| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.07.2013, 12:01
| #1 | |
| |  Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Hallo  mein erstes mal hier. Ich hab einen Virus der immer wieder kommt. hab versucht diesen mit HiJackThis, Avira Free Antivirus, Malwarebytes und Microsoft Safety Scanner zu bekämpfen. Meine Firewall wird immer vom Virus deaktiviert. Nachdem alle viren gelöscht sind aktiviert sich die Firewall wieder. (seitdem ich Microsoft Safety Scanner benutze) mit Malwarebytes war die Firewall hinterher immernoch deaktiviert. Nachdem alles gelöscht ist geht alles wieder aber irgendwann fängt der spaß von neu an. Ich weiß nicht was es auslöst... Hab Java und Java 64 Bit installiert. (vlt kommt der virus von java?) Malwarebytes sagt was von "Trojan.0Access" Die von Malwarebytes gefundenen Viren werden im Papierkorb entdeckt. (?!.. C:\$Recycle.Bin) MS Safety Scanner sagt was von "Trojan:Win64/Sirefef.P" (Teilweise entfernt, neustart erforderlich) "Trojan:Win64/Sirefef.AI" "Trojan:Win64/Sirefef.AK" "Trojan:Win64/Sirefef.AN" "Trojan:Win32/Sirefef!cfg" (Teilweise entfernt, neustart erforderlich) "Trojan:Win32/Sirefef.AB" (Teilweise entfernt, neustart erforderlich) "Trojan:Win32/Sirefef.AN" Avira Free Antivir fand dxmovs.exe "WORM/Phorpiex.B.128" und folgende Fehler: Zitat:
O4 - HKLM\..\Policies\Explorer\Run: [29797] c:\progra~3\dxajpxgzx.exe (schädlich 2.29/5) hatte es noch nie mit so einem hartnäckigen virus zu tun. hoffe jemand kennt sich aus.  edit: habs nun auch mit FRST64 gescannt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by Dredglol (administrator) on 24-07-2013 13:22:22
Running from C:\Users\Dredglol\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTSched.exe
() C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe
(Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CTXFISPI.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avcenter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Users\Dredglol\Downloads\msert.exe
(Trend Micro Inc.) C:\Users\Dredglol\Downloads\HiJackThis204.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer\Run: [29797] c:\progra~3\dxajpxgzx.exe [948736 2010-11-21] ( (DAMN))
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKCU\...\Run: [CreativeTaskScheduler] - C:\Program Files (x86)\Creative\Shared Files\CTSched.exe [53341 2006-11-17] (Creative Technology Ltd)
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1672616 2013-07-10] (Valve Corporation)
MountPoints2: {2530f524-ee06-11e2-851c-20cf3021426f} - E:\ME2_DE.exe
HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [676608 2013-06-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [CTxfiHlp] - CTXFIHLP.EXE [24576 2012-12-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Razer Synapse] - "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe" [610152 2013-06-21] (Razer Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
Startup: C:\Users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSI Afterburner.lnk
ShortcutTarget: MSI Afterburner.lnk -> C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9 01 mswsock.dll File Not found ()
Winsock: Catalog9 02 mswsock.dll File Not found ()
Winsock: Catalog9 03 mswsock.dll File Not found ()
Winsock: Catalog9 04 mswsock.dll File Not found ()
Winsock: Catalog9 05 mswsock.dll File Not found ()
Winsock: Catalog9 06 mswsock.dll File Not found ()
Winsock: Catalog9 07 mswsock.dll File Not found ()
Winsock: Catalog9 08 mswsock.dll File Not found ()
Winsock: Catalog9 09 mswsock.dll File Not found ()
Winsock: Catalog9 10 mswsock.dll File Not found ()
Winsock: Catalog5-x64 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9-x64 01 mswsock.dll File Not found ()
Winsock: Catalog9-x64 02 mswsock.dll File Not found ()
Winsock: Catalog9-x64 03 mswsock.dll File Not found ()
Winsock: Catalog9-x64 04 mswsock.dll File Not found ()
Winsock: Catalog9-x64 05 mswsock.dll File Not found ()
Winsock: Catalog9-x64 06 mswsock.dll File Not found ()
Winsock: Catalog9-x64 07 mswsock.dll File Not found ()
Winsock: Catalog9-x64 08 mswsock.dll File Not found ()
Winsock: Catalog9-x64 09 mswsock.dll File Not found ()
Winsock: Catalog9-x64 10 mswsock.dll File Not found ()
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Dredglol\AppData\Roaming\Mozilla\Firefox\Profiles\1wlwa6vl.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Extension: No Name - C:\Users\Dredglol\AppData\Roaming\Mozilla\Firefox\Profiles\1wlwa6vl.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-06-04] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-12-11] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [57472 2012-04-09] (Advanced Micro Devices)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-02-26] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)
S3 CYUSB; C:\Windows\System32\Drivers\CYUSB.sys [47104 2009-08-10] (Cypress Semiconductor)
S3 DAdderFltr; C:\Windows\System32\drivers\dadder.sys [12032 2010-04-19] (Razer (Asia-Pacific) Pte Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-19] (DT Soft Ltd)
S1 kkpvbxdj; C:\Windows\system32\drivers\kkpvbxdj.sys [49872 2013-07-24] (Microsoft Corporation)
R1 MpKslcfd174bc; C:\Windows\Temp\MpKslcfd174bc.sys [35664 2013-07-24] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-07-15] ()
R3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-07-15] ()
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [31232 2013-06-07] (Razer Inc)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 athr; system32\DRIVERS\athrx.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-24 13:22 - 2013-07-24 13:22 - 00000000 ____D C:\FRST
2013-07-24 13:21 - 2013-07-24 13:22 - 01779757 _____ (Farbar) C:\Users\Dredglol\Downloads\FRST64.exe
2013-07-24 12:49 - 2013-07-24 12:49 - 00049872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kkpvbxdj.sys
2013-07-24 01:57 - 2013-07-24 02:00 - 10401792 _____ C:\Users\Dredglol\Downloads\pso-pr-sample.avi
2013-07-23 06:19 - 2013-07-23 06:19 - 00013312 _____ (Loghain) C:\Users\Dredglol\Downloads\giveme2entitlements(1).exe
2013-07-23 05:03 - 2013-07-23 05:03 - 00013312 _____ (Loghain) C:\Users\Dredglol\Downloads\giveme2entitlements.exe
2013-07-23 01:10 - 2013-07-24 12:49 - 00000000 ____D C:\Windows\system32\MpEngineStore
2013-07-23 01:08 - 2013-07-23 01:08 - 00000000 ____D C:\Users\Dredglol\Downloads\backups
2013-07-23 01:06 - 2013-07-24 12:58 - 00009199 _____ C:\Users\Dredglol\Downloads\hijackthis.log
2013-07-23 01:05 - 2013-07-23 01:06 - 00388608 _____ (Trend Micro Inc.) C:\Users\Dredglol\Downloads\HiJackThis204.exe
2013-07-23 00:59 - 2013-07-23 00:59 - 00000402 _____ C:\Users\Dredglol\Desktop\Repair.bat
2013-07-23 00:56 - 2013-07-23 00:57 - 88568592 _____ (Microsoft Corporation) C:\Users\Dredglol\Downloads\msert.exe
2013-07-21 12:02 - 2013-07-21 12:02 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-21 12:02 - 2013-07-21 12:02 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-21 12:02 - 2013-07-21 12:02 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-21 12:02 - 2013-07-21 12:02 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-21 12:02 - 2013-07-21 12:02 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-21 12:02 - 2013-07-21 12:02 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-21 12:02 - 2013-07-21 12:02 - 00000000 ____D C:\Program Files\Java
2013-07-20 22:12 - 2013-07-23 04:20 - 00000000 ____D C:\Users\Dredglol\Documents\BioWare
2013-07-20 12:42 - 2013-07-15 13:33 - 15960440 _____ C:\Users\Dredglol\Desktop\MSIAfterburnerSetup300Beta11.exe
2013-07-19 19:15 - 2013-07-23 00:57 - 00000236 _____ C:\Users\Dredglol\Neues Textdokument.txt
2013-07-19 18:52 - 2013-07-19 18:52 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\LolClient
2013-07-19 17:08 - 2013-07-20 14:05 - 00000000 ____D C:\Users\Dredglol\AppData\Local\PMB Files
2013-07-19 17:08 - 2013-07-19 17:08 - 00001613 _____ C:\Users\Public\Desktop\Play League of Legends.lnk
2013-07-19 17:08 - 2013-07-19 17:08 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin
2013-07-19 17:08 - 2013-07-19 17:08 - 00000000 ____D C:\Riot Games
2013-07-19 17:08 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2013-07-19 17:08 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2013-07-19 17:08 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2013-07-19 17:07 - 2013-07-20 14:05 - 00000000 ____D C:\ProgramData\PMB Files
2013-07-19 17:07 - 2013-07-19 17:07 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Riot Games
2013-07-19 17:07 - 2013-07-19 17:07 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-18 21:32 - 2013-07-18 21:36 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\.minecraft
2013-07-18 21:31 - 2013-07-18 21:31 - 00675988 _____ C:\Users\Dredglol\Desktop\Minecraft.exe
2013-07-18 03:57 - 2013-07-23 06:25 - 00000282 _____ C:\Windows\Tasks\MSIAfterburner.job
2013-07-17 15:50 - 2013-07-17 15:50 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Malwarebytes
2013-07-17 15:49 - 2013-07-17 15:49 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-17 15:49 - 2013-07-17 15:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-17 15:49 - 2013-07-17 15:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-17 15:49 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-17 15:30 - 2013-07-17 15:30 - 00001696 _____ C:\AdwCleaner[S1].txt
2013-07-17 14:14 - 2013-07-17 14:14 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Ubisoft
2013-07-17 12:30 - 2013-07-17 19:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-17 12:30 - 2013-07-17 12:30 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-17 12:16 - 2013-07-17 12:16 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2013-07-17 12:08 - 2013-07-20 22:24 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-07-16 15:56 - 2013-07-16 15:56 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Notepad++
2013-07-16 15:56 - 2013-07-16 15:56 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
2013-07-16 15:56 - 2013-07-16 15:56 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-07-15 19:01 - 2013-07-15 19:01 - 00002106 _____ C:\Users\Public\Desktop\Path of Exile.lnk
2013-07-15 19:01 - 2013-07-15 19:01 - 00000000 ____D C:\Program Files (x86)\Grinding Gear Games
