:\Users\Public\Desktop\Internet Security PRO.lnk
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:51 - 2013-07-09 01:51 - 03357912 ____A (Piriform Ltd) C:\Users\kevin\Desktop\ccsetup403_slim.exe
2013-07-09 01:31 - 2013-07-09 01:32 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-08 21:44 - 2013-07-08 21:44 - 00002303 ____A C:\Users\kevin\Desktop\esetscan abgebrochen.txt
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:30 - 2013-07-08 18:30 - 00000000 ____D C:\Program Files\ESET
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 18:12 - 2013-07-08 18:13 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\kevin\Desktop\mbam-setup-1.75.0.1300.exe
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-07 22:28 - 2013-07-08 12:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-07 22:27 - 2013-07-08 12:48 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-07 22:26 - 2013-07-07 22:26 - 13399154 ____A C:\Users\kevin\Desktop\mbar-1.06.0.1004.zip
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-06 11:13 - 2010-07-07 23:09 - 03948600 ____A (Microsoft Corporation) C:\Windows\System32\ntkrlICE.exe
2013-07-06 09:10 - 2013-07-06 09:10 - 00002592 ____A C:\Users\kevin\Desktop\FSS.txt
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-06 05:16 - 2013-07-06 05:16 - 00014227 ____A C:\Users\kevin\Desktop\hs_err_pid8064.log
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:06 - 2013-07-05 13:40 - 00000000 ____D C:\Qoobox
2013-07-05 13:06 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 13:06 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 13:06 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 13:05 - 2013-07-05 13:37 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== One Month Modified Files and Folders =======

2013-07-09 13:15 - 2013-07-09 13:15 - 01216596 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 13:07 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-09 12:59 - 2013-07-09 12:59 - 00001031 ____A C:\Users\kevin\Desktop\eset.txt
2013-07-09 12:42 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-07-09 12:42 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-07-09 12:42 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-09 12:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-09 12:22 - 2013-02-08 08:48 - 01264190 ____A C:\Windows\WindowsUpdate.log
2013-07-09 12:05 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-09 12:02 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-09 06:41 - 2013-07-09 06:41 - 00054016 ____A C:\Windows\System32\Drivers\kehwxbex.sys
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:18 - 2013-07-09 06:16 - 00000000 ____D C:\sh4ldr
2013-07-09 06:17 - 2013-07-09 06:17 - 00002242 ____A C:\Users\kevin\Desktop\SpyHunter.lnk
2013-07-09 06:17 - 2013-07-09 06:15 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2010-06-20 15:42 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-07-09 05:54 - 2013-07-09 05:54 - 00001747 ____A C:\Users\kevin\Desktop\RKreport[0]_D_07092013_055433.txt
2013-07-09 05:54 - 2013-07-09 05:54 - 00001643 ____A C:\Users\kevin\Desktop\RKreport[0]_S_07092013_055424.txt
2013-07-09 05:54 - 2013-07-09 05:41 - 00000000 ____D C:\Users\kevin\Desktop\RK_Quarantine
2013-07-09 05:51 - 2013-07-09 05:51 - 00004991 ____A C:\Users\kevin\Desktop\RKreport[0]_D_07092013_055113.txt
2013-07-09 05:51 - 2012-06-14 15:17 - 00000000 __SHD C:\Users\kevin\AppData\Local\{fd72f31c-638f-0885-e43c-e044e4f81431}
2013-07-09 05:46 - 2013-07-09 05:46 - 00004696 ____A C:\Users\kevin\Desktop\RKreport[0]_S_07092013_054603.txt
2013-07-09 05:40 - 2013-07-09 03:39 - 00001420 ____A C:\Users\kevin\Desktop\Rkill.txt
2013-07-09 04:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-09 04:14 - 2013-07-09 04:14 - 00001875 ____A C:\Users\kevin\Desktop\aswMBR.txt
2013-07-09 04:09 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 03:21 - 2011-03-26 23:08 - 00000000 ____D C:\Program Files\Common Files\Nokia
2013-07-09 03:18 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-07-09 02:55 - 2013-07-09 02:55 - 00343718 ____A C:\Users\kevin\Desktop\cc_20130709_025521.reg
2013-07-09 02:53 - 2013-02-08 06:37 - 00000000 ____D C:\Windows\Panther
2013-07-09 02:53 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\AppData\Roaming\IDM
2013-07-09 02:53 - 2012-07-03 22:31 - 00000000 ____D C:\Program Files\Connectify
2013-07-09 02:53 - 2012-06-20 02:47 - 00000000 ____D C:\Users\kevin\AppData\Roaming\TS3Client
2013-07-09 02:53 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-07-09 02:53 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-09 02:53 - 2010-06-11 19:18 - 00000000 ____D C:\Users\kevin\Tracing
2013-07-09 02:41 - 2013-07-09 02:41 - 00043600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\hiuhgfdi.sys
2013-07-09 02:40 - 2013-07-09 02:40 - 00855040 ____A (Dexpot GbR) C:\ProgramData\mwdefender.exe
2013-07-09 02:40 - 2013-07-09 02:40 - 00000651 ____A C:\Users\Public\Desktop\Internet Security PRO.lnk
2013-07-09 02:31 - 2012-07-02 02:48 - 00000000 ____D C:\Users\kevin\AppData\Local\Sony
2013-07-09 02:25 - 2010-10-28 01:07 - 00000000 ____D C:\Program Files\Neffy
2013-07-09 02:25 - 2010-08-05 16:17 - 00000000 ____D C:\Program Files\Netlog Uploader
2013-07-09 02:12 - 2012-08-10 18:38 - 00000000 ____D C:\Program Files\MAGIX
2013-07-09 02:12 - 2012-08-10 18:37 - 00000000 ____D C:\ProgramData\MAGIX
2013-07-09 01:59 - 2012-07-05 16:47 - 00000000 ____D C:\Program Files\SoftLogica
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:58 - 2012-07-15 20:31 - 00000000 ____D C:\ProgramData\Google
2013-07-09 01:58 - 2012-07-15 20:31 - 00000000 ____D C:\Program Files\Google
2013-07-09 01:57 - 2012-07-04 15:48 - 00000000 ____D C:\Program Files\Cisco
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:51 - 2013-07-09 01:51 - 03357912 ____A (Piriform Ltd) C:\Users\kevin\Desktop\ccsetup403_slim.exe
2013-07-09 01:49 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Bonjour
2013-07-09 01:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-07-09 01:43 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-09 01:32 - 2013-07-09 01:31 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-09 00:22 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-09 00:22 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-09 00:22 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-09 00:21 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-09 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-08 21:44 - 2013-07-08 21:44 - 00002303 ____A C:\Users\kevin\Desktop\esetscan abgebrochen.txt
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:30 - 2013-07-08 18:30 - 00000000 ____D C:\Program Files\ESET
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 18:13 - 2013-07-08 18:12 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\kevin\Desktop\mbam-setup-1.75.0.1300.exe
2013-07-08 18:13 - 2012-07-15 21:58 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-08 13:05 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-08 12:48 - 2013-07-07 22:28 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-08 12:48 - 2013-07-07 22:27 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-08 03:17 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-08 03:17 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-08 03:10 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-08 03:06 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-08 00:18 - 2012-06-20 02:48 - 00000000 ____D C:\Users\kevin\AppData\Roaming\ts3overlay
2013-07-08 00:17 - 2012-06-20 02:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-07-07 22:26 - 2013-07-07 22:26 - 13399154 ____A C:\Users\kevin\Desktop\mbar-1.06.0.1004.zip
2013-07-07 17:52 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-07 17:11 - 2010-12-27 20:51 - 00076888 ____A C:\Windows\System32\PnkBstrA.exe
2013-07-07 17:00 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-07-07 16:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-07-07 16:55 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-07-07 16:55 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-07 16:55 - 2012-01-31 16:58 - 00000000 ____D C:\Users\kevin\Documents\Assassin's Creed Revelations
2013-07-07 16:54 - 2011-07-25 22:35 - 00000000 ____D C:\Program Files\Ubisoft
2013-07-07 16:06 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-07-06 09:10 - 2013-07-06 09:10 - 00002592 ____A C:\Users\kevin\Desktop\FSS.txt
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-06 05:16 - 2013-07-06 05:16 - 00014227 ____A C:\Users\kevin\Desktop\hs_err_pid8064.log
2013-07-05 21:44 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:40 - 2013-07-05 13:06 - 00000000 ____D C:\Qoobox
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-07-05 13:37 - 2013-07-05 13:05 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:30 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-04 21:45 - 2013-07-04 21:45 - 00282521 ____A C:\Users\kevin\Desktop\gvu.dib
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-03 13:36 - 2013-07-03 13:36 - 00014212 ____A C:\Users\kevin\Desktop\hs_err_pid3876.log
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3072820278-2867077185-342124202-1001\$fd72f31c638f0885e43ce044e4f81431

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431

Files to move or delete:
====================
C:\ProgramData\mwdefender.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Microsoft Security Client\MsMpEng.exe => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Microsoft Security Client


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition :

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 09-07-2013
Ran by kevin at 2013-07-09 13:16:46
Running from C:\Users\kevin\Desktop
Boot Mode: Normal
==========================================================