2013-07-15 12:57 - 2013-07-15 12:57 - 00000000 ____D C:\Users\Dredglol\AppData\Local\Chromium
2013-07-15 12:56 - 2013-07-23 00:24 - 00000000 ____D C:\Users\Dredglol\Documents\Rockstar Games
2013-07-15 12:56 - 2013-07-15 12:56 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2013-07-15 12:51 - 2013-07-15 12:51 - 00000000 ____D C:\ProgramData\Rockstar Games
2013-07-14 15:49 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2013-07-14 15:49 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2013-07-14 15:49 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2013-07-14 15:49 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2013-07-14 15:49 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2013-07-14 15:49 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2013-07-14 11:24 - 2013-07-14 11:24 - 00000219 _____ C:\Users\Dredglol\Desktop\Dota 2.url
2013-07-13 16:30 - 2013-07-13 16:30 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-13 16:30 - 2013-07-13 16:30 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-13 16:30 - 2013-07-13 16:30 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-13 16:30 - 2013-07-13 16:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-13 16:30 - 2013-07-13 16:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-13 16:30 - 2013-07-13 16:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-13 16:30 - 2013-07-13 16:30 - 00000000 ____D C:\ProgramData\Sun
2013-07-13 16:30 - 2013-07-13 16:30 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-13 12:17 - 2013-07-13 12:17 - 00000000 ____D C:\Users\Dredglol\AppData\Local\My Games
2013-07-13 12:17 - 2013-07-13 12:17 - 00000000 ____D C:\ProgramData\REVOLT
2013-07-13 12:11 - 2013-07-13 12:37 - 00000000 ____D C:\Program Files (x86)\Games
2013-07-12 17:50 - 2013-07-17 15:04 - 00000000 ____D C:\Windows\system32\appmgmt
2013-07-12 16:32 - 2013-07-12 16:32 - 00000000 ____D C:\Users\Dredglol\AppData\Local\SmartFTP
2013-07-12 15:09 - 2013-07-12 15:09 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\SmartFTP
2013-07-12 15:09 - 2013-07-12 15:09 - 00000000 ____D C:\Users\Dredglol\AppData\Local\SmartFTP Client 4.1 Setup
2013-07-11 13:21 - 2013-07-11 13:21 - 00000000 ____D C:\Program Files (x86)\dumps
2013-07-11 13:20 - 2013-07-24 12:30 - 00000000 ____D C:\Program Files (x86)\Steam
2013-07-11 13:20 - 2013-07-11 13:20 - 00000917 _____ C:\Users\Public\Desktop\Steam.lnk
2013-07-11 13:15 - 2013-07-11 13:15 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-07-11 02:15 - 2013-07-11 02:15 - 00387832 _____ C:\Users\Dredglol\Documents\Stapelverarbeitung.veg
2013-07-11 02:08 - 2013-07-12 16:14 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Audacity
2013-07-11 02:08 - 2013-07-11 02:08 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-07-11 02:04 - 2013-07-11 02:04 - 00004984 _____ C:\Users\Dredglol\Documents\Track 2 - 26.sfk
2013-07-11 02:03 - 2013-07-11 02:04 - 01261942 _____ C:\Users\Dredglol\Documents\Track 2 - 26.wav
2013-07-11 02:03 - 2013-07-11 02:03 - 00634986 _____ C:\Users\Dredglol\Documents\Track 2 - 25.wav
2013-07-11 02:03 - 2013-07-11 02:03 - 00002608 _____ C:\Users\Dredglol\Documents\Track 2 - 24.sfk
2013-07-11 02:03 - 2013-07-11 02:03 - 00002536 _____ C:\Users\Dredglol\Documents\Track 2 - 25.sfk
2013-07-11 01:59 - 2013-07-11 02:03 - 00654110 _____ C:\Users\Dredglol\Documents\Track 2 - 24.wav
2013-07-11 01:59 - 2013-07-11 01:59 - 00871726 _____ C:\Users\Dredglol\Documents\Track 2 - 23.wav
2013-07-11 01:59 - 2013-07-11 01:59 - 00003656 _____ C:\Users\Dredglol\Documents\Track 2 - 22.sfk
2013-07-11 01:59 - 2013-07-11 01:59 - 00003464 _____ C:\Users\Dredglol\Documents\Track 2 - 23.sfk
2013-07-11 01:58 - 2013-07-11 01:59 - 00922070 _____ C:\Users\Dredglol\Documents\Track 2 - 22.wav
2013-07-11 01:58 - 2013-07-11 01:58 - 00004920 _____ C:\Users\Dredglol\Documents\Track 2 - 21.sfk
2013-07-11 01:56 - 2013-07-11 01:58 - 01245214 _____ C:\Users\Dredglol\Documents\Track 2 - 21.wav
2013-07-11 01:56 - 2013-07-11 01:56 - 01890618 _____ C:\Users\Dredglol\Documents\Track 2 - 20.wav
2013-07-11 01:56 - 2013-07-11 01:56 - 00007440 _____ C:\Users\Dredglol\Documents\Track 2 - 20.sfk
2013-07-11 01:56 - 2013-07-11 01:56 - 00007000 _____ C:\Users\Dredglol\Documents\Track 2 - 19.sfk
2013-07-11 01:53 - 2013-07-11 01:56 - 01777526 _____ C:\Users\Dredglol\Documents\Track 2 - 19.wav
2013-07-11 01:53 - 2013-07-11 01:53 - 00002912 _____ C:\Users\Dredglol\Documents\Track 2 - 18.sfk
2013-07-11 01:52 - 2013-07-11 01:53 - 00731650 _____ C:\Users\Dredglol\Documents\Track 2 - 18.wav
2013-07-11 01:52 - 2013-07-11 01:52 - 01821362 _____ C:\Users\Dredglol\Documents\Track 2 - 17.wav
2013-07-11 01:52 - 2013-07-11 01:52 - 00007176 _____ C:\Users\Dredglol\Documents\Track 2 - 16.sfk
2013-07-11 01:52 - 2013-07-11 01:52 - 00007168 _____ C:\Users\Dredglol\Documents\Track 2 - 17.sfk
2013-07-11 01:47 - 2013-07-11 01:52 - 01823250 _____ C:\Users\Dredglol\Documents\Track 2 - 16.wav
2013-07-11 01:47 - 2013-07-11 01:47 - 00003800 _____ C:\Users\Dredglol\Documents\Track 2 - 15.sfk
2013-07-11 01:46 - 2013-07-11 01:47 - 00958394 _____ C:\Users\Dredglol\Documents\Track 2 - 15.wav
2013-07-11 01:46 - 2013-07-11 01:46 - 00003272 _____ C:\Users\Dredglol\Documents\Track 2 - 14.sfk
2013-07-11 01:43 - 2013-07-11 01:46 - 00822954 _____ C:\Users\Dredglol\Documents\Track 2 - 14.wav
2013-07-11 01:43 - 2013-07-11 01:43 - 00003856 _____ C:\Users\Dredglol\Documents\Track 2 - 13.sfk
2013-07-11 01:42 - 2013-07-11 01:43 - 00972002 _____ C:\Users\Dredglol\Documents\Track 2 - 13.wav
2013-07-11 01:42 - 2013-07-11 01:42 - 00005008 _____ C:\Users\Dredglol\Documents\Track 2 - 12.sfk
2013-07-11 01:40 - 2013-07-11 01:42 - 01268326 _____ C:\Users\Dredglol\Documents\Track 2 - 12.wav
2013-07-11 01:40 - 2013-07-11 01:40 - 00005680 _____ C:\Users\Dredglol\Documents\Track 2 - 11.sfk
2013-07-11 01:39 - 2013-07-11 01:40 - 01440038 _____ C:\Users\Dredglol\Documents\Track 2 - 11.wav
2013-07-11 01:39 - 2013-07-11 01:39 - 00004568 _____ C:\Users\Dredglol\Documents\Track 2 - 10.sfk
2013-07-11 01:38 - 2013-07-11 01:39 - 01154574 _____ C:\Users\Dredglol\Documents\Track 2 - 10.wav
2013-07-11 01:38 - 2013-07-11 01:38 - 01283462 _____ C:\Users\Dredglol\Documents\Track 2 - 9.wav
2013-07-11 01:38 - 2013-07-11 01:38 - 00006248 _____ C:\Users\Dredglol\Documents\Track 2 - 8.sfk
2013-07-11 01:38 - 2013-07-11 01:38 - 00005072 _____ C:\Users\Dredglol\Documents\Track 2 - 9.sfk
2013-07-11 01:37 - 2013-07-11 01:38 - 01585114 _____ C:\Users\Dredglol\Documents\Track 2 - 8.wav
2013-07-11 01:37 - 2013-07-11 01:37 - 00005896 _____ C:\Users\Dredglol\Documents\Track 2 - 7.sfk
2013-07-11 01:36 - 2013-07-11 01:37 - 01494226 _____ C:\Users\Dredglol\Documents\Track 2 - 7.wav
2013-07-11 01:36 - 2013-07-11 01:36 - 01216010 _____ C:\Users\Dredglol\Documents\Track 2 - 6.wav
2013-07-11 01:36 - 2013-07-11 01:36 - 00004808 _____ C:\Users\Dredglol\Documents\Track 2 - 6.sfk
2013-07-11 01:36 - 2013-07-11 01:36 - 00002496 _____ C:\Users\Dredglol\Documents\Track 2 - 5.sfk
2013-07-11 01:34 - 2013-07-11 01:36 - 00624658 _____ C:\Users\Dredglol\Documents\Track 2 - 5.wav
2013-07-11 01:34 - 2013-07-11 01:34 - 01004106 _____ C:\Users\Dredglol\Documents\Track 2 - 4.wav
2013-07-11 01:34 - 2013-07-11 01:34 - 00004600 _____ C:\Users\Dredglol\Documents\Track 2 - 3.sfk
2013-07-11 01:34 - 2013-07-11 01:34 - 00003976 _____ C:\Users\Dredglol\Documents\Track 2 - 4.sfk
2013-07-11 01:31 - 2013-07-11 01:34 - 01164114 _____ C:\Users\Dredglol\Documents\Track 2 - 3.wav
2013-07-11 01:31 - 2013-07-11 01:31 - 00002144 _____ C:\Users\Dredglol\Documents\Track 2 - 2.sfk
2013-07-11 01:30 - 2013-07-11 01:31 - 00535390 _____ C:\Users\Dredglol\Documents\Track 2 - 2.wav
2013-07-11 01:30 - 2013-07-11 01:30 - 00478590 _____ C:\Users\Dredglol\Documents\Track 2 - 1.wav
2013-07-11 01:30 - 2013-07-11 01:30 - 00001928 _____ C:\Users\Dredglol\Documents\Track 2 - 1.sfk
2013-07-11 00:59 - 2013-07-11 01:23 - 00004519 _____ C:\Users\Dredglol\AppData\Roaming\CamStudio.cfg
2013-07-11 00:59 - 2013-07-11 01:23 - 00000408 _____ C:\Users\Dredglol\AppData\Roaming\CamShapes.ini
2013-07-11 00:59 - 2013-07-11 01:23 - 00000408 _____ C:\Users\Dredglol\AppData\Roaming\CamLayout.ini
2013-07-11 00:59 - 2013-07-11 01:23 - 00000100 _____ C:\Users\Dredglol\AppData\Roaming\Camdata.ini
2013-07-11 00:56 - 2013-07-11 00:59 - 00000000 ____D C:\Program Files (x86)\CamStudio 2.7
2013-07-10 23:56 - 2013-07-12 16:21 - 00699120 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt4.veg
2013-07-10 23:56 - 2013-07-11 00:33 - 00698648 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt4.veg.bak
2013-07-10 21:41 - 2005-07-14 12:31 - 00032256 ___SH C:\Windows\SysWOW64\AVSredirect.dll
2013-07-10 21:41 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\yv12vfw.dll
2013-07-10 21:41 - 2004-01-25 00:00 - 00070656 ___SH (www.helixcommunity.org) C:\Windows\SysWOW64\i420vfw.dll
2013-07-10 21:34 - 2013-07-10 21:55 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2013-07-10 21:34 - 2013-07-10 21:34 - 00000000 ____D C:\Users\Dredglol\Documents\eRightSoft
2013-07-10 21:34 - 2004-10-10 09:50 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
2013-07-10 21:34 - 2004-07-02 17:33 - 00327749 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\drvc.dll
2013-07-10 19:18 - 2013-07-10 21:13 - 00527080 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt3.veg
2013-07-10 19:18 - 2013-07-10 20:08 - 00506728 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt3.veg.bak
2013-07-10 18:41 - 2013-07-10 18:41 - 00268936 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt2.veg
2013-07-10 16:50 - 2013-07-10 16:51 - 00015364 ____H C:\Users\Public\.DS_Store
2013-07-10 16:31 - 2013-07-10 16:31 - 02329530 _____ C:\Users\Dredglol\Documents\Track 5 - 4.wav
2013-07-10 16:31 - 2013-07-10 16:31 - 00009152 _____ C:\Users\Dredglol\Documents\Track 5 - 4.sfk
2013-07-10 16:31 - 2013-07-10 16:31 - 00008592 _____ C:\Users\Dredglol\Documents\Track 5 - 3.sfk
2013-07-10 16:30 - 2013-07-10 16:31 - 02185378 _____ C:\Users\Dredglol\Documents\Track 5 - 3.wav
2013-07-10 16:30 - 2013-07-10 16:30 - 01093546 _____ C:\Users\Dredglol\Documents\Track 5 - 1.wav
2013-07-10 16:30 - 2013-07-10 16:30 - 00578446 _____ C:\Users\Dredglol\Documents\Track 5 - 2.wav
2013-07-10 16:30 - 2013-07-10 16:30 - 00004328 _____ C:\Users\Dredglol\Documents\Track 5 - 1.sfk
2013-07-10 16:30 - 2013-07-10 16:30 - 00002312 _____ C:\Users\Dredglol\Documents\Track 5 - 2.sfk
2013-07-10 16:14 - 2013-07-10 18:35 - 00261888 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt.veg.bak
2013-07-10 16:14 - 2013-07-10 18:35 - 00261888 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt.veg
2013-07-10 15:02 - 2013-07-11 01:21 - 00000000 ____D C:\Users\Dredglol\Datentausch
2013-07-10 14:53 - 2013-07-10 14:53 - 00159512 _____ C:\Users\Dredglol\Documents\Untitled-5.psd
2013-07-10 01:37 - 2013-07-10 01:37 - 03900120 _____ C:\Users\Dredglol\Documents\whatever.psd
2013-07-10 01:37 - 2013-07-10 01:37 - 01593778 _____ C:\Users\Dredglol\Documents\crazy doc.psd
2013-07-09 15:18 - 2013-07-09 15:18 - 01091710 _____ C:\Users\Dredglol\Documents\Track 1 - 3.wav
2013-07-09 15:18 - 2013-07-09 15:18 - 00004320 _____ C:\Users\Dredglol\Documents\Track 1 - 3.sfk
2013-07-09 15:18 - 2013-07-09 15:18 - 00004200 _____ C:\Users\Dredglol\Documents\Track 1 - 2.sfk
2013-07-09 15:17 - 2013-07-09 15:18 - 01061134 _____ C:\Users\Dredglol\Documents\Track 1 - 2.wav
2013-07-09 15:17 - 2013-07-09 15:17 - 01054238 _____ C:\Users\Dredglol\Documents\Track 1 - 1.wav
2013-07-09 15:17 - 2013-07-09 15:17 - 00004176 _____ C:\Users\Dredglol\Documents\Track 1 - 1.sfk
2013-07-09 15:01 - 2013-07-09 15:01 - 11837897 _____ C:\Users\Dredglol\Documents\Untitled-2.psd
2013-07-09 15:00 - 2013-07-09 15:00 - 00189864 _____ C:\Users\Dredglol\Documents\Untitled.veg
2013-07-09 13:58 - 2013-07-09 13:58 - 11834737 _____ C:\Users\Dredglol\Documents\Untitled-1.psd
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_wachidrouter_01009.Wdf
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\WTablet
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Program Files\TabletPlugins
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Program Files\Tablet
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Program Files (x86)\TabletPlugins
2013-07-09 12:35 - 2012-12-11 13:07 - 01981312 _____ (Wacom Technology, Corp.) C:\Windows\system32\Pen_Tablet.dll
2013-07-09 12:35 - 2012-12-11 13:07 - 01974144 _____ (Wacom Technology, Corp.) C:\Windows\system32\Pen_Touch_Tablet.dll
2013-07-09 12:35 - 2012-12-11 13:07 - 01843584 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wintab32.dll
2013-07-09 12:35 - 2012-12-11 13:07 - 01840000 _____ (Wacom Technology, Corp.) C:\Windows\system32\WacomMT.dll
2013-07-09 12:35 - 2012-12-11 13:07 - 01628544 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Pen_Tablet.dll
2013-07-09 12:35 - 2012-12-11 13:07 - 01621888 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Pen_Touch_Tablet.dll
2013-07-09 12:35 - 2012-12-11 13:07 - 01509760 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wintab32.dll
2013-07-09 12:35 - 2012-12-11 13:07 - 01505664 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\WacomMT.dll
2013-07-09 12:35 - 2012-12-03 16:36 - 00081824 _____ (Wacom Technology) C:\Windows\system32\Drivers\wachidrouter.sys
2013-07-09 12:35 - 2012-12-03 16:36 - 00013728 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys
2013-07-09 12:35 - 2012-11-15 09:41 - 00015776 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys
2013-07-09 02:28 - 2013-07-10 18:19 - 00001456 _____ C:\Users\Dredglol\AppData\Local\Adobe Save for Web 13.0 Prefs
2013-07-09 02:00 - 2013-07-09 02:00 - 00000132 _____ C:\Users\Dredglol\AppData\Roaming\Adobe PNG Format CS6 Prefs
2013-07-09 01:56 - 2013-07-09 01:56 - 00000000 ____D C:\Users\Dredglol\Documents\Adobe
2013-07-09 01:47 - 2013-07-09 01:47 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2013-07-09 01:44 - 2013-07-09 01:44 - 00003514 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Dredglol-PC-Dredglol
2013-07-09 01:41 - 2013-07-09 01:45 - 00000000 ____D C:\Program Files\Adobe
2013-07-09 01:41 - 2013-07-09 01:45 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-09 01:41 - 2013-07-09 01:41 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2013-07-09 01:40 - 2013-07-09 01:41 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-07-09 01:38 - 2013-07-09 02:00 - 00000000 ____D C:\ProgramData\Adobe
2013-07-07 11:40 - 2013-07-07 11:40 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_rzudd_01009.Wdf
2013-07-07 11:40 - 2013-07-07 11:40 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_rzendpt_01009.Wdf
2013-07-07 11:31 - 2013-07-07 11:40 - 00000000 ____D C:\Program Files (x86)\Razer
2013-07-07 11:31 - 2013-07-07 11:31 - 00000000 ____D C:\Users\Dredglol\AppData\Local\Razer
2013-07-07 11:31 - 2013-07-07 11:31 - 00000000 ____D C:\ProgramData\Razer
2013-07-04 13:50 - 2013-07-04 13:50 - 00000000 ____D C:\Users\Dredglol\AppData\Local\The Witcher 2
2013-07-03 12:20 - 2013-07-04 12:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 13:15 - 2013-07-02 13:15 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-07-02 00:44 - 2013-07-02 00:44 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-07-01 15:10 - 2013-07-01 19:44 - 00000000 ____D C:\Program Files (x86)\Arab-GB
2013-06-30 13:41 - 2013-07-15 19:05 - 00000000 ____D C:\Users\Dredglol\Documents\My Games
2013-06-30 04:23 - 2013-06-30 04:23 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-06-30 00:17 - 2013-06-30 00:17 - 00000000 ____D C:\ProgramData\ZeniMax Online Studios
2013-06-29 14:08 - 2013-06-29 14:08 - 00000000 ____D C:\Users\Dredglol\Documents\CAPCOM
2013-06-29 14:08 - 2013-06-29 14:08 - 00000000 ____D C:\ProgramData\Steam
2013-06-24 13:20 - 2013-06-24 13:20 - 00768000 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevicedll.dll
2013-06-24 03:50 - 2013-06-24 03:50 - 00258048 _____ (Flo) C:\Users\Dredglol\Downloads\Vista-ShutdownTimer.exe
==================== One Month Modified Files and Folders =======
2013-07-24 13:22 - 2013-07-24 13:22 - 00000000 ____D C:\FRST
2013-07-24 13:22 - 2013-07-24 13:21 - 01779757 _____ (Farbar) C:\Users\Dredglol\Downloads\FRST64.exe
2013-07-24 12:58 - 2013-07-23 01:06 - 00009199 _____ C:\Users\Dredglol\Downloads\hijackthis.log
2013-07-24 12:49 - 2013-07-24 12:49 - 00049872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kkpvbxdj.sys
2013-07-24 12:49 - 2013-07-23 01:10 - 00000000 ____D C:\Windows\system32\MpEngineStore
2013-07-24 12:30 - 2013-07-11 13:20 - 00000000 ____D C:\Program Files (x86)\Steam
2013-07-24 11:34 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-24 11:34 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-24 11:31 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-07-24 11:31 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-07-24 11:31 - 2009-07-14 07:13 - 01612310 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-24 11:27 - 2012-12-13 11:36 - 00024227 _____ C:\Windows\setupact.log
2013-07-24 02:32 - 2013-06-19 17:15 - 00305721 _____ C:\Windows\WindowsUpdate.log
2013-07-24 02:00 - 2013-07-24 01:57 - 10401792 _____ C:\Users\Dredglol\Downloads\pso-pr-sample.avi
2013-07-23 06:25 - 2013-07-18 03:57 - 00000282 _____ C:\Windows\Tasks\MSIAfterburner.job
2013-07-23 04:43 - 2013-06-19 19:23 - 00170558 _____ C:\Windows\DirectX.log
2013-07-23 04:20 - 2013-07-20 22:12 - 00000000 ____D C:\Users\Dredglol\Documents\BioWare
2013-07-23 01:08 - 2013-07-23 01:08 - 00000000 ____D C:\Users\Dredglol\Downloads\backups
2013-07-23 01:06 - 2013-07-23 01:05 - 00388608 _____ (Trend Micro Inc.) C:\Users\Dredglol\Downloads\HiJackThis204.exe
2013-07-23 00:59 - 2013-07-23 00:59 - 00000402 _____ C:\Users\Dredglol\Desktop\Repair.bat
2013-07-23 00:57 - 2013-07-23 00:56 - 88568592 _____ (Microsoft Corporation) C:\Users\Dredglol\Downloads\msert.exe
2013-07-23 00:57 - 2013-07-19 19:15 - 00000236 _____ C:\Users\Dredglol\Neues Textdokument.txt
2013-07-23 00:53 - 2013-06-19 17:13 - 00000000 ____D C:\Users\Dredglol
2013-07-23 00:24 - 2013-07-16 15:07 - 00000000 ____D C:\Program Files (x86)\R.G. Mechanics
2013-07-23 00:24 - 2013-07-15 12:56 - 00000000 ____D C:\Users\Dredglol\Documents\Rockstar Games
2013-07-22 22:31 - 2013-06-19 19:14 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Skype
2013-07-22 05:20 - 2013-06-21 12:07 - 00001080 _____ C:\Windows\system32\settingsbkup.sfm
2013-07-22 05:20 - 2013-06-21 12:07 - 00001080 _____ C:\Windows\system32\settings.sfm
2013-07-21 17:30 - 2013-06-19 18:33 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-07-21 12:02 - 2013-07-21 12:02 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-21 12:02 - 2013-07-21 12:02 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-21 12:02 - 2013-07-21 12:02 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-21 12:02 - 2013-07-21 12:02 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-21 12:02 - 2013-07-21 12:02 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-21 12:02 - 2013-07-21 12:02 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-21 12:02 - 2013-07-21 12:02 - 00000000 ____D C:\Program Files\Java
2013-07-21 01:10 - 2010-11-21 05:47 - 00202978 _____ C:\Windows\PFRO.log
2013-07-20 22:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-20 22:24 - 2013-07-17 12:08 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-07-20 18:52 - 2013-06-19 18:05 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-20 14:05 - 2013-07-19 17:08 - 00000000 ____D C:\Users\Dredglol\AppData\Local\PMB Files
2013-07-20 14:05 - 2013-07-19 17:07 - 00000000 ____D C:\ProgramData\PMB Files
2013-07-19 18:52 - 2013-07-19 18:52 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\LolClient
2013-07-19 17:08 - 2013-07-19 17:08 - 00001613 _____ C:\Users\Public\Desktop\Play League of Legends.lnk
2013-07-19 17:08 - 2013-07-19 17:08 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin
2013-07-19 17:08 - 2013-07-19 17:08 - 00000000 ____D C:\Riot Games
2013-07-19 17:07 - 2013-07-19 17:07 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Riot Games
2013-07-19 17:07 - 2013-07-19 17:07 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-19 16:55 - 2013-06-19 19:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-07-19 16:55 - 2013-06-19 19:14 - 00000000 ____D C:\ProgramData\Skype
2013-07-19 02:19 - 2013-06-20 21:32 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\BitTorrent
2013-07-18 21:36 - 2013-07-18 21:32 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\.minecraft