Adobe AIR (Version: 2.7.0.19530)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (Version: 11.3.300.271)
Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03)
Apple Mobile Device Support (Version: 6.0.0.59)
Assassin's Creed Revelations 1.03 (Version: 1.03)
ASUS GPU Tweak (Version: 2.3.9.2)
Audacity 1.3.12 (Unicode)
Audacity 2.0.2 (Version: 2.0.2)
Auslogics Disk Defrag (Version: 3.6)
AXIS Media Control Embedded Installer (Version: 6.0.65)
Badoo Desktop (Version: 1.6.58.1220)
Battlefield 2142
Battlefield 3™ (Version: 1.6.0.0)
BHV Camgoo Demo
BioShock 2 (Version: 1.0.0005.131)
BioShock 2 (Version: 1.00.0000)
BlackBeatsFM (Version: 1.0)
Blacklight: Retribution
Brink
Call of Duty: Black Ops
Call of Duty: Black Ops - Multiplayer
CameraHelperMsi (Version: 13.50.854.0)
CCleaner (Version: 4.03)
Cisco PEAP Module (Version: 1.1.6)
Connectify (Version: 3.4.0.23678)
Counter-Strike: Condition Zero
Counter-Strike: Source
Counter-Strike: Source (Version: 1.0.0.0)
Counter-Strike: Source Beta
CPUCooL (remove only)
CPUFSB (remove only)
CPUID CPU-Z 1.63.0
Creative ALchemy (Version: 1.41)
Creative Audio-Systemsteuerung (Version: 3.00)
Creative Karaoke Player (Version: 2.11)
Creative Konsole Starter (Version: 2.61)
Creative Media Toolbox 6 (Shared Components) (Version: 2.80.12)
Creative Media Toolbox 6 (Version: 6.00)
Creative MediaSource 5 (Version: 5.00)
Creative Smart Recorder (Version: 2.20)
Creative Systeminformationen
Creative WaveStudio 7 (Version: 7.14)
Crysis WARHEAD(R)
Crysis WARHEAD(R) (Version: 1.0)
Crysis Wars(R)
Crysis Wars(R) (Version: 1.0)
Crysis(R) (Version: 1.00.0000)
Crysis® 2 (Version: 1.0.0.0)
Cucusoft YouTube Mate 8.07
D3DX10 (Version: 15.4.2368.0902)
Data Doctor Recovery - SIM Card (Demo) (Version: 4.4.1.2)
Day of Defeat: Source
Deckadance
DH Driver Cleaner Professional Edition (Version: Version 1.5)
DHTML Editing Component (Version: 6.02.0001)
DirectWave
DivX-Setup (Version: 1.0.2.22)
DX10
EA Download Manager (Version: 4.0.0.462)
Edison
Eigenschaften von Creative Sound Blaster (Version: 1.02)
Epson USB Display (Version: 1.51.000)
erLT (Version: 1.20.138.34)
ESN Sonar (Version: 0.70.4)
Facebook Messenger 2.1.4814.0 (Version: 2.1.4814.0)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Far Cry 2 (Version: 1.03.00)
Far Cry 3 (Version: 1.05)
FlatOut2 (Version: 1.00.0000)
Fraps (remove only)
Free Download Manager 3.0
Free Studio version 5.0.5
Futuremark SystemInfo (Version: 4.15.0)
GameSpy Comrade (Version: 1.5.0.156)
GEAR 32bit Driver Installer (Version: 2.005.1)
Geeks3D.com FurMark 1.10.1
GIMP 2.6.11 (Version: 2.6.11)
Google Update Helper (Version: 1.3.21.149)
Grand Theft Auto IV
Grand Theft Auto IV (Version: 1.0.0011.131)
Grand Theft Auto IV (Version: 1.0.0013.131)
Grand Theft Auto IV (Version: 1.00.0000)
HAL9000 1.7
Half-Life 2: Deathmatch
Half-Life 2: Lost Coast
Hauppauge WinTV 7 (Version: v7.0.28314)
Hauppauge WinTV Infrared Remote (Version: 2.68.28280)
Hauppauge WinTV IR Blaster (Version: 7.4.28190)
Hercules DJ Products Series drivers (Version: 4.HDJS.2010)
HomeMedia (Version: 2.0.3)
HUAWEI DataCard Driver 4.22.19.00 (Version: 4.22.19.00)
IL Autogun
IL Gross Beat
IL Juice Pack
IL Vocodex
ImgBurn (Version: 2.5.7.0)
Internet Download Manager
Internet-TV für Windows Media Center (Version: 4.2.2.0)
IsoBuster 2.8.5 (Version: 2.8.5)
Java Auto Updater (Version: 2.0.2.1)
Java(TM) 6 Update 33 (Version: 6.0.330)
JNLP
Join Air (Version: 1.0.0.1)
Juiced2_HIN (Version: 1.00.0000)
Kies Air Discovery Service
LAME v3.99.3 (for Windows)
Left 4 Dead 2
Linkury Smartbar Engine (HKCU Version: 1.24.22.10764)
Logitech Vid HD (Version: 7.2 (7240))
Logitech Webcam Software (Version: 2.0)
LWS Facebook (Version: 13.50.854.0)
LWS Gallery (Version: 13.50.854.0)
LWS Help_main (Version: 13.50.862.0)
LWS Launcher (Version: 13.50.859.0)
LWS Motion Detection (Version: 13.30.1395.0)
LWS Pictures And Video (Version: 13.50.861.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Video Mask Maker (Version: 13.30.1379.0)
LWS VideoEffects (Version: 13.30.1379.0)
LWS Webcam Software (Version: 13.31.1038.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
MagicTune Premium (Version: 4.0.12)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Mario Forever 5.0
Maximus
Medieval CUE Splitter (Version: 1.0.0)
Messenger Plus! Live (Version: 4.90.0.392)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 2.1.6805.0)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8107.0)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft PowerPoint Viewer (Version: 14.0.6029.1000)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Client DE-DE Language Pack (Version: 2.0.0657.0)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MixMeister Fusion Demo 7.4.4
Mobile Broadband Generic Drivers (Version: 2.03.10.002.25)
Mobile Connection Manager (Version: 8.8.7.892)
Morphine
Mozilla Firefox 21.0 (x86 de) (Version: 21.0)
Mozilla Maintenance Service (Version: 21.0)
MSI Star Cam 370i (Version: 100.000.070814)
MSI Star Cam 370i (Version: 5.12.2.25)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSVC90_x86 (Version: 1.0.1.2)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT Redists (Version: 1.0)
MSVCRT110 (Version: 16.4.1108.0727)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
MyPhoneExplorer (Version: 1.8.2)
Need for Speed™ The Run (Version: 1.1.0.0)
Nexon Game Manager
Nokia Connectivity Cable Driver (Version: 7.1.45.0)
Nokia Map Loader (Version: 3.0.28)
Nokia Ovi Player (Version: 2.1.11020)
Nokia Ovi Suite (Version: 3.1.1.90)
Nokia_Multimedia_Common_Components_2_5 (Version: 2.7.16)
Nur Deinstallierung der CopyTrans Suite möglich. (HKCU Version: 2.27)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2)
NVIDIA Install Application (Version: 2.1002.124.810)
NVIDIA nTune (Version: 1.00.0000)
NVIDIA PhysX (Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
Opera 12.10 (Version: 12.10.1652)
Option WWAN Driver 5.0.32.0 Installer  (Version: 3.5.0.1158)
Option WWAN Driver 5.0.32.0 Installer (Version: 3.5.0.1158)
Origin (Version: 8.5.0.4550)
OtsTurntables Free 1.00.047
Ovi Desktop Sync Engine (Version: 1.5.266.0)
OviMPlatform (Version: 2.7.72.0)
Paltalk Messenger  10.2 (Version: 10.2.0)
Pando Media Booster (Version: 2.6.0.8)
PC Connectivity Solution (Version: 11.4.21.0)
Photo Common (Version: 16.4.3508.0205)
PowerStrip 3 (remove only)
Project64 1.6 (Version: 1.6)
PunkBuster Services (Version: 0.993)
Realtek High Definition Audio Driver (Version: 6.0.1.6132)
RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition (Version: v2.24 MSI Master Overclocking Arena 2009 edition)
Roadkil's Unstoppable Copier Version 5.2
Saints Row: The Third
Samsung Kies (Version: 2.3.2.12064_9)
Samsung Mobile phone USB driver Drive Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung PC Studio 3 (Version: 3.0.0.71206)
Samsung PC Studio 3 (Version: 3.2.1.71206)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.6.0)
Samsung_MonSetup (Version: 1.00.0000)
Scratch Live 2.2.0 (22033) (Version: 2.2.0)
Security Task Manager 1.8f (Version: 1.8f)
simfy (Version: 1.4.9)
Sitecom 11n USB Wireless LAN Driver and Utility (Version: 1.00.0165)
Skype™ 6.5 (Version: 6.5.158)
SocksCap V2
Sony Ericsson PC Companion 2.01.149 (Version: 2.01.149)
Sound Blaster X-Fi Surround 5.1 (Version: 1.0)
Source Multiplayer Dedicated Server
Source SDK
Source SDK Base 2006
Source SDK Base 2007
SpeedFan (remove only)
Spotify (HKCU Version: 0.8.3.222.g317ab79d)
SpyHunter (Version: 4.14.5.4268)
Steam (Version: 1.0.0.0)
STREET FIGHTER IV (Version: 1.00.3013)
StuffIt Expander 2010 (Version: 14.0.0)
System Requirements Lab
System Requirements Lab (Version: 4.3.1.0)
System Requirements Lab CYRI (Version: 5.0.6.0)
Team Fortress 2
TeamSpeak 3 Client (Version: 3.0.10.1)
TeamViewer 7 (Version: 7.0.12541)
Text-To-Speech-Runtime (Version: 1.0.0.0)
The Lord of the Rings Online™ v03.07.01.8015 (Version: 03.07.01.8015)
Titan Quest (Version: 1.00.0000)
TmNationsForever
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.3000.99)
TuneUp Utilities Language Pack (de-DE) (Version: 12.0.3600.73)
Ubisoft Game Launcher (Version: 1.0.0.0)
Unity Web Player (HKCU Version: )
UnLock Root 2.41 (Version: 2.41)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)
Uplay (Version: 3.0)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
VirtualDJ PRO Full (Version: 7.4)
VLC media player 1.0.5 (Version: 1.0.5)
Vodafone Mobile Connect Lite (Version: 9.4.2.14731)
WarRock
Wecker 2.2 2.2 (Version: 2.2)
Win7codecs (Version: 4.0.0)
Windows 7 Upgrade Advisor (Version: 2.0.5000.0)
Windows 7 USB/DVD Download Tool (Version: 1.0.30)
Windows Driver Package - Google, Inc. AndroidUsbDeviceClass  (12/06/2010 4.0.0000.00000) (Version: 12/06/2010 4.0.0000.00000)
Windows Live Communications Platform (Version: 16.4.3508.0205)
Windows Live Essentials (Version: 16.4.3508.0205)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (Version: 16.4.3508.0205)
Windows Live Messenger (Version: 16.4.3508.0205)
Windows Live Photo Common (Version: 16.4.3508.0205)
Windows Live PIMT Platform (Version: 16.4.3508.0205)
Windows Live SOXE (Version: 16.4.3508.0205)
Windows Live SOXE Definitions (Version: 16.4.3508.0205)
Windows Live UX Platform (Version: 16.4.3508.0205)
Windows Live UX Platform Language Pack (Version: 16.4.3508.0205)
Windows Media Center Add-in for Silverlight (Version: 4.7.3.0)
Windows Movie Maker 2.6 (Version: 2.6.4037.0)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
WinPcap 4.1.2 (Version: 4.1.0.2001)
WinRAR 4.01 (32-Bit) (Version: 4.01.0)
WM Recorder (Version: 14.11.2)
WM Recorder (Version: 14.12.2)
Worms 3D Demo (Version: 0.00.001)
ZTE Drivers v1.2059.0.11 (Version: 1.0.0.25)
ZTE USB Driver (Version: 1.0.1.25_TME)
 