2013-07-18 21:31 - 2013-07-18 21:31 - 00675988 _____ C:\Users\Dredglol\Desktop\Minecraft.exe
2013-07-17 20:51 - 2013-06-19 20:31 - 00003034 _____ C:\Windows\System32\Tasks\MSIAfterburner
2013-07-17 19:52 - 2013-07-17 12:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-17 16:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-17 15:50 - 2013-07-17 15:50 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Malwarebytes
2013-07-17 15:49 - 2013-07-17 15:49 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-17 15:49 - 2013-07-17 15:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-17 15:49 - 2013-07-17 15:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-17 15:30 - 2013-07-17 15:30 - 00001696 _____ C:\AdwCleaner[S1].txt
2013-07-17 15:04 - 2013-07-12 17:50 - 00000000 ____D C:\Windows\system32\appmgmt
2013-07-17 14:14 - 2013-07-17 14:14 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Ubisoft
2013-07-17 12:30 - 2013-07-17 12:30 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-17 12:30 - 2013-06-19 18:41 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-17 12:30 - 2013-06-19 18:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-17 12:16 - 2013-07-17 12:16 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2013-07-17 02:00 - 2013-06-19 18:40 - 00000000 ____D C:\Users\Dredglol\AppData\Local\Adobe
2013-07-16 23:07 - 2013-06-19 23:39 - 00000000 ____D C:\Program Files (x86)\MKVToolNix
2013-07-16 15:56 - 2013-07-16 15:56 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Notepad++
2013-07-16 15:56 - 2013-07-16 15:56 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
2013-07-16 15:56 - 2013-07-16 15:56 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-07-15 19:05 - 2013-06-30 13:41 - 00000000 ____D C:\Users\Dredglol\Documents\My Games
2013-07-15 19:01 - 2013-07-15 19:01 - 00002106 _____ C:\Users\Public\Desktop\Path of Exile.lnk
2013-07-15 19:01 - 2013-07-15 19:01 - 00000000 ____D C:\Program Files (x86)\Grinding Gear Games
2013-07-15 13:33 - 2013-07-20 12:42 - 15960440 _____ C:\Users\Dredglol\Desktop\MSIAfterburnerSetup300Beta11.exe
2013-07-15 12:57 - 2013-07-15 12:57 - 00000000 ____D C:\Users\Dredglol\AppData\Local\Chromium
2013-07-15 12:56 - 2013-07-15 12:56 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2013-07-15 12:51 - 2013-07-15 12:51 - 00000000 ____D C:\ProgramData\Rockstar Games
2013-07-14 11:24 - 2013-07-14 11:24 - 00000219 _____ C:\Users\Dredglol\Desktop\Dota 2.url
2013-07-14 04:17 - 2013-06-19 20:59 - 00000000 ____D C:\Users\Dredglol\Documents\Heroes of Newerth
2013-07-13 16:30 - 2013-07-13 16:30 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-13 16:30 - 2013-07-13 16:30 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-13 16:30 - 2013-07-13 16:30 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-13 16:30 - 2013-07-13 16:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-13 16:30 - 2013-07-13 16:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-13 16:30 - 2013-07-13 16:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-13 16:30 - 2013-07-13 16:30 - 00000000 ____D C:\ProgramData\Sun
2013-07-13 16:30 - 2013-07-13 16:30 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-13 12:37 - 2013-07-13 12:11 - 00000000 ____D C:\Program Files (x86)\Games
2013-07-13 12:17 - 2013-07-13 12:17 - 00000000 ____D C:\Users\Dredglol\AppData\Local\My Games
2013-07-12 16:48 - 2013-06-19 23:37 - 00000000 ____D C:\Program Files (x86)\Megui 32 Bit
2013-07-12 16:32 - 2013-07-12 16:32 - 00000000 ____D C:\Users\Dredglol\AppData\Local\SmartFTP
2013-07-12 16:21 - 2013-07-10 23:56 - 00699120 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt4.veg
2013-07-12 16:14 - 2013-07-11 02:08 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Audacity
2013-07-12 15:09 - 2013-07-12 15:09 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\SmartFTP
2013-07-12 15:09 - 2013-07-12 15:09 - 00000000 ____D C:\Users\Dredglol\AppData\Local\SmartFTP Client 4.1 Setup
2013-07-12 14:15 - 2013-06-19 20:59 - 00000000 ____D C:\Program Files (x86)\Heroes of Newerth
2013-07-11 13:21 - 2013-07-11 13:21 - 00000000 ____D C:\Program Files (x86)\dumps
2013-07-11 13:20 - 2013-07-11 13:20 - 00000917 _____ C:\Users\Public\Desktop\Steam.lnk
2013-07-11 13:15 - 2013-07-11 13:15 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-07-11 13:15 - 2013-06-19 18:30 - 00000000 ____D C:\Program Files\WinRAR-x64
2013-07-11 02:15 - 2013-07-11 02:15 - 00387832 _____ C:\Users\Dredglol\Documents\Stapelverarbeitung.veg
2013-07-11 02:08 - 2013-07-11 02:08 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-07-11 02:04 - 2013-07-11 02:04 - 00004984 _____ C:\Users\Dredglol\Documents\Track 2 - 26.sfk
2013-07-11 02:04 - 2013-07-11 02:03 - 01261942 _____ C:\Users\Dredglol\Documents\Track 2 - 26.wav
2013-07-11 02:03 - 2013-07-11 02:03 - 00634986 _____ C:\Users\Dredglol\Documents\Track 2 - 25.wav
2013-07-11 02:03 - 2013-07-11 02:03 - 00002608 _____ C:\Users\Dredglol\Documents\Track 2 - 24.sfk
2013-07-11 02:03 - 2013-07-11 02:03 - 00002536 _____ C:\Users\Dredglol\Documents\Track 2 - 25.sfk
2013-07-11 02:03 - 2013-07-11 01:59 - 00654110 _____ C:\Users\Dredglol\Documents\Track 2 - 24.wav
2013-07-11 01:59 - 2013-07-11 01:59 - 00871726 _____ C:\Users\Dredglol\Documents\Track 2 - 23.wav
2013-07-11 01:59 - 2013-07-11 01:59 - 00003656 _____ C:\Users\Dredglol\Documents\Track 2 - 22.sfk
2013-07-11 01:59 - 2013-07-11 01:59 - 00003464 _____ C:\Users\Dredglol\Documents\Track 2 - 23.sfk
2013-07-11 01:59 - 2013-07-11 01:58 - 00922070 _____ C:\Users\Dredglol\Documents\Track 2 - 22.wav
2013-07-11 01:58 - 2013-07-11 01:58 - 00004920 _____ C:\Users\Dredglol\Documents\Track 2 - 21.sfk
2013-07-11 01:58 - 2013-07-11 01:56 - 01245214 _____ C:\Users\Dredglol\Documents\Track 2 - 21.wav
2013-07-11 01:56 - 2013-07-11 01:56 - 01890618 _____ C:\Users\Dredglol\Documents\Track 2 - 20.wav
2013-07-11 01:56 - 2013-07-11 01:56 - 00007440 _____ C:\Users\Dredglol\Documents\Track 2 - 20.sfk
2013-07-11 01:56 - 2013-07-11 01:56 - 00007000 _____ C:\Users\Dredglol\Documents\Track 2 - 19.sfk
2013-07-11 01:56 - 2013-07-11 01:53 - 01777526 _____ C:\Users\Dredglol\Documents\Track 2 - 19.wav
2013-07-11 01:53 - 2013-07-11 01:53 - 00002912 _____ C:\Users\Dredglol\Documents\Track 2 - 18.sfk
2013-07-11 01:53 - 2013-07-11 01:52 - 00731650 _____ C:\Users\Dredglol\Documents\Track 2 - 18.wav
2013-07-11 01:52 - 2013-07-11 01:52 - 01821362 _____ C:\Users\Dredglol\Documents\Track 2 - 17.wav
2013-07-11 01:52 - 2013-07-11 01:52 - 00007176 _____ C:\Users\Dredglol\Documents\Track 2 - 16.sfk
2013-07-11 01:52 - 2013-07-11 01:52 - 00007168 _____ C:\Users\Dredglol\Documents\Track 2 - 17.sfk
2013-07-11 01:52 - 2013-07-11 01:47 - 01823250 _____ C:\Users\Dredglol\Documents\Track 2 - 16.wav
2013-07-11 01:47 - 2013-07-11 01:47 - 00003800 _____ C:\Users\Dredglol\Documents\Track 2 - 15.sfk
2013-07-11 01:47 - 2013-07-11 01:46 - 00958394 _____ C:\Users\Dredglol\Documents\Track 2 - 15.wav
2013-07-11 01:46 - 2013-07-11 01:46 - 00003272 _____ C:\Users\Dredglol\Documents\Track 2 - 14.sfk
2013-07-11 01:46 - 2013-07-11 01:43 - 00822954 _____ C:\Users\Dredglol\Documents\Track 2 - 14.wav
2013-07-11 01:43 - 2013-07-11 01:43 - 00003856 _____ C:\Users\Dredglol\Documents\Track 2 - 13.sfk
2013-07-11 01:43 - 2013-07-11 01:42 - 00972002 _____ C:\Users\Dredglol\Documents\Track 2 - 13.wav
2013-07-11 01:42 - 2013-07-11 01:42 - 00005008 _____ C:\Users\Dredglol\Documents\Track 2 - 12.sfk
2013-07-11 01:42 - 2013-07-11 01:40 - 01268326 _____ C:\Users\Dredglol\Documents\Track 2 - 12.wav
2013-07-11 01:40 - 2013-07-11 01:40 - 00005680 _____ C:\Users\Dredglol\Documents\Track 2 - 11.sfk
2013-07-11 01:40 - 2013-07-11 01:39 - 01440038 _____ C:\Users\Dredglol\Documents\Track 2 - 11.wav
2013-07-11 01:39 - 2013-07-11 01:39 - 00004568 _____ C:\Users\Dredglol\Documents\Track 2 - 10.sfk
2013-07-11 01:39 - 2013-07-11 01:38 - 01154574 _____ C:\Users\Dredglol\Documents\Track 2 - 10.wav
2013-07-11 01:38 - 2013-07-11 01:38 - 01283462 _____ C:\Users\Dredglol\Documents\Track 2 - 9.wav
2013-07-11 01:38 - 2013-07-11 01:38 - 00006248 _____ C:\Users\Dredglol\Documents\Track 2 - 8.sfk
2013-07-11 01:38 - 2013-07-11 01:38 - 00005072 _____ C:\Users\Dredglol\Documents\Track 2 - 9.sfk
2013-07-11 01:38 - 2013-07-11 01:37 - 01585114 _____ C:\Users\Dredglol\Documents\Track 2 - 8.wav
2013-07-11 01:37 - 2013-07-11 01:37 - 00005896 _____ C:\Users\Dredglol\Documents\Track 2 - 7.sfk
2013-07-11 01:37 - 2013-07-11 01:36 - 01494226 _____ C:\Users\Dredglol\Documents\Track 2 - 7.wav
2013-07-11 01:36 - 2013-07-11 01:36 - 01216010 _____ C:\Users\Dredglol\Documents\Track 2 - 6.wav
2013-07-11 01:36 - 2013-07-11 01:36 - 00004808 _____ C:\Users\Dredglol\Documents\Track 2 - 6.sfk
2013-07-11 01:36 - 2013-07-11 01:36 - 00002496 _____ C:\Users\Dredglol\Documents\Track 2 - 5.sfk
2013-07-11 01:36 - 2013-07-11 01:34 - 00624658 _____ C:\Users\Dredglol\Documents\Track 2 - 5.wav
2013-07-11 01:34 - 2013-07-11 01:34 - 01004106 _____ C:\Users\Dredglol\Documents\Track 2 - 4.wav
2013-07-11 01:34 - 2013-07-11 01:34 - 00004600 _____ C:\Users\Dredglol\Documents\Track 2 - 3.sfk
2013-07-11 01:34 - 2013-07-11 01:34 - 00003976 _____ C:\Users\Dredglol\Documents\Track 2 - 4.sfk
2013-07-11 01:34 - 2013-07-11 01:31 - 01164114 _____ C:\Users\Dredglol\Documents\Track 2 - 3.wav
2013-07-11 01:31 - 2013-07-11 01:31 - 00002144 _____ C:\Users\Dredglol\Documents\Track 2 - 2.sfk
2013-07-11 01:31 - 2013-07-11 01:30 - 00535390 _____ C:\Users\Dredglol\Documents\Track 2 - 2.wav
2013-07-11 01:30 - 2013-07-11 01:30 - 00478590 _____ C:\Users\Dredglol\Documents\Track 2 - 1.wav
2013-07-11 01:30 - 2013-07-11 01:30 - 00001928 _____ C:\Users\Dredglol\Documents\Track 2 - 1.sfk
2013-07-11 01:23 - 2013-07-11 00:59 - 00004519 _____ C:\Users\Dredglol\AppData\Roaming\CamStudio.cfg
2013-07-11 01:23 - 2013-07-11 00:59 - 00000408 _____ C:\Users\Dredglol\AppData\Roaming\CamShapes.ini
2013-07-11 01:23 - 2013-07-11 00:59 - 00000408 _____ C:\Users\Dredglol\AppData\Roaming\CamLayout.ini
2013-07-11 01:23 - 2013-07-11 00:59 - 00000100 _____ C:\Users\Dredglol\AppData\Roaming\Camdata.ini
2013-07-11 01:21 - 2013-07-10 15:02 - 00000000 ____D C:\Users\Dredglol\Datentausch
2013-07-11 00:59 - 2013-07-11 00:56 - 00000000 ____D C:\Program Files (x86)\CamStudio 2.7
2013-07-11 00:33 - 2013-07-10 23:56 - 00698648 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt4.veg.bak
2013-07-10 21:55 - 2013-07-10 21:34 - 00000000 ____D C:\Program Files (x86)\eRightSoft
2013-07-10 21:34 - 2013-07-10 21:34 - 00000000 ____D C:\Users\Dredglol\Documents\eRightSoft
2013-07-10 21:13 - 2013-07-10 19:18 - 00527080 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt3.veg
2013-07-10 20:08 - 2013-07-10 19:18 - 00506728 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt3.veg.bak
2013-07-10 18:41 - 2013-07-10 18:41 - 00268936 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt2.veg
2013-07-10 18:35 - 2013-07-10 16:14 - 00261888 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt.veg.bak
2013-07-10 18:35 - 2013-07-10 16:14 - 00261888 _____ C:\Users\Dredglol\Documents\GhettoFinalProjekt.veg
2013-07-10 18:19 - 2013-07-09 02:28 - 00001456 _____ C:\Users\Dredglol\AppData\Local\Adobe Save for Web 13.0 Prefs
2013-07-10 18:12 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-07-10 16:51 - 2013-07-10 16:50 - 00015364 ____H C:\Users\Public\.DS_Store
2013-07-10 16:31 - 2013-07-10 16:31 - 02329530 _____ C:\Users\Dredglol\Documents\Track 5 - 4.wav
2013-07-10 16:31 - 2013-07-10 16:31 - 00009152 _____ C:\Users\Dredglol\Documents\Track 5 - 4.sfk
2013-07-10 16:31 - 2013-07-10 16:31 - 00008592 _____ C:\Users\Dredglol\Documents\Track 5 - 3.sfk
2013-07-10 16:31 - 2013-07-10 16:30 - 02185378 _____ C:\Users\Dredglol\Documents\Track 5 - 3.wav
2013-07-10 16:30 - 2013-07-10 16:30 - 01093546 _____ C:\Users\Dredglol\Documents\Track 5 - 1.wav
2013-07-10 16:30 - 2013-07-10 16:30 - 00578446 _____ C:\Users\Dredglol\Documents\Track 5 - 2.wav
2013-07-10 16:30 - 2013-07-10 16:30 - 00004328 _____ C:\Users\Dredglol\Documents\Track 5 - 1.sfk
2013-07-10 16:30 - 2013-07-10 16:30 - 00002312 _____ C:\Users\Dredglol\Documents\Track 5 - 2.sfk
2013-07-10 14:53 - 2013-07-10 14:53 - 00159512 _____ C:\Users\Dredglol\Documents\Untitled-5.psd
2013-07-10 01:37 - 2013-07-10 01:37 - 03900120 _____ C:\Users\Dredglol\Documents\whatever.psd
2013-07-10 01:37 - 2013-07-10 01:37 - 01593778 _____ C:\Users\Dredglol\Documents\crazy doc.psd
2013-07-09 15:18 - 2013-07-09 15:18 - 01091710 _____ C:\Users\Dredglol\Documents\Track 1 - 3.wav
2013-07-09 15:18 - 2013-07-09 15:18 - 00004320 _____ C:\Users\Dredglol\Documents\Track 1 - 3.sfk
2013-07-09 15:18 - 2013-07-09 15:18 - 00004200 _____ C:\Users\Dredglol\Documents\Track 1 - 2.sfk
2013-07-09 15:18 - 2013-07-09 15:17 - 01061134 _____ C:\Users\Dredglol\Documents\Track 1 - 2.wav
2013-07-09 15:17 - 2013-07-09 15:17 - 01054238 _____ C:\Users\Dredglol\Documents\Track 1 - 1.wav
2013-07-09 15:17 - 2013-07-09 15:17 - 00004176 _____ C:\Users\Dredglol\Documents\Track 1 - 1.sfk
2013-07-09 15:01 - 2013-07-09 15:01 - 11837897 _____ C:\Users\Dredglol\Documents\Untitled-2.psd
2013-07-09 15:00 - 2013-07-09 15:00 - 00189864 _____ C:\Users\Dredglol\Documents\Untitled.veg
2013-07-09 13:58 - 2013-07-09 13:58 - 11834737 _____ C:\Users\Dredglol\Documents\Untitled-1.psd
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_wachidrouter_01009.Wdf
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\WTablet
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Program Files\TabletPlugins
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Program Files\Tablet
2013-07-09 12:35 - 2013-07-09 12:35 - 00000000 ____D C:\Program Files (x86)\TabletPlugins
2013-07-09 11:09 - 2009-07-14 06:45 - 04914048 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-09 02:27 - 2013-06-19 18:41 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Adobe
2013-07-09 02:00 - 2013-07-09 02:00 - 00000132 _____ C:\Users\Dredglol\AppData\Roaming\Adobe PNG Format CS6 Prefs
2013-07-09 02:00 - 2013-07-09 01:38 - 00000000 ____D C:\ProgramData\Adobe
2013-07-09 01:59 - 2013-06-19 19:24 - 00000000 ____D C:\Program Files\MPC-HC
2013-07-09 01:56 - 2013-07-09 01:56 - 00000000 ____D C:\Users\Dredglol\Documents\Adobe
2013-07-09 01:47 - 2013-07-09 01:47 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2013-07-09 01:45 - 2013-07-09 01:41 - 00000000 ____D C:\Program Files\Adobe
2013-07-09 01:45 - 2013-07-09 01:41 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-09 01:44 - 2013-07-09 01:44 - 00003514 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-Dredglol-PC-Dredglol
2013-07-09 01:43 - 2013-06-19 18:10 - 00058464 _____ C:\Users\Dredglol\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-09 01:41 - 2013-07-09 01:41 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2013-07-09 01:41 - 2013-07-09 01:40 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-07-07 11:40 - 2013-07-07 11:40 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_rzudd_01009.Wdf
2013-07-07 11:40 - 2013-07-07 11:40 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_rzendpt_01009.Wdf
2013-07-07 11:40 - 2013-07-07 11:31 - 00000000 ____D C:\Program Files (x86)\Razer
2013-07-07 11:40 - 2013-06-19 18:55 - 00092290 _____ C:\Windows\DPINST.LOG
2013-07-07 11:31 - 2013-07-07 11:31 - 00000000 ____D C:\Users\Dredglol\AppData\Local\Razer
2013-07-07 11:31 - 2013-07-07 11:31 - 00000000 ____D C:\ProgramData\Razer
2013-07-05 12:22 - 2013-06-19 18:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-04 13:50 - 2013-07-04 13:50 - 00000000 ____D C:\Users\Dredglol\AppData\Local\The Witcher 2
2013-07-04 12:54 - 2013-07-03 12:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 13:15 - 2013-07-02 13:15 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-07-02 00:44 - 2013-07-02 00:44 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-07-01 19:44 - 2013-07-01 15:10 - 00000000 ____D C:\Program Files (x86)\Arab-GB
2013-07-01 15:20 - 2013-06-19 19:21 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-07-01 15:09 - 2013-06-19 18:14 - 00000000 ____D C:\Users\Dredglol\AppData\Roaming\DAEMON Tools Lite
2013-06-30 04:23 - 2013-06-30 04:23 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-06-30 00:17 - 2013-06-30 00:17 - 00000000 ____D C:\ProgramData\ZeniMax Online Studios
2013-06-29 14:08 - 2013-06-29 14:08 - 00000000 ____D C:\Users\Dredglol\Documents\CAPCOM
2013-06-29 14:08 - 2013-06-29 14:08 - 00000000 ____D C:\ProgramData\Steam
2013-06-26 12:11 - 2013-06-19 20:21 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-06-24 13:20 - 2013-06-24 13:20 - 00768000 _____ (Razer Inc) C:\Windows\SysWOW64\rzdevicedll.dll
2013-06-24 03:50 - 2013-06-24 03:50 - 00258048 _____ (Flo) C:\Users\Dredglol\Downloads\Vista-ShutdownTimer.exe
ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini
ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3313348296-2172988495-2078389442-1001\$d2944aef0cd029843f072ca6c1a3ac3f
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$d2944aef0cd029843f072ca6c1a3ac3f
Files to move or delete:
====================
C:\ProgramData\dxajpxgzx.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-15 05:37
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2013 Ran by Dredglol at 2013-07-24 13:22:38 Running from C:\Users\Dredglol\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Photoshop CS6 (x32 Version: 13.0) AMD Accelerated Video Transcoding (Version: 13.10.100.30604) AMD Catalyst Control Center (x32 Version: 2013.0604.1838.31590) AMD Catalyst Install Manager (Version: 8.0.915.0) AMD Drag and Drop Transcoding (Version: 2.00.0000) AMD Fuel (Version: 2013.0604.1838.31590) AMD Media Foundation Decoders (Version: 1.0.80604.1838) AMD Steady Video Plug-In (Version: 2.06.0000) AMD Wireless Display v3.0 (Version: 1.0.0.12) Application Profiles (x32 Version: 2.0.4888.34279) Audacity 2.0.3 (x32 Version: 2.0.3) Avira Free Antivirus (x32 Version: 13.0.0.3884) AviSynth 2.5 (x32) BitTorrent (x32 Version: 7.8.0.29676) CamStudio Lossless Codec v1.5 (x32 Version: 1.5) CamStudio version 2.7 (x32 Version: 2.7) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0604.1838.31590) Catalyst Control Center InstallProxy (x32 Version: 2013.0604.1838.31590) Catalyst Control Center Localization All (x32 Version: 2013.0604.1838.31590) CCC Help Chinese Standard (x32 Version: 2013.0604.1837.31590) CCC Help Chinese Traditional (x32 Version: 2013.0604.1837.31590) CCC Help Czech (x32 Version: 2013.0604.1837.31590) CCC Help Danish (x32 Version: 2013.0604.1837.31590) CCC Help Dutch (x32 Version: 2013.0604.1837.31590) CCC Help English (x32 Version: 2013.0604.1837.31590) CCC Help Finnish (x32 Version: 2013.0604.1837.31590) CCC Help French (x32 Version: 2013.0604.1837.31590) CCC Help German (x32 Version: 2013.0604.1837.31590) CCC Help Greek (x32 Version: 2013.0604.1837.31590) CCC Help Hungarian (x32 Version: 2013.0604.1837.31590) CCC Help Italian (x32 Version: 2013.0604.1837.31590) CCC Help Japanese (x32 Version: 2013.0604.1837.31590) CCC Help Korean (x32 Version: 2013.0604.1837.31590) CCC Help Norwegian (x32 Version: 2013.0604.1837.31590) CCC Help Polish (x32 Version: 2013.0604.1837.31590) CCC Help Portuguese (x32 Version: 2013.0604.1837.31590) CCC Help Russian (x32 Version: 2013.0604.1837.31590) CCC Help Spanish (x32 Version: 2013.0604.1837.31590) CCC Help Swedish (x32 Version: 2013.0604.1837.31590) CCC Help Thai (x32 Version: 2013.0604.1837.31590) CCC Help Turkish (x32 Version: 2013.0604.1837.31590) ccc-utility64 (Version: 2013.0604.1838.31590) Core Temp 1.0 RC5 (Version: 1.0) Creative Audio-Systemsteuerung (x32 Version: 3.00) Creative Software AutoUpdate (x32 Version: 1.41) Creative Sound Blaster Properties x64 Edition (x32 Version: 1.03) DAEMON Tools Lite (x32 Version: 4.47.1.0333) DebugMode FrameServer (x32) Dota 2 (x32) Fraps (remove only) (x32) Heroes of Newerth (x32 Version: 2.3.0) IrfanView (remove only) (x32 Version: 4.35) Java 7 Update 25 (64-bit) (Version: 7.0.250) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) League of Legends (x32 Version: 3.0.1) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Marvell Miniport Driver (x32 Version: 11.24.10.3) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727) Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727) Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727) Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000) MKVToolNix 6.2.0 (x32 Version: 6.2.0) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MPC-HC 1.6.8 (64-bit) (Version: 1.6.8.7417) MSI Afterburner 3.0.0 Beta 11 (x32 Version: 3.0.0 Beta 11) MSVCRT