==================== Restore Points  =========================

06-07-2013 14:55:36 Geplanter Prüfpunkt
07-07-2013 01:00:11 Windows Update
07-07-2013 05:18:24 Installiert Far Cry 3
07-07-2013 14:43:31 Wiederherstellungsvorgang
07-07-2013 15:07:00 Installiert Far Cry 3
07-07-2013 22:14:05 Malwarebytes Anti-Rootkit Restore Point
08-07-2013 23:42:51 Removed Apple Software Update
08-07-2013 23:45:29 Removed Apple Application Support
08-07-2013 23:47:10 .NET Utilities wird entfernt
08-07-2013 23:48:34 Removed Bonjour
08-07-2013 23:56:00 Removed Cisco EAP-FAST Module
08-07-2013 23:56:21 Removed Cisco LEAP Module
09-07-2013 00:09:43 MAGIX Screenshare wird entfernt
09-07-2013 00:10:05 MAGIX Speed burnR (MSI) wird entfernt
09-07-2013 00:25:33 Removed PlayReady PC Runtime x86
09-07-2013 00:28:28 Removed Remote Control Server.
09-07-2013 00:29:02 Removed Vegas Pro 11.0
09-07-2013 01:14:49 Removed BlueStacks
09-07-2013 01:20:24 Removed Nokia Ovi Suite Software Updater.
09-07-2013 04:15:46 Installed SpyHunter

==================== Hosts content: ==========================

2013-07-05 13:27 - 2013-07-05 13:30 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {108D2882-FD23-45DD-B957-EDA509AC53CF} - System32\Tasks\{596A7DC0-19CB-49CD-A6BF-D31DB867FF1B} => c:\program files\internet explorer\iexplore.exe [2013-05-17] (Microsoft Corporation)
Task: {1499F01C-A5A1-4C55-A794-DADBA5C0B26F} - System32\Tasks\{D3332D73-B353-4D1A-94CC-FDF7B5024FEC} => E:\Autorun.exe No File
Task: {1AB72F55-6452-422C-9B95-C24FA3C9AD77} - System32\Tasks\{72DBD266-83F0-4ECB-8508-9D2ECB8B15CB} => E:\Setup\Setup.exe No File
Task: {2074660B-3B67-4D7F-9DDD-BD73805F5B8C} - System32\Tasks\User_Feed_Synchronization-{1E23D3BD-A4ED-473B-B39E-B889EE424B79} => C:\Windows\system32\msfeedssync.exe [2013-04-05] (Microsoft Corporation)
Task: {22BEBCF0-814D-479F-99EE-06E8CA14B374} - System32\Tasks\{13438248-D0BB-44C1-B598-406136FD136F} => E:\Setup\Setup.exe No File
Task: {23C5AB58-007B-4448-B62B-6021F01EF423} - System32\Tasks\{03DBA127-F5EE-433B-BB95-8D672A48407A} => E:\Setup\Setup.exe No File
Task: {47FEEF93-CFC8-4212-BA75-51488A506D40} - System32\Tasks\{2336342D-43A3-401A-BA31-86CA34567BAE} => C:\Program Files\Samsung\Samsung PC Studio 3\Launcher.exe [2007-12-14] ()
Task: {4FAC3A2F-296C-4971-A087-07B6DA7B54C8} - System32\Tasks\{4040B74E-A860-43B8-9EAC-F6C814D044EE} => C:\Team17\Worms 3D Demo\Launcher.exe [2003-10-22] (Team17 Software Ltd)
Task: {69A112C1-FA7A-470F-8847-C637C5BD076A} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe No File
Task: {6A688C04-59C3-4482-9658-96317DA0832D} - System32\Tasks\{E6EAE8B2-555D-4322-A3E5-C861178AE616} => c:\program files\internet explorer\iexplore.exe [2013-05-17] (Microsoft Corporation)
Task: {7B808232-EA82-4BF9-8A88-72520DB4D2B1} - System32\Tasks\{DB47CE6D-8A74-4FE1-9ACF-A2ECE1D24D4A} => E:\Setup\Setup.exe No File
Task: {89CEE9C3-A531-4234-850E-EE1BA44E3849} - System32\Tasks\{D086AA7E-1EF9-4A09-B255-B46D5B0E5F60} => C:\Program Files\Skype\\Phone\Skype.exe [2013-06-03] (Skype Technologies S.A.)
Task: {910D58AE-9579-4226-B5AA-BFFC90E055D2} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)
Task: {920A7E2E-4E12-492D-BD75-7304D255A9FF} - System32\Tasks\Google Updater and Installer => C:\Users\kevin\AppData\Local\Google\Update\GoogleUpdate.exe No File
Task: {92E3151C-7AEE-43CE-BDED-B1E3B082EDC2} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18] (Sun Microsystems, Inc.)
Task: {953B0E42-868E-422A-8A8F-D61A8CA58B4E} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files\TuneUp Utilities 2011\OneClick.exe No File
Task: {977E3137-0D4B-44D2-A4AC-3ED6C50B19CA} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2013-06-27] (Enigma Software Group USA, LLC.)
Task: {9CEEE205-200F-4C78-AEBC-5D8E39542C12} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-07-15] (Google Inc.)
Task: {9DF278D4-1410-4320-9F83-7AFF1FABC250} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {9F821761-16E2-4629-9DA6-5A5BDD2FC58A} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {ABB732A7-F4B0-4138-96DE-4EF840FF489C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {B1E63869-308E-4460-8A58-655BDC122F9C} - System32\Tasks\{6D5113FD-ED25-45E7-891C-F8F63734E6A4} => E:\setup.exe No File
Task: {BB1F0186-D189-4A9F-8F17-3367FA60BB45} - System32\Tasks\User_Feed_Synchronization-{FD2DC954-A0C3-46AF-A2F3-C5D5DF290CE2} => C:\Windows\system32\msfeedssync.exe [2013-04-05] (Microsoft Corporation)
Task: {BB3654D2-84CD-45C5-BD25-1980EBA52C9C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-13] (Adobe Systems Incorporated)
Task: {C948E476-8795-4519-8EE4-AD148F524017} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {CC913BB9-F6FF-4EDF-A9AB-966C91FE507C} - System32\Tasks\WPD\SqmUpload_S-1-5-21-3072820278-2867077185-342124202-1007 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {CFC37238-F214-4E42-B5F0-61EF7D54D07E} - System32\Tasks\{25267A73-5C3A-43E7-BC22-54107A40BE49} => E:\Autorun.exe No File
Task: {D3295B8C-54C2-426E-86C9-82BE44BB596F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-25] (Facebook Inc.)
Task: {E09222E3-A52D-4463-B1C8-3734CA0150C8} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-01-27] ()
Task: {E5F6BD09-6508-4DD7-BAB9-85CCD594C53A} - System32\Tasks\{BBA781FA-64B3-4A55-A666-471B074D8FB6} => C:\Program Files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe No File
Task: {E8DDDEF4-E76E-4FA0-BD7A-81A202FA359E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-07-15] (Google Inc.)
Task: {EEA8010E-DBC3-476A-A4F0-6BAC0CF814DD} - System32\Tasks\{EA1483EA-A0FA-461D-AB90-2ADDB0902127} => C:\Team17\Worms 3D Demo\Launcher.exe [2003-10-22] (Team17 Software Ltd)
Task: {F01EC86B-84BE-4377-B2DA-8551DA7EF39A} - System32\Tasks\{6F285D02-12FD-44B2-A95E-F809DBAC9021} => C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2009-04-20] (Vodafone)
Task: {F56456A5-F589-423F-9035-B8F0F648EB3F} - System32\Tasks\{DE931848-CCE3-4809-941B-FA000A4ECAD5} => C:\Program Files\Samsung\Samsung PC Studio 3\Launcher.exe [2007-12-14] ()
Task: {FD638276-DD67-4E5A-9DEB-7A3AAE78B837} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-25] (Facebook Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job => C:\Users\kevin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Name: Connectify LightWeight Filter
Description: Connectify LightWeight Filter
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: cnnctfy2
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/09/2013 00:00:07 PM) (Source: Google Update) (User: kevin-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http s

Error: (07/09/2013 09:00:06 AM) (Source: Google Update) (User: kevin-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http s

Error: (07/09/2013 06:16:07 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service vToolbarUpdater15.1.0 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (07/09/2013 03:20:24 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service vToolbarUpdater15.1.0 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (07/09/2013 03:14:50 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service vToolbarUpdater15.1.0 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (07/09/2013 01:48:21 AM) (Source: MsiInstaller) (User: kevin-PC)
Description: Product: .NET Utilities -- Error 1929. Error unregistering COM+ Application.  Contact your support personnel for more information.

Error: (07/09/2013 01:48:09 AM) (Source: COM+) (User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (07/08/2013 04:56:24 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (07/08/2013 00:14:14 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddLegacyDriverFiles: Unable to back up image of binary MpKsl65cc2d53.