Redists (Version: 1.0) Notepad++ (x32 Version: 6.4.2) NVIDIA PhysX (x32 Version: 9.12.0213) Pando Media Booster (x32 Version: 2.6.0.7) Path of Exile (x32 Version: 0.11.1.25969) PDF Settings CS6 (x32 Version: 11.0) Razer Synapse 2.0 (x32 Version: 1.11.3) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.4.0) Rockstar Games Social Club (x32 Version: 1.1.0.1) rosoft .NET Framework 4 Client Profile (Version: 4.0.30319) Skype™ 6.6 (x32 Version: 6.6.106) Steam (x32 Version: 1.0.0.0) Ubisoft Game Launcher (x32 Version: 1.0.0.0) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Vegas Pro 12.0 (64-bit) (Version: 12.0.563) Wacom (Version: 5.3.2-1) WebTablet FB Plugin 32 bit (x32 Version: 2.1.0.2) WebTablet FB Plugin 64 bit (Version: 2.1.0.2) Winamp (x32 Version: 5.64 ) Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1) ==================== Restore Points ========================= 22-07-2013 22:49:29 DirectX wurde installiert 23-07-2013 02:42:49 DirectX wurde installiert 24-07-2013 10:31:35 Removed Java 7 Update 25 ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {29DB5D10-F9E3-4D95-8078-415F12A29554} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-17] (Adobe Systems Incorporated) Task: {82F72F25-6090-4E9B-A502-4F3206920261} - System32\Tasks\AdobeAAMUpdater-1.0-Dredglol-PC-Dredglol => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated) Task: {AE8F4FC4-47BA-4BBD-A7AB-97BB5BF3B702} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe [2013-07-15] () Task: {C6B018DD-45D1-4EA5-982F-4C6280ACE431} - System32\Tasks\{D0C0DD2C-599C-4940-B643-997C49BF522B} => c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03] (Mozilla Corporation) Task: {ED955356-A149-4303-A34A-E44F86FFB81E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\MSIAfterburner.job => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/24/2013 11:29:29 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (07/23/2013 01:24:34 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (07/23/2013 01:13:33 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (07/23/2013 00:52:18 AM) (Source: Application Hang) (User: ) Description: Programm avscan.exe, Version 13.6.0.1722 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 6c0 Startzeit: 01ce872aa42aaa0a Endzeit: 60000 Anwendungspfad: C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe Berichts-ID: 31f04275-f321-11e2-8a70-20cf3021426f Error: (07/23/2013 00:24:13 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (07/22/2013 00:37:25 PM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (07/21/2013 11:53:50 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. Error: (07/21/2013 01:25:59 AM) (Source: Microsoft-Windows-WMI) (User: NT-AUTORITÄT) Description: Der Ereignisfilter mit der Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" aufgrund des Fehlers "0x80041003" nicht reaktiviert werden. Solange dieses Problem besteht, können mit diesem Filter keine Ereignisse übermittelt werden. System errors: ============= Error: (07/24/2013 11:36:04 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2147024891 Error: (07/24/2013 11:36:04 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: %%-2147024891 Error: (07/24/2013 11:27:45 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060 Error: (07/24/2013 11:27:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert. Error: (07/24/2013 11:27:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert. Error: (07/23/2013 00:22:38 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: %%-2147024891 Error: (07/23/2013 00:22:38 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2147024891 Error: (07/23/2013 00:22:26 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert. Error: (07/23/2013 00:22:26 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert. Error: (07/23/2013 00:22:25 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060 Microsoft Office Sessions: ========================= Error: (07/24/2013 11:29:29 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/23/2013 01:24:34 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/23/2013 01:13:33 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/23/2013 00:52:18 AM) (Source: Application Hang)(User: ) Description: avscan.exe13.6.0.17226c001ce872aa42aaa0a60000C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe31f04275-f321-11e2-8a70-20cf3021426f Error: (07/23/2013 00:24:13 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/22/2013 00:37:25 PM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/21/2013 11:53:50 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/21/2013 01:25:59 AM) (Source: Microsoft-Windows-WMI)(User: NT-AUTORITÄT) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2012-12-13 10:29:15.841 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 10:23:12.616 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 10:23:12.257 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 10:23:12.148 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 10:23:12.023 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 10:20:10.908 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 10:15:21.549 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 10:03:42.638 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 08:48:30.951 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2012-12-13 08:33:55.490 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\DisplaySwitch.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 33% Total physical RAM: 8174.11 MB Available physical RAM: 5415.03 MB Total Pagefile: 16346.42 MB Available Pagefile: 13199.32 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:119.14 GB) (Free:30.58 GB) NTFS (Disk=0 Partition=2) Drive d: () (Fixed) (Total:931.51 GB) (Free:905.16 GB) NTFS (Disk=1 Partition=1) Drive f: (USB20FD) (Removable) (Total:30.23 GB) (Free:29.22 GB) NTFS (Disk=2 Partition=1) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: 106B4964) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=119 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 106B4979) Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (MBR Code: Windows XP) (Size: 30 GB) (Disk ID: C3072E18) Partition 1: (Active) - (Size=30 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Geändert von causese1990 (24.07.2013 um 12:48 Uhr) |
|
24.07.2013, 12:47
| #2 |
| /// TB-Ausbilder   |  Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Hallo,
__________________schauen wir rein: Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
24.07.2013, 12:50
| #3 |
| | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) habs eben reineditiert^^
__________________ |
|
24.07.2013, 12:54
| #4 |
| /// TB-Ausbilder | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Ok. Scan mit Combofix
__________________ cheers, Leo |
|
24.07.2013, 13:09
| #5 |
| | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Bitteschön: Code:
ATTFilter ComboFix 13-07-24.02 - Dredglol 24.07.2013 13:58:45.1.8 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.8174.5694 [GMT 2:00]
ausgeführt von:: c:\users\Dredglol\Downloads\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\$recycle.bin\S-1-5-21-3313348296-2172988495-2078389442-1001\$d2944aef0cd029843f072ca6c1a3ac3f\@
c:\$recycle.bin\S-1-5-21-3313348296-2172988495-2078389442-1001\$d2944aef0cd029843f072ca6c1a3ac3f\n
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\SysWow64\frapsvid.dll
D:\install.exe
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Run
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-24 bis 2013-07-24 ))))))))))))))))))))))))))))))
.
.
2013-07-24 11:22 . 2013-07-24 11:22 -------- d-----w- C:\FRST
2013-07-22 23:10 . 2013-07-24 10:49 -------- d-----w- c:\windows\system32\MpEngineStore
2013-07-21 10:02 . 2013-07-21 10:02 972712 ----a-w- c:\windows\system32\deployJava1.dll
2013-07-21 10:02 . 2013-07-21 10:02 312232 ----a-w- c:\windows\system32\javaws.exe
2013-07-21 10:02 . 2013-07-21 10:02 1093032 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-07-21 10:02 . 2013-07-21 10:02 189352 ----a-w- c:\windows\system32\javaw.exe
2013-07-21 10:02 . 2013-07-21 10:02 188840 ----a-w- c:\windows\system32\java.exe
2013-07-21 10:02 . 2013-07-21 10:02 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-07-21 10:02 . 2013-07-21 10:02 -------- d-----w- c:\program files\Java
2013-07-19 16:52 . 2013-07-19 16:52 -------- d-----w- c:\users\Dredglol\AppData\Roaming\LolClient
2013-07-19 15:08 . 2008-07-12 06:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll
2013-07-19 15:08 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2013-07-19 15:08 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll
2013-07-19 15:08 . 2013-07-19 15:08 -------- d-sh--w- c:\windows\SysWow64\AI_RecycleBin
2013-07-19 15:08 . 2013-07-19 15:08 -------- d-----w- C:\Riot Games
2013-07-19 15:08 . 2013-07-20 12:05 -------- d-----w- c:\users\Dredglol\AppData\Local\PMB Files
2013-07-19 15:07 . 2013-07-20 12:05 -------- d-----w- c:\programdata\PMB Files
2013-07-19 15:07 . 2013-07-19 15:07 -------- d-----w- c:\program files (x86)\Pando Networks
2013-07-19 15:07 . 2013-07-19 15:07 -------- d-----w- c:\users\Dredglol\AppData\Roaming\Riot Games
2013-07-18 19:32 . 2013-07-18 19:36 -------- d-----w- c:\users\Dredglol\AppData\Roaming\.minecraft
2013-07-17 13:50 . 2013-07-17 13:50 -------- d-----w- c:\users\Dredglol\AppData\Roaming\Malwarebytes
2013-07-17 13:49 . 2013-07-17 13:49 -------- d-----w- c:\programdata\Malwarebytes
2013-07-17 13:49 . 2013-07-17 13:49 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-17 13:49 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-17 12:14 . 2013-07-17 12:14 -------- d-----w- c:\users\Dredglol\AppData\Roaming\Ubisoft
2013-07-17 10:16 . 2013-07-17 10:16 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
2013-07-17 10:08 . 2013-07-20 20:24 -------- d-----w- c:\program files (x86)\Ubisoft
2013-07-16 14:00 . 2013-07-22 22:24 -------- d-----w- c:\programdata\RELOADED
2013-07-16 13:56 . 2013-07-16 13:56 -------- d-----w- c:\users\Dredglol\AppData\Roaming\Notepad++
2013-07-16 13:56 . 2013-07-16 13:56 -------- d-----w- c:\program files (x86)\Notepad++
2013-07-15 17:01 . 2013-07-15 17:01 -------- d-----w- c:\program files (x86)\Grinding Gear Games
2013-07-15 10:57 . 2013-07-15 10:57 -------- d-----w- c:\users\Dredglol\AppData\Local\Chromium
2013-07-15 10:56 . 2013-07-15 10:56 -------- d-----w- c:\program files (x86)\Rockstar Games
2013-07-15 10:51 . 2013-07-15 10:51 -------- d-----w- c:\programdata\Rockstar Games
2013-07-14 13:49 . 2008-10-15 04:22 519000 ----a-w- c:\windows\system32\d3dx10_40.dll
2013-07-14 13:49 . 2008-10-15 04:22 452440 ----a-w- c:\windows\SysWow64\d3dx10_40.dll
2013-07-14 13:49 . 2008-10-15 04:22 2605920 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2013-07-14 13:49 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\SysWow64\D3DCompiler_40.dll
2013-07-14 13:49 . 2008-10-15 04:22 5631312 ----a-w- c:\windows\system32\D3DX9_40.dll
2013-07-14 13:49 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\SysWow64\D3DX9_40.dll
2013-07-13 14:30 . 2013-07-13 14:30 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-07-13 14:30 . 2013-07-13 14:30 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-07-13 14:30 . 2013-07-13 14:30 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-07-13 14:30 . 2013-07-13 14:30 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-13 14:30 . 2013-07-13 14:30 -------- d-----w- c:\program files (x86)\Java
2013-07-13 10:17 . 2013-07-13 10:17 -------- d-----w- c:\users\Dredglol\AppData\Local\My Games
2013-07-13 10:17 . 2013-07-13 10:17 -------- d-----w- c:\programdata\REVOLT
2013-07-13 10:11 . 2013-07-13 10:37 -------- d-----w- c:\program files (x86)\Games
2013-07-12 15:50 . 2013-07-17 13:04 -------- d-----w- c:\windows\system32\appmgmt
2013-07-12 14:32 . 2013-07-12 14:32 -------- d-----w- c:\users\Dredglol\AppData\Local\SmartFTP
2013-07-12 13:09 . 2013-07-12 13:09 -------- d-----w- c:\users\Dredglol\AppData\Roaming\SmartFTP
2013-07-12 13:09 . 2013-07-12 13:09 -------- d-----w- c:\users\Dredglol\AppData\Local\SmartFTP Client 4.1 Setup
2013-07-11 11:21 . 2013-07-11 11:21 -------- d-----w- c:\program files (x86)\dumps
2013-07-11 11:20 . 2013-07-24 12:03 -------- d-----w- c:\program files (x86)\Steam
2013-07-11 11:20 . 2013-07-11 11:20 -------- d-----w- c:\program files (x86)\Common Files\Steam
2013-07-11 00:08 . 2013-07-12 14:14 -------- d-----w- c:\users\Dredglol\AppData\Roaming\Audacity
2013-07-11 00:08 . 2013-07-11 00:08 -------- d-----w- c:\program files (x86)\Audacity
2013-07-10 22:56 . 2013-07-10 22:59 -------- d-----w- c:\program files (x86)\CamStudio 2.7
2013-07-10 19:41 . 2005-07-14 10:31 32256 --sh--w- c:\windows\SysWow64\AVSredirect.dll
2013-07-10 19:41 . 2004-01-24 22:00 70656 --sh--w- c:\windows\SysWow64\yv12vfw.dll
2013-07-10 19:41 . 2004-01-24 22:00 70656 --sh--w- c:\windows\SysWow64\i420vfw.dll
2013-07-10 19:34 . 2004-07-02 15:33 327749 ----a-w- c:\windows\SysWow64\drvc.dll
2013-07-10 19:34 . 2013-07-10 19:55 -------- d-----w- c:\program files (x86)\eRightSoft
2013-07-10 13:02 . 2013-07-10 23:21 -------- d-----w- c:\users\Dredglol\Datentausch
2013-07-08 23:47 . 2013-07-08 23:47 -------- d-----w- c:\users\Dredglol\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2013-07-08 23:41 . 2013-07-08 23:41 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2013-07-08 23:41 . 2013-07-08 23:45 -------- d-----w- c:\program files\Adobe
2013-07-08 23:40 . 2013-07-08 23:41 -------- d-----w- c:\program files\Common Files\Adobe
2013-07-08 23:38 . 2013-07-08 23:41 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2013-07-07 09:31 . 2013-07-07 09:31 -------- d-----w- c:\users\Dredglol\AppData\Local\Razer
2013-07-07 09:31 . 2013-07-07 09:40 -------- d-----w- c:\program files (x86)\Razer
2013-07-07 09:31 . 2013-07-07 09:31 -------- d-----w- c:\programdata\Razer
2013-07-04 11:50 . 2013-07-04 11:50 -------- d-----w- c:\users\Dredglol\AppData\Local\The Witcher 2
2013-07-02 00:45 . 2000-10-05 13:55 77824 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2013-07-02 00:45 . 2000-10-05 13:55 221184 ----a-w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2013-07-02 00:45 . 2000-10-05 13:50 221184 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2013-07-02 00:45 . 2000-10-05 13:49 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2013-07-01 13:10 . 2013-07-01 17:44 -------- d-----w- c:\program files (x86)\Arab-GB
2013-06-30 02:23 . 2013-06-30 02:23 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
2013-06-29 22:17 . 2013-06-29 22:17 -------- d-----w- c:\programdata\ZeniMax Online Studios
2013-06-29 12:08 . 2013-06-29 12:08 -------- d-----w- c:\programdata\Steam
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-17 10:30 . 2013-06-19 16:41 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-17 10:30 . 2013-06-19 16:41 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-26 10:11 . 2013-06-19 18:21 83672 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-06-24 11:20 . 2013-06-24 11:20 768000 ----a-w- c:\windows\SysWow64\rzdevicedll.dll
2013-06-19 16:14 . 2013-06-19 16:14 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-06-17 06:43 . 2013-06-17 06:43 56832 ----a-w- c:\windows\SysWow64\rzdevinfo.dll
2013-06-17 06:43 . 2013-06-17 06:43 154112 ----a-w- c:\windows\SysWow64\rztouchdll.dll
2013-06-17 06:43 . 2013-06-17 06:43 117248 ----a-w- c:\windows\SysWow64\rzdisplaydll.dll
2013-06-17 06:43 . 2013-06-17 06:43 296448 ----a-w- c:\windows\SysWow64\rzaudiodll.dll
2013-06-07 03:29 . 2013-06-07 03:29 126464 ----a-w- c:\windows\system32\drivers\rzudd.sys
2013-06-07 03:29 . 2013-06-07 03:29 31232 ----a-w- c:\windows\system32\drivers\rzendpt.sys
2013-06-04 23:12 . 2013-06-19 14:27 78432 ----a-w- c:\windows\system32\atimpc64.dll
2013-06-04 23:12 . 2013-06-19 14:27 78432 ----a-w- c:\windows\system32\amdpcom64.dll
2013-06-04 23:12 . 2013-06-19 14:27 71704 ----a-w- c:\windows\SysWow64\atimpc32.dll
2013-06-04 23:12 . 2013-06-19 14:27 71704 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2013-06-04 23:12 . 2013-06-19 14:27 139696 ----a-w- c:\windows\system32\atiuxp64.dll
2013-06-04 23:12 . 2013-06-19 14:27 123216 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2013-06-04 23:12 . 2013-06-19 14:27 97448 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2013-06-04 23:12 . 2013-06-19 14:27 113464 ----a-w- c:\windows\system32\atiu9p64.dll
2013-06-04 23:11 . 2013-06-19 14:27 1182056 ----a-w- c:\windows\system32\aticfx64.dll
2013-06-04 23:11 . 2013-06-19 14:27 990976 ----a-w- c:\windows\SysWow64\aticfx32.dll
2013-06-04 23:11 . 2013-06-19 14:27 8431232 ----a-w- c:\windows\system32\atidxx64.dll
2013-06-04 23:11 . 2013-06-19 14:27 7378560 ----a-w- c:\windows\SysWow64\atidxx32.dll
2013-06-04 23:11 . 2013-06-19 14:27 4415256 ----a-w- c:\windows\SysWow64\atiumdva.dll
2013-06-04 23:11 . 2013-06-19 14:27 5963328 ----a-w- c:\windows\SysWow64\atiumdag.dll
2013-06-04 23:11 . 2013-06-19 14:27 4957536 ----a-w- c:\windows\system32\atiumd6a.dll
2013-06-04 23:11 . 2013-06-19 14:27 6984088 ----a-w- c:\windows\system32\atiumd64.dll
2013-06-04 23:09 . 2013-06-19 14:27 11833856 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2013-06-04 22:51 . 2013-06-19 14:27 229376 ----a-w- c:\windows\system32\clinfo.exe
2013-06-04 22:51 . 2013-06-19 14:27 1187342 ----a-w- c:\windows\system32\amdocl_as64.exe
2013-06-04 22:51 . 2013-06-19 14:27 1061902 ----a-w- c:\windows\system32\amdocl_ld64.exe
2013-06-04 22:51 . 2013-06-19 14:27 995342 ----a-w- c:\windows\SysWow64\amdocl_as32.exe
2013-06-04 22:51 . 2013-06-19 14:27 798734 ----a-w- c:\windows\SysWow64\amdocl_ld32.exe
2013-06-04 22:51 . 2013-06-19 14:27 98304 ----a-w- c:\windows\system32\OpenVideo64.dll
2013-06-04 22:50 . 2013-06-19 14:27 82944 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2013-06-04 22:50 . 2013-06-19 14:27 86016 ----a-w- c:\windows\system32\OVDecode64.dll
2013-06-04 22:50 . 2013-06-19 14:27 72704 ----a-w- c:\windows\SysWow64\OVDecode.dll
2013-06-04 22:50 . 2013-06-19 14:27 27800576 ----a-w- c:\windows\system32\amdocl64.dll
2013-06-04 22:48 . 2013-06-19 14:27 23421440 ----a-w- c:\windows\SysWow64\amdocl.dll
2013-06-04 22:46 . 2013-06-19 14:27 63488 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-04 22:46 . 2013-06-19 14:27 57344 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-06-04 22:33 . 2013-06-19 14:27 24250880 ----a-w- c:\windows\system32\atio6axx.dll
2013-06-04 22:27 . 2013-06-19 14:27 368640 ----a-w- c:\windows\system32\atiapfxx.exe
2013-06-04 22:25 . 2013-06-19 14:27 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2013-06-04 22:25 . 2013-06-19 14:27 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2013-06-04 22:25 . 2013-06-19 14:27 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2013-06-04 22:25 . 2013-06-19 14:27 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2013-06-04 22:25 . 2013-06-19 14:27 118784 ----a-w- c:\windows\system32\coinst_13.101.dll
2013-06-04 22:24 . 2013-06-19 14:27 16082944 ----a-w- c:\windows\system32\aticaldd64.dll
2013-06-04 22:20 . 2013-06-19 14:27 13703168 ----a-w- c:\windows\SysWow64\aticaldd.dll
2013-06-04 22:13 . 2013-06-19 14:27 19906560 ----a-w- c:\windows\SysWow64\atioglxx.dll
2013-06-04 22:03 . 2013-06-19 14:27 442368 ----a-w- c:\windows\system32\atidemgy.dll
2013-06-04 22:03 . 2013-06-19 14:27 26112 ----a-w- c:\windows\system32\atimuixx.dll
2013-06-04 22:03 . 2013-06-19 14:27 562688 ----a-w- c:\windows\system32\atieclxx.exe
2013-06-04 22:02 . 2013-06-19 14:27 241152 ----a-w- c:\windows\system32\atiesrxx.exe
2013-06-04 22:00 . 2013-06-19 14:27 120320 ----a-w- c:\windows\system32\atitmm64.dll
2013-06-04 22:00 . 2013-06-19 14:27 59392 ----a-w- c:\windows\system32\atiedu64.dll
2013-06-04 22:00 . 2013-06-19 14:27 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2013-06-04 21:36 . 2013-06-19 14:27 95232 ----a-w- c:\windows\system32\amdave64.dll
2013-06-04 21:35 . 2013-06-19 14:27 594944 ----a-w- c:\windows\system32\atiadlxx.dll
2013-06-04 21:35 . 2013-06-19 14:27 89600 ----a-w- c:\windows\SysWow64\amdave32.dll
2013-06-04 21:35 . 2013-06-19 14:27 419840 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2013-06-04 21:35 . 2013-06-19 14:27 89088 ----a-w- c:\windows\system32\atisamu64.dll
2013-06-04 21:35 . 2013-06-19 14:27 80896 ----a-w- c:\windows\SysWow64\atisamu32.dll
2013-06-04 21:35 . 2013-06-19 14:27 17408 ----a-w- c:\windows\system32\atig6pxx.dll