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (07/07/2013 05:27:33 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Uplay.exe, Version: 0.0.0.0, Zeitstempel: 0x5135b9c0
Name des fehlerhaften Moduls: Uplay.exe, Version: 0.0.0.0, Zeitstempel: 0x5135b9c0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001ef2c2
ID des fehlerhaften Prozesses: 0xf8c
Startzeit der fehlerhaften Anwendung: 0xUplay.exe0
Pfad der fehlerhaften Anwendung: Uplay.exe1
Pfad des fehlerhaften Moduls: Uplay.exe2
Berichtskennung: Uplay.exe3


System errors:
=============
Error: (07/09/2013 01:16:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:16:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:16:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:16:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:16:05 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:16:01 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:15:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:15:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:15:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079

Error: (07/09/2013 01:15:59 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1079


Microsoft Office Sessions:
=========================
Error: (07/09/2013 00:00:07 PM) (Source: Google Update)(User: kevin-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http s

Error: (07/09/2013 09:00:06 AM) (Source: Google Update)(User: kevin-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http s

Error: (07/09/2013 06:16:07 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service vToolbarUpdater15.1.0 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (07/09/2013 03:20:24 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service vToolbarUpdater15.1.0 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (07/09/2013 03:14:50 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service vToolbarUpdater15.1.0 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (07/09/2013 01:48:21 AM) (Source: MsiInstaller)(User: kevin-PC)
Description: Product: .NET Utilities -- Error 1929. Error unregistering COM+ Application.  Contact your support personnel for more information.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (07/09/2013 01:48:09 AM) (Source: COM+)(User: )
Description: (DtcGetTransactionManagerEx(): hr = 0x8004d01b)

Error: (07/08/2013 04:56:24 AM) (Source: SideBySide)(User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\asio4all v2\a4apanel64.exe

Error: (07/08/2013 00:14:14 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: 
Details:
AddLegacyDriverFiles: Unable to back up image of binary MpKsl65cc2d53.

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (07/07/2013 05:27:33 PM) (Source: Application Error)(User: )
Description: Uplay.exe0.0.0.05135b9c0Uplay.exe0.0.0.05135b9c0c0000005001ef2c2f8c01ce7b267f7eb75cC:\Program Files\Ubisoft\Ubisoft Game Launcher\Uplay.exeC:\Program Files\Ubisoft\Ubisoft Game Launcher\Uplay.exebe1d2054-e719-11e2-8d58-001d60d1a58c


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 5119.29 MB
Available physical RAM: 2912.3 MB
Total Pagefile: 10236.86 MB
Available Pagefile: 7465.51 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.66 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:229.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: D61A319B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

==================== End Of Log ============================

neue Symptome die aufgetreten sind : egal was mit Internet Explorer oder mit Firefox gedownloaded wid zeigt er an "***.exe" enthielt einen Virus und wurde gelöscht. unteranderem auch bei FRST.exe . kann nur noch über Opera downloaden

Aneri · 09.07.2013, 16:38

Hi

Schritt 1

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess
C:\$Recycle.Bin\S-1-5-21-3072820278-2867077185-342124202-1001\$fd72f31c638f0885e43ce044e4f81431
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431
DeleteJunctionsIndirectory: C:\Program Files\Microsoft Security Client
C:\Dokumente und Einstellungen\kevin\AppData\Local\temp\01373330415963.exe
C:\Dokumente und Einstellungen\kevin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3ab0d83b-5408f364
C:\Dokumente und Einstellungen\kevin\Desktop\Programme\handy dateien\Memory Stick\Download\SuperOneClickv2.zip
C:\Dokumente und Einstellungen\kevin\Documents\Downloads\MsgPlusLive-485.exe
C:\Program Files\Unlockroot\tools\rootutility
C:\Program Files\Unlockroot\tools\Superusers.apk
C:\Users\kevin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3ab0d83b-5408f364
C:\Users\kevin\Desktop\Programme\handy dateien\Memory Stick\Download\SuperOneClickv2.zip
C:\Users\kevin\Documents\Downloads\MsgPlusLive-485.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus. Es wird nur eine FRST.txt erzeugt. Poste mir diese.

kevinanthony · 09.07.2013, 17:09

hi

Fixlog

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 09-07-2013 01
Ran by kevin at 2013-07-09 18:04:12 Run:4
Running from C:\Users\kevin\Desktop
Boot Mode: Normal

==============================================

HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
C:\$Recycle.Bin\S-1-5-21-3072820278-2867077185-342124202-1001\$fd72f31c638f0885e43ce044e4f81431 => Deleted successfully.
C:\$Recycle.Bin\S-1-5-18\$fd72f31c638f0885e43ce044e4f81431 => Deleted successfully.
"C:\Program Files\Microsoft Security Client" => Deleting reparse point and unlocking started.
"C:\Program Files\Microsoft Security Client" => Deleting reparse point and unlocking completed.
"C:\Dokumente und Einstellungen\kevin\AppData\Local\temp\01373330415963.exe" => File/Directory not found.
C:\Dokumente und Einstellungen\kevin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3ab0d83b-5408f364 => Moved successfully.
C:\Dokumente und Einstellungen\kevin\Desktop\Programme\handy dateien\Memory Stick\Download\SuperOneClickv2.zip => Moved successfully.
C:\Dokumente und Einstellungen\kevin\Documents\Downloads\MsgPlusLive-485.exe => Moved successfully.
C:\Program Files\Unlockroot\tools\rootutility => Moved successfully.
C:\Program Files\Unlockroot\tools\Superusers.apk => Moved successfully.
"C:\Users\kevin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\3ab0d83b-5408f364" => File/Directory not found.
"C:\Users\kevin\Desktop\Programme\handy dateien\Memory Stick\Download\SuperOneClickv2.zip" => File/Directory not found.
"C:\Users\kevin\Documents\Downloads\MsgPlusLive-485.exe" => File/Directory not found.


The system needs a manual reboot. 

==== End of Fixlog ====

kontrollscan

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-07-2013 01
Ran by kevin (administrator) on 09-07-2013 18:06:12
Running from C:\Users\kevin\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Windows\system32\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\ehome\ehRec.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe
(Microsoft Corporation) C:\Windows\eHome\EhTray.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Electronic Arts) C:\Program Files\Origin\Origin.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\ehome\ehshell.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [141848 2009-09-11] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [173592 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [150552 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe, [x]
HKCU\...\Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] - C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-07-07] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-07-09] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKsl5ba6fccc; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B74B23D3-E1D3-4740-90D5-0370472ABCD6}\MpKsl5ba6fccc.sys [29904 2013-07-09] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 catchme; \??\C:\Users\kevin\AppData\Local\Temp\catchme.sys [x]
S3 clwvd; system32\DRIVERS\clwvd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 18:03 - 2013-07-09 18:04 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 14:03 - 2013-07-09 14:04 - 00040776 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamswissarmy.sys
2013-07-09 14:03 - 2013-07-09 14:03 - 00085168 ____A C:\Windows\setupact.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:59 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2013-07-09 13:25 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:31 - 2013-07-09 01:32 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-07 22:28 - 2013-07-08 12:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-07 22:27 - 2013-07-08 12:48 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-06 11:13 - 2010-07-07 23:09 - 03948600 ____A (Microsoft Corporation) C:\Windows\System32\ntkrlICE.exe
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:06 - 2013-07-05 13:40 - 00000000 ____D C:\Qoobox
2013-07-05 13:06 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 13:06 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 13:06 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 13:05 - 2013-07-05 13:37 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-09 18:04 - 00000000 ____D C:\FRST
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== One Month Modified Files and Folders =======

2013-07-09 18:07 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-09 18:04 - 2013-07-09 18:03 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 18:04 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-09 18:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-09 17:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-09 17:35 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-09 17:35 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-09 17:35 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-09 17:34 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-09 17:13 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-09 14:30 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-09 14:30 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-09 14:18 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-09 14:14 - 2013-02-08 08:48 - 01285753 ____A C:\Windows\WindowsUpdate.log
2013-07-09 14:04 - 2013-07-09 14:03 - 00040776 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamswissarmy.sys
2013-07-09 14:03 - 2013-07-09 14:03 - 00085168 ____A C:\Windows\setupact.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 14:03 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-09 14:03 - 2012-07-15 20:31 - 00000000 ____D C:\Program Files\Google
2013-07-09 14:03 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:59 - 2013-07-09 13:42 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 13:25 - 2013-07-09 06:15 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 12:42 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-07-09 12:42 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-07-09 12:42 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2010-06-20 15:42 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-07-09 05:51 - 2012-06-14 15:17 - 00000000 __SHD C:\Users\kevin\AppData\Local\{fd72f31c-638f-0885-e43c-e044e4f81431}
2013-07-09 04:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 03:21 - 2011-03-26 23:08 - 00000000 ____D C:\Program Files\Common Files\Nokia
2013-07-09 03:18 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-07-09 02:53 - 2013-02-08 06:37 - 00000000 ____D C:\Windows\Panther
2013-07-09 02:53 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\AppData\Roaming\IDM
2013-07-09 02:53 - 2012-07-03 22:31 - 00000000 ____D C:\Program Files\Connectify
2013-07-09 02:53 - 2012-06-20 02:47 - 00000000 ____D C:\Users\kevin\AppData\Roaming\TS3Client
2013-07-09 02:53 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-07-09 02:53 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-09 02:53 - 2010-06-11 19:18 - 00000000 ____D C:\Users\kevin\Tracing
2013-07-09 02:31 - 2012-07-02 02:48 - 00000000 ____D C:\Users\kevin\AppData\Local\Sony
2013-07-09 02:25 - 2010-10-28 01:07 - 00000000 ____D C:\Program Files\Neffy
2013-07-09 02:25 - 2010-08-05 16:17 - 00000000 ____D C:\Program Files\Netlog Uploader
2013-07-09 02:12 - 2012-08-10 18:38 - 00000000 ____D C:\Program Files\MAGIX
2013-07-09 02:12 - 2012-08-10 18:37 - 00000000 ____D C:\ProgramData\MAGIX
2013-07-09 01:59 - 2012-07-05 16:47 - 00000000 ____D C:\Program Files\SoftLogica
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:58 - 2012-07-15 20:31 - 00000000 ____D C:\ProgramData\Google
2013-07-09 01:57 - 2012-07-04 15:48 - 00000000 ____D C:\Program Files\Cisco
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:49 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Bonjour
2013-07-09 01:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-07-09 01:43 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-09 01:32 - 2013-07-09 01:31 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-09 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 18:13 - 2012-07-15 21:58 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-08 12:48 - 2013-07-07 22:28 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-08 12:48 - 2013-07-07 22:27 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-08 03:06 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-08 00:18 - 2012-06-20 02:48 - 00000000 ____D C:\Users\kevin\AppData\Roaming\ts3overlay
2013-07-08 00:17 - 2012-06-20 02:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-07-07 17:52 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-07 17:11 - 2010-12-27 20:51 - 00076888 ____A C:\Windows\System32\PnkBstrA.exe
2013-07-07 17:00 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-07-07 16:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-07-07 16:55 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-07-07 16:55 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-07 16:55 - 2012-01-31 16:58 - 00000000 ____D C:\Users\kevin\Documents\Assassin's Creed Revelations
2013-07-07 16:54 - 2011-07-25 22:35 - 00000000 ____D C:\Program Files\Ubisoft
2013-07-07 16:06 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 21:44 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:40 - 2013-07-05 13:06 - 00000000 ____D C:\Qoobox
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-07-05 13:37 - 2013-07-05 13:05 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:30 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================

--- --- ---

--- --- ---

Manuell nochmal rebooted und ein kontrollscan durchgeführt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-07-2013 01
Ran by kevin (administrator) on 09-07-2013 18:44:59
Running from C:\Users\kevin\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\ehome\ehrec.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Windows\system32\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehRec.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(Microsoft Corporation) C:\Windows\eHome\EhTray.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [141848 2009-09-11] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [173592 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [150552 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe, [x]
HKCU\...\Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] - C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)
HKU\Kevo\...\Run: [Remote Control Server] - C:\Program Files\Remote Control Server\Remote Control Server.exe [x]
HKU\Kevo\...\Run: [GPU Tweak Main] - C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-07-07] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKsl32821b76; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B74B23D3-E1D3-4740-90D5-0370472ABCD6}\MpKsl32821b76.sys [29904 2013-07-09] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 catchme; \??\C:\Users\kevin\AppData\Local\Temp\catchme.sys [x]
S3 clwvd; system32\DRIVERS\clwvd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 18:03 - 2013-07-09 18:04 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 14:03 - 2013-07-09 18:42 - 00170336 ____A C:\Windows\setupact.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:59 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2013-07-09 13:25 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:31 - 2013-07-09 01:32 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-07 22:28 - 2013-07-08 12:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-07 22:27 - 2013-07-08 12:48 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-06 11:13 - 2010-07-07 23:09 - 03948600 ____A (Microsoft Corporation) C:\Windows\System32\ntkrlICE.exe
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:06 - 2013-07-05 13:40 - 00000000 ____D C:\Qoobox
2013-07-05 13:06 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 13:06 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 13:06 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 13:05 - 2013-07-05 13:37 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-09 18:04 - 00000000 ____D C:\FRST
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== One Month Modified Files and Folders =======

2013-07-09 18:45 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-09 18:43 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-09 18:42 - 2013-07-09 14:03 - 00170336 ____A C:\Windows\setupact.log
2013-07-09 18:42 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-09 18:38 - 2013-02-08 08:48 - 01286994 ____A C:\Windows\WindowsUpdate.log
2013-07-09 18:38 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-09 18:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-09 18:11 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-09 18:07 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-09 18:04 - 2013-07-09 18:03 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 18:04 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-09 18:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-09 17:35 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-09 17:35 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-09 17:35 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-09 17:34 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-09 14:30 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-09 14:30 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-09 14:18 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 14:03 - 2012-07-15 20:31 - 00000000 ____D C:\Program Files\Google
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:59 - 2013-07-09 13:42 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 13:25 - 2013-07-09 06:15 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 12:42 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-07-09 12:42 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-07-09 12:42 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2010-06-20 15:42 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-07-09 05:51 - 2012-06-14 15:17 - 00000000 __SHD C:\Users\kevin\AppData\Local\{fd72f31c-638f-0885-e43c-e044e4f81431}
2013-07-09 04:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 03:21 - 2011-03-26 23:08 - 00000000 ____D C:\Program Files\Common Files\Nokia
2013-07-09 03:18 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-07-09 02:53 - 2013-02-08 06:37 - 00000000 ____D C:\Windows\Panther
2013-07-09 02:53 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\AppData\Roaming\IDM
2013-07-09 02:53 - 2012-07-03 22:31 - 00000000 ____D C:\Program Files\Connectify
2013-07-09 02:53 - 2012-06-20 02:47 - 00000000 ____D C:\Users\kevin\AppData\Roaming\TS3Client
2013-07-09 02:53 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-07-09 02:53 - 2010-06-11 19:18 - 00000000 ____D C:\Users\kevin\Tracing
2013-07-09 02:31 - 2012-07-02 02:48 - 00000000 ____D C:\Users\kevin\AppData\Local\Sony
2013-07-09 02:25 - 2010-10-28 01:07 - 00000000 ____D C:\Program Files\Neffy
2013-07-09 02:25 - 2010-08-05 16:17 - 00000000 ____D C:\Program Files\Netlog Uploader
2013-07-09 02:12 - 2012-08-10 18:38 - 00000000 ____D C:\Program Files\MAGIX
2013-07-09 02:12 - 2012-08-10 18:37 - 00000000 ____D C:\ProgramData\MAGIX
2013-07-09 01:59 - 2012-07-05 16:47 - 00000000 ____D C:\Program Files\SoftLogica
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:58 - 2012-07-15 20:31 - 00000000 ____D C:\ProgramData\Google
2013-07-09 01:57 - 2012-07-04 15:48 - 00000000 ____D C:\Program Files\Cisco
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:49 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Bonjour
2013-07-09 01:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-07-09 01:43 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-09 01:32 - 2013-07-09 01:31 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-09 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 18:13 - 2012-07-15 21:58 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-08 12:48 - 2013-07-07 22:28 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-08 12:48 - 2013-07-07 22:27 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-08 00:18 - 2012-06-20 02:48 - 00000000 ____D C:\Users\kevin\AppData\Roaming\ts3overlay
2013-07-08 00:17 - 2012-06-20 02:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-07-07 17:52 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-07 17:11 - 2010-12-27 20:51 - 00076888 ____A C:\Windows\System32\PnkBstrA.exe
2013-07-07 17:00 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-07-07 16:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-07-07 16:55 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-07-07 16:55 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-07 16:55 - 2012-01-31 16:58 - 00000000 ____D C:\Users\kevin\Documents\Assassin's Creed Revelations
2013-07-07 16:54 - 2011-07-25 22:35 - 00000000 ____D C:\Program Files\Ubisoft
2013-07-07 16:06 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 21:44 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:40 - 2013-07-05 13:06 - 00000000 ____D C:\Qoobox
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-07-05 13:37 - 2013-07-05 13:05 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:30 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================

--- --- ---

--- --- ---

Aneri · 09.07.2013, 17:53

Hi

Kann es sein, dass du schon wieder Software installiert hast? z.B. Hitman Pro so um 13:43?

Schritt 1:

starte das System bitte neu. FRST Verlangt einen manuelle Neustart.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

kevinanthony · 09.07.2013, 18:00

ja, hab ich damit was flasches gemacht ?

ich habe schon manuell neugestarted hatte sogar das log hinzugefügt im letzten post.

hier nochmal

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-07-2013 01
Ran by kevin (administrator) on 09-07-2013 19:02:49
Running from C:\Users\kevin\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Windows\system32\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\ehome\ehshell.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\eHome\EhTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehRec.exe
(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [141848 2009-09-11] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [173592 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [150552 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe, [x]
HKCU\...\Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] - C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)
HKU\Kevo\...\Run: [Remote Control Server] - C:\Program Files\Remote Control Server\Remote Control Server.exe [x]
HKU\Kevo\...\Run: [GPU Tweak Main] - C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-07-07] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R1 MpKsl32821b76; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B74B23D3-E1D3-4740-90D5-0370472ABCD6}\MpKsl32821b76.sys [29904 2013-07-09] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 catchme; \??\C:\Users\kevin\AppData\Local\Temp\catchme.sys [x]
S3 clwvd; system32\DRIVERS\clwvd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 19:01 - 2013-07-09 19:02 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 14:03 - 2013-07-09 18:42 - 00170336 ____A C:\Windows\setupact.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:59 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2013-07-09 13:25 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:31 - 2013-07-09 01:32 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-07 22:28 - 2013-07-08 12:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-07 22:27 - 2013-07-08 12:48 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-06 11:13 - 2010-07-07 23:09 - 03948600 ____A (Microsoft Corporation) C:\Windows\System32\ntkrlICE.exe
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:06 - 2013-07-05 13:40 - 00000000 ____D C:\Qoobox
2013-07-05 13:06 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 13:06 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 13:06 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 13:05 - 2013-07-05 13:37 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-09 18:04 - 00000000 ____D C:\FRST
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== One Month Modified Files and Folders =======

2013-07-09 19:02 - 2013-07-09 19:01 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 18:57 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-09 18:56 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-09 18:50 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-09 18:50 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-09 18:43 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-09 18:42 - 2013-07-09 14:03 - 00170336 ____A C:\Windows\setupact.log
2013-07-09 18:42 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-09 18:38 - 2013-02-08 08:48 - 01303179 ____A C:\Windows\WindowsUpdate.log
2013-07-09 18:38 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-09 18:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-09 18:07 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-09 18:04 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-09 18:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-09 17:35 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-09 17:35 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-09 17:35 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-09 17:34 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-09 14:18 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 14:03 - 2012-07-15 20:31 - 00000000 ____D C:\Program Files\Google
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:59 - 2013-07-09 13:42 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 13:25 - 2013-07-09 06:15 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 12:42 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-07-09 12:42 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-07-09 12:42 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2010-06-20 15:42 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-07-09 05:51 - 2012-06-14 15:17 - 00000000 __SHD C:\Users\kevin\AppData\Local\{fd72f31c-638f-0885-e43c-e044e4f81431}
2013-07-09 04:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 03:21 - 2011-03-26 23:08 - 00000000 ____D C:\Program Files\Common Files\Nokia
2013-07-09 03:18 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-07-09 02:53 - 2013-02-08 06:37 - 00000000 ____D C:\Windows\Panther
2013-07-09 02:53 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\AppData\Roaming\IDM
2013-07-09 02:53 - 2012-07-03 22:31 - 00000000 ____D C:\Program Files\Connectify
2013-07-09 02:53 - 2012-06-20 02:47 - 00000000 ____D C:\Users\kevin\AppData\Roaming\TS3Client
2013-07-09 02:53 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-07-09 02:53 - 2010-06-11 19:18 - 00000000 ____D C:\Users\kevin\Tracing
2013-07-09 02:31 - 2012-07-02 02:48 - 00000000 ____D C:\Users\kevin\AppData\Local\Sony
2013-07-09 02:25 - 2010-10-28 01:07 - 00000000 ____D C:\Program Files\Neffy
2013-07-09 02:25 - 2010-08-05 16:17 - 00000000 ____D C:\Program Files\Netlog Uploader
2013-07-09 02:12 - 2012-08-10 18:38 - 00000000 ____D C:\Program Files\MAGIX
2013-07-09 02:12 - 2012-08-10 18:37 - 00000000 ____D C:\ProgramData\MAGIX
2013-07-09 01:59 - 2012-07-05 16:47 - 00000000 ____D C:\Program Files\SoftLogica
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:58 - 2012-07-15 20:31 - 00000000 ____D C:\ProgramData\Google
2013-07-09 01:57 - 2012-07-04 15:48 - 00000000 ____D C:\Program Files\Cisco
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:49 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Bonjour
2013-07-09 01:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-07-09 01:43 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-09 01:32 - 2013-07-09 01:31 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-09 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 18:13 - 2012-07-15 21:58 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-08 12:48 - 2013-07-07 22:28 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-08 12:48 - 2013-07-07 22:27 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-08 00:18 - 2012-06-20 02:48 - 00000000 ____D C:\Users\kevin\AppData\Roaming\ts3overlay
2013-07-08 00:17 - 2012-06-20 02:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-07-07 17:52 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-07 17:11 - 2010-12-27 20:51 - 00076888 ____A C:\Windows\System32\PnkBstrA.exe
2013-07-07 17:00 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-07-07 16:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-07-07 16:55 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-07-07 16:55 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-07 16:55 - 2012-01-31 16:58 - 00000000 ____D C:\Users\kevin\Documents\Assassin's Creed Revelations
2013-07-07 16:54 - 2011-07-25 22:35 - 00000000 ____D C:\Program Files\Ubisoft
2013-07-07 16:06 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 21:44 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:40 - 2013-07-05 13:06 - 00000000 ____D C:\Qoobox
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-07-05 13:37 - 2013-07-05 13:05 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:30 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================

--- --- ---

Aneri · 09.07.2013, 18:33

Hi Kevinanthony

ja hast du , ich hatte dich mehrmals gebeten nichts zu installieren oder zu deinstallieren ohne Anweisung

Schritt 1:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

testsigning: on

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2:

Starte das System neu und scanne nochmals mit FRST und Poste das Logfile hier.

Teil mir mit wie das System jetzt läuft und ob es noch Probleme gibt.

Aneri · 09.07.2013, 19:47

Dann geht´s so weiter:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Wunderbar dein System ist soweit ich das sehen kann sauber.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Benutzerkonto Einstellungen:

Wir sehen immer wieder User mit Administratorrechten. Hier kann jeder Nutzer eines Windowsrechners schon die erste Türe schließen. Arbeite mit einem eingeschränkten Benutzerkonto anstelle eines Kontos mit Administratorrechten. Diese sind für das tägliche Arbeiten nicht nötig, und solltest du einmal Software installieren wollen wirst du im normalfall nach deinem Passwort gefragt.

Solltest du Hilfe bei der Erstellung eines "eingeschränkten Kontos" benötigen helfe ich dir gern weiter.

Systemupdates:

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Besonders Java erfährt zur Zeit regelmäßig sicherheitsrelevante Updates

Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 17 ) herunter laden.
Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
Klicke erneut OK.

schneller Plugin-Test: PluginCheck

Antivirensoftware

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

alternatives Browsen

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Wenn du möchtest, kannst du das Trojaner Board Forum mit einer kleinen Spende unterstützen.

kevinanthony · 09.07.2013, 21:27

hi,

wollte den fix durchführen, nachdem die Fixlog datei erstellt wurde sagt er mir editor zugriff verweigert

Aneri · 10.07.2013, 12:14

hi,

Hänge die Datei bitte hier im Post als Anhang an, und poste ein frisches FRST Logfile .

kevinanthony · 10.07.2013, 14:20

jetzt hat es geklappt

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 09-07-2013 01
Ran by kevin at 2013-07-10 15:16:54 Run:9
Running from C:\Users\kevin\Desktop
Boot Mode: Normal

==============================================


Die angegebene Eintrags-ID ist nicht gltig.
Falscher Parameter.

==== End of Fixlog ====

FRST log

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-07-2013 01
Ran by kevin (administrator) on 10-07-2013 15:17:34
Running from C:\Users\kevin\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
() C:\Windows\system32\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Electronic Arts) C:\Program Files\Origin\Origin.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\eHome\EhTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehRec.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\ehome\ehVid.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [141848 2009-09-11] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [173592 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [150552 2009-09-11] (Intel Corporation)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe, [x]
HKCU\...\Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot [3491264 2012-06-10] (Tonec Inc.)
HKCU\...\Run: [GPU Tweak Main] - C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [3268608 2013-05-16] (ASUS)
HKCU\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [19604072 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-14] (Microsoft Corporation)
HKU\Kevo\...\Run: [Remote Control Server] - C:\Program Files\Remote Control Server\Remote Control Server.exe [x]
HKU\Kevo\...\Run: [GPU Tweak Main] - C:\Program Files\ASUS\GPU Tweak\GPUTweak.exe [ 2013-05-16] (ASUS)
HKU\Kevo\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-06-03] (Skype Technologies S.A.)
HKU\Kevo\...\Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot [ 2012-06-10] (Tonec Inc.)
HKU\Kevo\...\Policies\system: [LogonHoursAction] 2
HKU\Kevo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKCU -No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default
FF NetworkProxy: "backup.ftp", "securewebproxy.org"
FF NetworkProxy: "backup.ftp_port", 1111
FF NetworkProxy: "backup.gopher", "securewebproxy.org"
FF NetworkProxy: "backup.gopher_port", 1111
FF NetworkProxy: "backup.socks", "securewebproxy.org"
FF NetworkProxy: "backup.socks_port", 1111
FF NetworkProxy: "backup.ssl", "securewebproxy.org"
FF NetworkProxy: "backup.ssl_port", 1111
FF NetworkProxy: "ftp", "securewebproxy.org"
FF NetworkProxy: "ftp_port", 1111
FF NetworkProxy: "gopher", "securewebproxy.org"
FF NetworkProxy: "gopher_port", 1111
FF NetworkProxy: "http", "securewebproxy.org"
FF NetworkProxy: "http_port", 1111
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "securewebproxy.org"
FF NetworkProxy: "socks_port", 1111
FF NetworkProxy: "ssl", "securewebproxy.org"
FF NetworkProxy: "ssl_port", 1111
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @java.com/DTPlugin,version=1.6.0_33 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\kevin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\kevin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\kevin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Elite Proxy Switcher - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\eliteproxyswitcher@my-proxy.com
FF Extension: No Name - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{88cdf226-1a4e-467b-aa5d-1c2c70bbadc0}
FF Extension: DownloadHelper - C:\Users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\iptyei2s.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\kevin\AppData\Roaming\IDM\idmmzcc5

========================== Services (Whitelisted) =================

S4 Connectify; C:\Program Files\Connectify\ConnectifyService.exe [65536 2012-05-02] ()
S4 CPUCooLServer; C:\Program Files\CPUCooL\CooLSrv.exe [743936 2011-12-01] ()
S4 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-09-17] (Creative Labs)
S4 Creative Media Toolbox 6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe [79360 2010-08-02] (Creative Labs)
S4 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.5\EMP_UDSA.exe [98304 2011-01-06] (SEIKO EPSON CORPORATION)
S4 Futuremark SystemInfo Service; C:\Program Files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [137488 2012-12-17] (Futuremark Corporation)
S4 GtDetectSc; C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [545792 2009-05-04] (OptionNV)
S4 HauppaugeTVServer; C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe [558592 2010-11-03] (Hauppauge Computer Works)
S4 HerculesDJControlMP3; C:\Program Files\Hercules\Audio\DJ Console Series\drivers\x86\HerculesDJControlMP3.EXE [17408 2010-12-23] ()
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S4 npggsvc; C:\Windows\system32\GameMon.des [3890920 2010-06-17] (INCA Internet Co., Ltd.)
S4 NWHelper; C:\Program Files\Novatel Wireless\Drivers\NWHelper.exe [193824 2009-12-04] (Novatel Wireless Inc.)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2013-07-07] ()
S4 Realtek11nCU; C:\Program Files\SITECOM\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-17] (Realtek)
S4 Sony Ericsson PCCompanion; C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [150528 2011-02-10] (Avanquest Software)
S4 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S4 UI Assistant Service; C:\Program Files\Mobile Partner Manager\AssistantServices.exe [241664 2009-03-24] ()
S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 VMCService; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-04-20] (Vodafone)
S2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [x]
S4 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [34592 2013-05-03] (AVG Technologies)
R3 Bulk; C:\Windows\System32\Drivers\HDJBulk.sys [153600 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
S1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [27248 2012-07-03] (Connectify)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [219352 2009-06-05] (Intel Corporation)
R2 ESLWireAC; C:\Windows\system32\drivers\ESLWireACD.sys [867344 2012-11-14] (<Turtle Entertainment>)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 hcw17bda; C:\Windows\System32\drivers\hcw17bda.sys [54016 2010-01-27] (Hauppauge Computer Works, Inc.)
R3 HDJMidi; C:\Windows\System32\DRIVERS\HDJMidi.sys [192000 2010-12-23] (© Guillemot R&D, 2010. All rights reserved.)
R3 ksaud; C:\Windows\System32\drivers\ksaud.sys [899712 2011-07-06] (Creative Technology Ltd.)
S3 LVPr2Mon; C:\Windows\System32\Drivers\LVPr2Mon.sys [25824 2010-05-07] ()
R1 MagicTune; C:\Windows\system32\drivers\MTiCtwl.sys [14336 2010-04-22] (Samsung Electronics, Inc. )
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S1 MpKsl32821b76; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B74B23D3-E1D3-4740-90D5-0370472ABCD6}\MpKsl32821b76.sys [29904 2013-07-09] ()
R1 MpKsl37287a90; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B74B23D3-E1D3-4740-90D5-0370472ABCD6}\MpKsl37287a90.sys [29904 2013-07-09] (Microsoft Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R1 ntiopnp; C:\Windows\System32\Drivers\ntiopnp.sys [21080 2010-11-11] ()
R1 ntiowp; C:\Windows\System32\Drivers\ntiowp.sys [12352 2006-10-20] ()
S3 NVFLASH; C:\Windows\system32\drivers\nvflash.sys [12864 2012-03-10] ()
S3 NVR0Dev; C:\Windows\nvoclock.sys [6912 2006-10-31] (NVidia Corp.)
S3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13312 2011-07-19] (June Fabrics Technology Inc.)
S3 PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] (B-phreaks)
R2 PStrip; C:\Windows\system32\DRIVERS\PSTRIP.SYS [27992 2007-07-15] (EnTech Taiwan)
S3 RivaTuner32; C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [9088 2009-08-22] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 catchme; \??\C:\Users\kevin\AppData\Local\Temp\catchme.sys [x]
S3 clwvd; system32\DRIVERS\clwvd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 19:01 - 2013-07-09 19:02 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 14:03 - 2013-07-09 22:53 - 00255504 ____A C:\Windows\setupact.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:59 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2013-07-09 13:25 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:31 - 2013-07-09 01:32 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-07 22:28 - 2013-07-08 12:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-07 22:27 - 2013-07-08 12:48 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-06 11:13 - 2010-07-07 23:09 - 03948600 ____A (Microsoft Corporation) C:\Windows\System32\ntkrlICE.exe
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:06 - 2013-07-05 13:40 - 00000000 ____D C:\Qoobox
2013-07-05 13:06 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 13:06 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 13:06 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 13:06 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 13:05 - 2013-07-05 13:37 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-04 21:33 - 2013-07-04 21:34 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 18:01 - 2013-07-09 18:04 - 00000000 ____D C:\FRST
2013-07-04 17:15 - 2013-07-04 17:16 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:21 - 2013-01-18 16:21 - 04133664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2013-06-30 09:21 - 2013-01-18 16:21 - 03005728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 02953448 ____A C:\Windows\System32\nvcoproc.bin
2013-06-30 09:21 - 2013-01-18 16:20 - 02557728 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00639776 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2013-06-30 09:21 - 2013-01-18 16:20 - 00108832 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2013-06-30 09:21 - 2013-01-18 16:20 - 00062752 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:19 - 2013-06-24 23:54 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:01 - 2013-06-23 08:16 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:45 - 2013-06-15 16:46 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-14 15:59 - 2013-06-13 21:14 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:13 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 03:13 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 03:13 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 03:04 - 2013-06-14 03:12 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 03:37 - 2013-06-13 15:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:22 - 2013-06-13 03:23 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:22 - 2010-01-18 14:01 - 00098384 ____A C:\Windows\System32\Drivers\hcw17isd.1b0
2013-06-13 03:22 - 2009-12-09 13:43 - 00101056 ____A C:\Windows\System32\Drivers\hcw17dvb.1b0
2013-06-13 03:22 - 2009-08-11 14:35 - 00249856 ____A (Siano Mobile Silicon) C:\Windows\System32\HcwSmsCt.dll
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:19 - 2013-06-13 03:20 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:19 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 03:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 03:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 03:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:24 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 02:24 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 02:24 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 02:23 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 02:23 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 02:23 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 02:23 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 02:23 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 02:23 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 02:23 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== One Month Modified Files and Folders =======

2013-07-10 15:15 - 2009-07-14 10:56 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-10 15:07 - 2012-07-15 20:32 - 00001096 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-10 15:00 - 2011-09-13 20:56 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001UA.job
2013-07-10 14:37 - 2012-04-19 20:36 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-10 11:59 - 2013-02-08 08:48 - 01314311 ____A C:\Windows\WindowsUpdate.log
2013-07-10 04:50 - 2012-06-20 02:47 - 00000000 ____D C:\Users\kevin\AppData\Roaming\TS3Client
2013-07-10 04:07 - 2012-07-15 20:32 - 00001092 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-10 03:54 - 2012-02-01 22:54 - 00291088 ____A C:\Windows\System32\PnkBstrB.xtr
2013-07-10 03:54 - 2010-12-27 20:52 - 00291088 ____A C:\Windows\System32\PnkBstrB.exe
2013-07-10 03:54 - 2010-12-27 20:52 - 00280904 ____A C:\Windows\System32\PnkBstrB.ex0
2013-07-10 03:54 - 2010-12-27 20:52 - 00137992 ____A C:\Windows\System32\Drivers\PnkBstrK.sys
2013-07-10 01:04 - 2010-12-02 21:26 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Skype
2013-07-10 00:00 - 2011-09-13 20:56 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3072820278-2867077185-342124202-1001Core.job
2013-07-09 23:00 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-09 23:00 - 2009-07-14 06:34 - 00015152 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-09 22:54 - 2011-08-02 01:11 - 00000000 ____D C:\Program Files\Origin
2013-07-09 22:53 - 2013-07-09 14:03 - 00255504 ____A C:\Windows\setupact.log
2013-07-09 22:52 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-09 19:02 - 2013-07-09 19:01 - 01216688 ____A (Farbar) C:\Users\kevin\Desktop\FRST.exe
2013-07-09 18:38 - 2010-06-09 20:58 - 00000000 ____D C:\Users\kevin\AppData\Roaming\DMCache
2013-07-09 18:04 - 2013-07-04 18:01 - 00000000 ____D C:\FRST
2013-07-09 14:03 - 2013-07-09 14:03 - 00002202 ____A C:\Windows\PFRO.log
2013-07-09 14:03 - 2013-07-09 14:03 - 00000000 ____A C:\Windows\setuperr.log
2013-07-09 14:03 - 2012-07-15 20:31 - 00000000 ____D C:\Program Files\Google
2013-07-09 13:59 - 2013-07-09 13:59 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-07-09 13:59 - 2013-07-09 13:42 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-09 13:43 - 2013-07-09 13:43 - 00001905 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-07-09 13:43 - 2013-07-09 13:43 - 00000000 ____D C:\Program Files\HitmanPro
2013-07-09 13:42 - 2013-07-09 13:42 - 09171472 ____A (SurfRight B.V.) C:\Users\kevin\Desktop\HitmanPro.exe
2013-07-09 13:25 - 2013-07-09 06:15 - 00000000 ____D C:\Windows\471D8B37C5B344579FA1B3C693334F4F.TMP
2013-07-09 12:42 - 2012-10-19 06:02 - 00000000 ____D C:\Users\kevin\Desktop\aktuellere lieder
2013-07-09 12:42 - 2010-06-10 22:18 - 00000000 ___RD C:\Users\kevin\Desktop\Programme
2013-07-09 12:42 - 2010-06-10 22:15 - 00000000 ____D C:\Users\kevin\Desktop\bilder
2013-07-09 06:18 - 2013-07-09 06:18 - 00000000 ____A C:\autoexec.bat
2013-07-09 06:16 - 2013-07-09 06:16 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-07-09 06:15 - 2010-06-20 15:42 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-07-09 05:51 - 2012-06-14 15:17 - 00000000 __SHD C:\Users\kevin\AppData\Local\{fd72f31c-638f-0885-e43c-e044e4f81431}
2013-07-09 04:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-09 03:41 - 2013-07-09 03:41 - 00000000 ____D C:\32788R22FWJFW
2013-07-09 03:39 - 2013-07-09 03:39 - 01814144 ____A (Bleeping Computer, LLC) C:\Users\kevin\Desktop\rkill.com
2013-07-09 03:21 - 2011-03-26 23:08 - 00000000 ____D C:\Program Files\Common Files\Nokia
2013-07-09 03:18 - 2012-06-15 02:03 - 00000000 ____D C:\Program Files\BlueStacks
2013-07-09 02:53 - 2013-02-08 06:37 - 00000000 ____D C:\Windows\Panther
2013-07-09 02:53 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\AppData\Roaming\IDM
2013-07-09 02:53 - 2012-07-03 22:31 - 00000000 ____D C:\Program Files\Connectify
2013-07-09 02:53 - 2011-03-01 19:17 - 00000000 ____D C:\Program Files\Steam
2013-07-09 02:53 - 2010-06-11 19:18 - 00000000 ____D C:\Users\kevin\Tracing
2013-07-09 02:31 - 2012-07-02 02:48 - 00000000 ____D C:\Users\kevin\AppData\Local\Sony
2013-07-09 02:25 - 2010-10-28 01:07 - 00000000 ____D C:\Program Files\Neffy
2013-07-09 02:25 - 2010-08-05 16:17 - 00000000 ____D C:\Program Files\Netlog Uploader
2013-07-09 02:12 - 2012-08-10 18:38 - 00000000 ____D C:\Program Files\MAGIX
2013-07-09 02:12 - 2012-08-10 18:37 - 00000000 ____D C:\ProgramData\MAGIX
2013-07-09 01:59 - 2012-07-05 16:47 - 00000000 ____D C:\Program Files\SoftLogica
2013-07-09 01:58 - 2013-07-09 01:58 - 00000000 ____D C:\Users\kevin\AppData\Local\Google
2013-07-09 01:58 - 2012-07-15 20:31 - 00000000 ____D C:\ProgramData\Google
2013-07-09 01:57 - 2012-07-04 15:48 - 00000000 ____D C:\Program Files\Cisco
2013-07-09 01:52 - 2013-07-09 01:52 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2013-07-09 01:52 - 2013-07-09 01:52 - 00000000 ____D C:\Program Files\CCleaner
2013-07-09 01:49 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Bonjour
2013-07-09 01:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-07-09 01:43 - 2012-02-15 20:03 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-09 01:32 - 2013-07-09 01:31 - 00448512 ____A (OldTimer Tools) C:\Users\kevin\Desktop\TFC.exe
2013-07-08 18:30 - 2013-07-08 18:30 - 02347384 ____A (ESET) C:\Users\kevin\Desktop\esetsmartinstaller_enu.exe
2013-07-08 18:13 - 2013-07-08 18:13 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-08 18:13 - 2012-07-15 21:58 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-08 12:48 - 2013-07-07 22:28 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-08 12:48 - 2013-07-07 22:27 - 00000000 ____D C:\Users\kevin\Desktop\mbar
2013-07-08 00:18 - 2013-07-08 00:18 - 00000000 ____D C:\ProgramData\dbg
2013-07-08 00:18 - 2012-06-20 02:48 - 00000000 ____D C:\Users\kevin\AppData\Roaming\ts3overlay
2013-07-08 00:17 - 2012-06-20 02:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-07-07 17:52 - 2012-07-15 22:09 - 00000000 ____D C:\Users\kevin\AppData\Roaming\MyPhoneExplorer
2013-07-07 17:28 - 2013-07-07 17:28 - 00001159 ____A C:\Users\kevin\Desktop\Uplay.lnk
2013-07-07 17:11 - 2010-12-27 20:51 - 00076888 ____A C:\Windows\System32\PnkBstrA.exe
2013-07-07 17:00 - 2013-02-08 06:51 - 00000000 ____D C:\users\kevin
2013-07-07 16:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-07-07 16:55 - 2013-02-08 06:51 - 00000000 ____D C:\users\Kevo
2013-07-07 16:55 - 2012-07-05 21:43 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\Skype
2013-07-07 16:55 - 2012-01-31 16:58 - 00000000 ____D C:\Users\kevin\Documents\Assassin's Creed Revelations
2013-07-07 16:54 - 2011-07-25 22:35 - 00000000 ____D C:\Program Files\Ubisoft
2013-07-07 16:06 - 2012-12-13 22:03 - 00000000 ____D C:\Users\Kevo\AppData\Roaming\DMCache
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-07-06 11:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-07-06 09:09 - 2013-07-06 09:09 - 00356399 ____A (Farbar) C:\Users\kevin\Desktop\FSS.exe
2013-07-05 21:44 - 2013-02-08 06:49 - 01607382 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 13:40 - 2013-07-05 13:40 - 00035493 ____A C:\ComboFix.txt
2013-07-05 13:40 - 2013-07-05 13:06 - 00000000 ____D C:\Qoobox
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-07-05 13:40 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-07-05 13:37 - 2013-07-05 13:05 - 00000000 ____D C:\Windows\erdnt
2013-07-05 13:30 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-07-05 13:04 - 2013-07-05 13:04 - 05085494 ____R (Swearware) C:\Users\kevin\Desktop\ComboFix.exe
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-07-05 13:03 - 2012-07-05 14:33 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-04 21:34 - 2013-07-04 21:33 - 00039819 ____A C:\AdwCleaner[S1].txt
2013-07-04 21:27 - 2013-05-03 02:01 - 00000000 ____D C:\ProgramData\MFAData
2013-07-04 20:46 - 2013-07-04 20:46 - 00000000 ____D C:\Users\kevin\AppData\Local\Avg2013
2013-07-04 17:16 - 2013-07-04 17:15 - 00040080 ____A C:\AdwCleaner[R1].txt
2013-07-04 17:13 - 2013-07-04 17:13 - 00650027 ____A C:\Users\kevin\Desktop\adwcleaner.exe
2013-07-04 15:29 - 2013-07-04 15:29 - 00000000 ____A C:\Users\kevin\Downloads\Fall Out Boy Ft[1]. Lil Wayne, Lupe Fiasco, Kanye West, Travis (of Gym Class Heroes), Tyga, Paul Wall, & Skin Head Rob) - This Aint A Scene, It An Arms Race (Rem
2013-07-04 13:03 - 2010-06-14 22:25 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-04 13:02 - 2013-07-04 13:02 - 21703480 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 22.0.exe
2013-07-02 19:56 - 2010-09-18 15:19 - 00000000 ____D C:\Users\kevin\Documents\VirtualDJ
2013-07-02 18:51 - 2013-02-08 13:41 - 00000680 _RASH C:\Users\Kevo\ntuser.pol
2013-06-30 15:08 - 2010-12-02 21:26 - 00000000 ____D C:\ProgramData\Skype
2013-06-30 14:53 - 2010-06-09 18:37 - 00000000 ____D C:\Program Files\Windows Live
2013-06-30 14:51 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-30 09:26 - 2013-06-30 09:26 - 00000000 ____D C:\Users\kevin\AppData\Local\{B2B348CF-713B-454E-AF1F-88D90571896E}
2013-06-30 09:24 - 2010-06-09 19:07 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 09:21 - 2010-06-09 18:34 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-06-30 09:20 - 2013-06-30 09:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-06-30 09:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-30 08:41 - 2013-06-08 04:28 - 00000000 ____D C:\Users\kevin\AppData\Local\NVIDIA
2013-06-26 14:12 - 2012-08-03 12:02 - 00000000 ____D C:\Users\kevin\Downloads\Video
2013-06-25 00:57 - 2013-04-03 20:25 - 00000000 ____D C:\Program Files\Futuremark
2013-06-25 00:57 - 2010-06-09 19:21 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-06-24 23:54 - 2013-06-24 23:54 - 00001188 ____A C:\Users\kevin\Desktop\iSRO - Verknüpfung.lnk
2013-06-24 23:54 - 2013-06-23 08:19 - 00000000 ____D C:\Program Files\iSRO
2013-06-23 08:43 - 2013-06-23 08:43 - 00001105 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\ProgramData\Mozilla
2013-06-23 08:43 - 2013-06-23 08:43 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-23 08:42 - 2013-06-23 08:42 - 21151576 ____A (Mozilla) C:\Users\kevin\Downloads\Firefox Setup 21.0.exe
2013-06-23 08:16 - 2013-06-23 08:01 - 1783991173 ____A C:\Users\kevin\Downloads\iSRO_286(2).exe
2013-06-22 23:31 - 2013-06-22 23:31 - 00000000 ____D C:\Users\kevin\AppData\Local\{C0DD6DF3-7E5F-495F-BC91-ED1CF71F38A8}
2013-06-22 08:33 - 2013-02-08 20:20 - 00000680 _RASH C:\Users\kevin\ntuser.pol
2013-06-22 03:07 - 2013-06-22 03:07 - 00000000 ____D C:\1fc9a1ecec8ad963f34885547effc46a
2013-06-22 02:08 - 2011-08-02 01:11 - 00000000 ____D C:\ProgramData\Origin
2013-06-22 02:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-06-22 02:01 - 2010-10-28 06:55 - 00000000 ____D C:\Program Files\gPotato.eu
2013-06-21 23:38 - 2013-06-21 23:38 - 00000000 ____D C:\Users\kevin\AppData\Local\{A152DDA7-9317-45C6-8EF5-B86ED556741E}
2013-06-20 00:20 - 2013-06-20 00:20 - 00026760 ____A C:\Users\kevin\Downloads\bitshare_default.xml
2013-06-19 23:10 - 2013-06-19 23:10 - 00000000 ____D C:\Users\kevin\AppData\Local\{11E16F19-44CF-4006-B8C0-0E752F9E9D17}
2013-06-15 16:46 - 2013-06-15 16:45 - 00000000 ____D C:\Users\kevin\AppData\Local\{DCB07B9B-1C60-473E-A594-F2F334CCDEAC}
2013-06-15 16:43 - 2013-04-29 10:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-06-15 01:05 - 2013-06-15 01:05 - 00000000 ____D C:\Users\kevin\AppData\Local\{3CF6A213-4817-42E6-A4CB-3FD56676B4D4}
2013-06-15 00:38 - 2012-12-14 00:35 - 00000000 ____D C:\Users\kevin\Desktop\beats
2013-06-14 10:23 - 2013-06-14 10:23 - 00000000 ____D C:\Users\kevin\AppData\Local\{77A77206-43F3-416C-97A7-0146DF373D92}
2013-06-14 03:13 - 2013-06-14 03:13 - 00000000 ____D C:\589457bd5c299aeeab
2013-06-14 03:12 - 2013-06-14 03:04 - 00000000 ____D C:\3c8ecc632caa6fdbfbacf16775
2013-06-13 21:14 - 2013-06-14 15:59 - 00000000 ____D C:\Users\kevin\Desktop\BEST OF MAY 2013
2013-06-13 18:59 - 2012-05-25 21:51 - 00000000 ___RD C:\Program Files\Skype
2013-06-13 15:38 - 2013-06-13 03:37 - 00000000 ____D C:\Users\kevin\AppData\Local\{683C7EE4-369F-486F-9646-3D187EE7302F}
2013-06-13 03:37 - 2012-04-19 20:36 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 03:37 - 2011-12-08 01:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-13 03:23 - 2013-06-13 03:22 - 00086330 ____A C:\hcwDriverInstall.txt
2013-06-13 03:20 - 2013-06-13 03:20 - 00000000 ____D C:\d70a8bbf2f4236b6a8f95ee8d8efcb3a
2013-06-13 03:20 - 2013-06-13 03:19 - 00173502 ____A C:\hcwclear.txt
2013-06-13 03:20 - 2013-02-08 14:40 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 03:19 - 2010-06-09 19:21 - 00000000 ____D C:\Windows\System32\Hauppauge
2013-06-13 01:23 - 2013-04-14 22:56 - 00001001 ____A C:\Users\Public\Desktop\ASUS GPU Tweak.lnk
2013-06-13 01:21 - 2011-01-06 04:31 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-12 08:57 - 2012-07-02 22:15 - 00000000 ____D C:\Users\kevin\AppData\Local\Downloaded Installations
2013-06-12 08:54 - 2013-06-12 08:54 - 00000000 ____D C:\Users\kevin\Desktop\RNB4U.in - Best of May 2013
2013-06-12 02:02 - 2013-02-08 13:44 - 00113528 ____A C:\Users\Kevo\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 22:38 - 2013-06-11 22:38 - 00006890 ____A C:\OFB-EAST109546437.pkg
2013-06-11 21:13 - 2013-06-11 21:13 - 00000975 ____A C:\Windows\System32\Drivers\etc\hosts.txt

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-07-03 14:49

==================== End Of Log ============================

--- --- ---

Das System läuft soweit gut außer das :

[IMG]

[/IMG]

Aneri · 10.07.2013, 19:34

Hi

dein Windows Defender ist deaktiviert. Gehe wie folgt vor um ihn zu aktivieren:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

reg: reg add HKLM\SOFTWARE\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD  /d 0

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

10.07.2013, 12:14	#28
Aneri /// Malwareteam	GVU Virus, Dienste lassen sich nicht aktivieren, pc langsam, Abstürze etc..! hi, Hänge die Datei bitte hier im Post als Anhang an, und poste ein frisches FRST Logfile . __________________ Gruß Aneri Mitglied von UNITE Lob oder Kritik? hier wirst du es los

GVU Virus, Dienste lassen sich nicht aktivieren, pc langsam, Abstürze etc..!

Plagegeister aller Art und deren Bekämpfung: GVU Virus, Dienste lassen sich nicht aktivieren, pc langsam, Abstürze etc..!