2013-06-04 21:35 . 2013-06-19 14:27 15872 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2013-06-04 21:35 . 2013-06-19 14:27 15872 ----a-w- c:\windows\system32\atiglpxx.dll
2013-06-04 21:35 . 2013-06-19 14:27 41984 ----a-w- c:\windows\system32\atig6txx.dll
2013-06-04 21:35 . 2013-06-19 14:27 36352 ----a-w- c:\windows\SysWow64\atigktxx.dll
2013-06-04 21:35 . 2013-06-19 14:27 608768 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2013-06-04 21:31 . 2013-06-19 14:27 43520 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-09-27 07:39 369152 --sh--w- c:\windows\SysWOW64\avisynth.dll
2005-07-14 10:31 32256 --sh--w- c:\windows\SysWOW64\AVSredirect.dll
2004-01-24 22:00 70656 --sh--w- c:\windows\SysWOW64\i420vfw.dll
2004-01-24 22:00 70656 --sh--w- c:\windows\SysWOW64\yv12vfw.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
"CreativeTaskScheduler"="c:\program files (x86)\Creative\Shared Files\CTSched.exe" [2006-11-17 53341]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-07-10 1672616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-06-04 676608]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-26 345144]
"CTxfiHlp"="CTXFIHLP.EXE" [2012-12-18 24576]
"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-06-21 610152]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\Dredglol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MSI Afterburner.lnk - c:\program files (x86)\MSI Afterburner\MSIAfterburner.exe [2013-7-15 448568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"301548880"= 504b0304ce5eec795045f9114d07000000300000e269f63d73594f6202c9694280cc96a28bbd63516fd3c2d5f7a2ff87ac3a990c3ec3b2ed7b07716237a0dfb1dfb651f67e31cb2e7649f98d5e55e9b25b1a579794989b176c357bdcc11226bd6ecb7de8a63ea216ab2a6f3bd651da5faa614c3ba48e87cc21c53a1354637b181014af26c92a0adbd1208eb42d8b55201d9d7b98423e41af179ddebe3ef4931015a2fc7b58a77630d30af187efca692a305fca408b0f84a60a0242fe94cf438cb216c9ad12c3969908df6593a382ef2f1fb27a6747d5e0867a216af309d7e397c00933f25264653e8824f1dfa27db2ec64c86f7403dd00d7db84bdd336e4f6ac5c84480b88d554e4a12fbf8d0b1e17061aadf7fa3ebe3e66f6e5193dd47dbe4b6fa2b5f36978356b8ec3fb66fcef4d7e5dd575dab2ed92efb281edf5083fba9393c06bed52f2a0bf7024b8f3ee5fa6e58247a1872dcf32345cc268be7090fc8bca9031ce0eb9835e98cc5da0ddb58b2aa38881d3b649600449633a0d1ea900691ffd79c68431a4a801fd923f9464b2cd1d7cf271b49db22b64bea8d763d7ed10441db4af5af2f14b3e2625806b35dc1e3370e7c9d948450ff997c32b477e51f3503508a858988495c1577c9c771f422ca4a3a34fc40202cab3ec70b9861a4c090fc11b8b97f2eb97c8e63d924903dc305a23c5af9ea18a5b5f2d31b3c93456598012280033381391f3714e6be80461f80a63a2b66a8c624a42d13b0d94d2a552018c2a92a847cb3d063165a6a65a3f6544c3e4eb3745828289dfe27f1709125c65538129efefd347436ec0e568af39425be10bab7d777d5c405b5e9f2a204c189d040050e7dbd8aae22d251c041b5ead104e43a5ec430568d8fa7123096ee44be719039204a44f19c41615dfef33586da39ac570127c6f6a6c593c105dd159f1fe27f684fe31d12e9d141ebbb9bccf1b9e4c709ec75bfdb65f65f59a61ec7f1281e74299e363b0c0b48f5c68b005479c7212b276c937f6e50086ff9fa01aeb3174439c531478633f9bb9710924b2445de3f019b959f073829327e6ec21810d0f75bb04b58e08e3cd2f76208402cc78a1baafee71dc5cd48116fdb03a45d03189b3f41b12430cf44702588cc854a2c01a4c46e0ea07fef803bd82a14f6118c1e15e1a6f3138bbe12b6fa9d040f35381380ab91715090c941ed1168429137b9bdfa5eb1933b2fc172df71dbb33693373709b05c504a50dda99cf6059f54d9bc8b3d578ca2507d1ab9c0331e8b11aa786a465722ef9b10824aecfc7972b670176153ee0342f14247363127c36a946a57610682f9c8294d14f9c11f6b8638510da26e64c255907262fd6b8699c23a4b817ba820461557a935f4f953183050c119291b573f483d4f23e4a76c34f3bd83ec3f4bd0e0af0c336982df6aa91d1f394a713b3f52fdd1a9c1f84bd764805d2b671500addd862b5fd461ca270fc2cebdc60cf12484818177f457e001042a034767f87c0f0f4e3bb561a405e839b327842e9a0902799efaf53ee7aa46f004df217838d944e4908d11c26191832c5bb5a32b62f64821f721538d361a6d2cf2dd96793005522b34f90b1d32e3120450827d3961c3c42cb618651ea41f727454047f1ba936fee2ef93b921add680c1b6888e93faa225b2dbba9265643860ab105ebfd430b381f0903825b75ede1d60bbc286d468bd031a0ad6f5c3bf6f0b92b17a41851fc3fb43773d51a7e07f46a95cced70778a8b5d3cc463242ebd0fe0f63e46f7934c48f27cae082b59476384482044b29e37c8cb1f39baf0d8ee95133c2340205f9daf18b2f9bd64f94bcc83987721b96451f4d8d83e71c916780cfbdb9f03b44dcb380b1a2e0da69ad52ce9c6c7afff2dd41b41c50c3e590bf830458a1fb3c4debf4e43aafd18e6a32cd7bf7aceaae18928629291820cd84f61a8cda2ddcc38a7fc3cda32d6580a36b92a668090931f54b28516eb6014d2e1ff2cb4d48d8cb17bd1e023d78ceeb25e9477205d8ab3501960dca31f1e521a3b35e20f95edc6d5c5806d784c118392608b2ff083a1d338d3266d60d0476c1cce2e7424ed2957529c4a49d5642b1400efe3550f5fad307a9bbb05b3b521b2430add241acb8e6726f03ebf803016643da16571c379841ed7bbef2dace29ae310fb921b7f662ae27dc7f3910a431144f0c14e35a72023a517510320e1b42d942736f05f9899566e8bce12bdda8ac87672e32fa899d56374cf9c2b11e1c1a6aec317965d467ea6f2d0e1a85d91e1ad6d8e6c00df00df68aa0e2cfdd0c85e85a0d5d832f917a4f21480294879e17641e9d752ea256d45f9168c612fc8f34052a9fd080c6a3302c77c558c7ce415d3436477694bd80c428ff160516271e44372e923d2432b8710a8a514fa30066bd5555d64e576be5a823407623749651380c5ce859b6f090a686155a2f2fd804af3bb7fd1ad171205233fa1047842804daf24d99bd0c371cfdfd2223a64d6f1f2af995240df3d62a7172ac416a980ee43ed005282243ce5a48d174192da3f0d1faacc4135685bc5e55afd4e56b03244213a492f88ea0b4a0e8342ecb2635698f193b44a5d16fb7c14fd6e2b41f319d0083cbfd22b0b1c3e193f9a62909ec6e7293ea9707c170a0441150d248a46bc1c
"3212083974"= 504b0304c239b7f8068374bfb511000000400000e269f63d73594f6202c9694280cc96a28bbd63516fe3c2d5f7a2ff87ac3a990c3ec3b2ed7b07716237a0dfb1dfb651f67e31cb2e7649f98d5e55e9b25b1a579794989b176c357bdcc11226bd6ecb7de8a63ea2165f6b31ead6b0a2a96a6e9d04b9b39f194ef52d48b088d4b6597f685a70ff6912914f86d8235681747da26cfd83223d3d248872c51095484634ebf976e4595f734bd35caf42b38dcf9e878af0be0a5e84b22940f721e8bbcdcbaa3e53607359252db16c0d6c38a142261bb4896d12a48c006cc3c21fdf717c155b2af0375d2545ee286c2aecb2955206ef25c82dc686f7eb83bb3072e94e1e59254b11a2e3628e1d98e177375b54e682a1c77f986e1907ffcb784accacb124189751d7ebbafc91d3a127f134a85e27f8c201d9082f621f5fffac09d2aab94a62f90bd74d6c96a8db6d42e4e98316449d202a4e24857673e2a50b7dfd9d5af72a21a19a922acc9675ba933a1c6ad4e0a11470fbb82eed7a79c5ca2dbb0bec5b2b43baa37373d3ef494726d7cf4a4aa8a3d6a5c206ced49148c0100bfa96b707be91b855151d8da8e0723dd1303325011b3951c9df7b10e9b153bced98376c4d7517f2e0e23a986914b2b0f978454441c47b5797d924ce9cd186d74d308099ee52f226e92de6b50e4a0691f75cfa9ce733494b8cafaeb4be4c65f6c9dffa34a3c2ed9d14f5844164be79b7a90495290350177b03aefa777ff519b624e3c75c219260ac447bba9a6db56f34b340a5f75837fab3c33831a3bc39c2914aeb87a39545bd7ed52450eb7e94d5380e2babce3f8ee6e3cdc9d4ed54d9889d9dbd0dc879caa2b121048a308a7f873252dad24ea8f8911ea0a3b202de930a9fc882cf1349ffe229016b2ebfd7821b8986d31deccbc296ba54fd6d864c915f1d77ac0734d96fe0ba43a669fab128026c7f90e9e1e0a7047f5a2378e4de0966eb6c217b3483194b2b21a3fa8a1cbef1d66a3fc8a5c863bcea6157981a11449bae3357f3287501cb9c24e0afb156f5ddfd6855cd8b7b43feabd9412c1c208b5de2330c469a59de5b490cc06bfd5a4900cb121eb967bc7185a9f00112a5b1e8d8028ca02b0f2b194af03cc1e172b70c9b88643e3c064b5406cf184ad9eba26736ef6feb30dac8ba400933a32a3c03230bd732fcbe16c4b3bdcc0b501616ce956d968b8da68b4a9a64238601e81e78095961580431361a4dd9fe963d3ceba5c21bba416c1cc9d94bb842c25b2fd12c8bf42c35948272965a3fecf6e9b92d32d7e84a402a0b6214a412a23427e4852ce607fd9f7ff8559bbb96a9ae577df0c19d108587d372470be0d3e27ed61feb442c2d65e55bac81c2786cf6b837eebc1b5af35634b29fd5d96347b5f9c747c8a9a83e7cb3c188d9042f08fbd4edeebd65de7c04b275b7fd74067a0ae3033752aa55a45a05355811416ea4a5101511e99305b700bd44742cbd6a9272b5cf4001505c4057866b57e4de5ef0ee9f88b41986a80119c962594972011fc0c39b4a74b74747f5116d896a0ebcbb4387685672899af54b80ae07008971ea1c997a898e33aab769e4e52fbbec97ebf199ce76454badbd4eab272f1d1caabb3b49b3aafc1e67d09ee8feb0580e414eb45f3f0c25fe88872312fec2341e7a6100b2e04ed25fce13a146098dce98446b2f3875ecb269a886795698619d337da612f19bf8d4fe3028e79a26548128d1595af0bf98ff320dc73d873f05ebd07c87cae28df067c00de3e53cc77e801e1304192ca7bf78ab28db40564328a108f9f0ddd8e1b0baeccf16bf1deb3cc5c4b5f5140f6b8a256e9128c203418aa3d93e3f08078977667dc02d830bb6869de92f29a65ac6d2689d0a5a90887a8643119dc9a68b5b00bd59d45da9d7ed5dae6ee6da6119243f77f51b263200f90abbb61cce9a951781ea2012a2c8d7200906439b08e7e76cf9c9536b2e6b560afd7cbaa5044791ee17ded45adfd9d359dac0a9f4ed15bf2cb2ea9b12b7cb11b597cf2e6e750a6c636fe2c4b144f6ff43ccffddae787be160b0a8b4282b35a6aeece165814e95ce7adbe416ef4e51860cb4f5d50af2a86aa4ee602a30aa54850e0cb4a38dc3a1c711b5d03b6a53ee102ac68e553d11e5fb3d0a8e0ef34266263ca4a3e0b76c55a92f75f921cd61a5363e5db7737874d57c653d63457260b67b1df330827b2921c29fda0045bbe7404e40985039f7db153f52b2c941a56e922dcfb60b89dbee327ed6f5c1e438270f766a6ed1730fc581a4aebcfe3b7726b27d6b092cf5a0b6954196cb4cc2788b8722338ee189d9e22692595f0d5b333b0f715cb8d94a08afb631dbb1be79a773e8f1a4eaf7220c24222dda431b91d9175dfa0c6ae81e8c4c879d64446cf56faefe1487ca6739a776aee42ef8be40a612f95cde3b1feeac1e1e41a24c92ed8b0152e247239e5a8bc903679ca8c7b94659ad5b1d10551f460d924fb60882fc90508c3723420f86f4cf100387e808133cc429883c0e3ace91651c075cd19d106e0b437b0363048ca1feaaf929b87aed90afde281edca0fa0cc7b5a7f03807fa5ac41b1ed73130eac1117c631c1818142f24d420f6776cb53d4d0326b9fc3008c3ca03fc649d87d37fa617b74f2865c75298bed54b7d8dc676e2210374d8bf194ae2feda62b4798933c764ccddf845330721fc21e68c0695ca73285103e22ae68da440326dfef9a80d17d0a7c3f920e7b0aa806ee9b7549ed9878b6cfb505ac69e8e8d3cfa718675764cfb03861d32afaae1d918be87f6a9ac0d815c57ad3e167d642f5fcddc25d4ba3ac3e67c26a4deaa17797b3c0654f271eaaa442a71cbe19372adcbde3df8b3fe491e5a76a79d1291a0de317ffbf927f42782fa48270f2c969563b183a4b0112f3497dd3c2a423ec83498bdbaac928910a9fb7fe5788e454c027a28f4a91af2bf09e261f85b0eee4f7929e63c4062496cb09534bb6d03ff69ed2915d0ea215b4fb3d1044e86eb87dfb4898bcbd50e5c4ddfbdb83b9410e1adf91446c43c959e0e341d67a5a7ef8712586de3b8b9c5b6f80f42f235bf68900ebfe6304bb0d9f67408b76201ec26180b4bd76500de4f0df86df4a063aececca69ddf8a162b67a4b9800fa7570d5b551ac2703adc0ffced00650a96cd81ec4187b90c6b2140ce99c1937c40587ea72899897e628115bcab73b3d9f425860b109a67347b8a121f65d0968d56a3dde6b8171cea61b08ae568b9d03c398977ce86f75055230ef370cabf67c9cf97c3223719555403f3e0bd2af0e1e8742decb05fadb0227f15d40ee2d6dc5a49fe1e6bc9e6cedde74294c3bb6fd5c5fedfad672df1dffd219bd8bc1ec39158eab507998755f553441d01cd26a5501f6fb2db4f3597510f85b93a542514c8013eedbbfc913dcce8b20a5759665bdfd9919eb22a89163d8656386d857c5bfc7c241c1d726cd94ab0f92d5b0fefcf1d4abdd26fbc6c17a4ccacf2d31e5e713059de93c59d3b8d3e8d03b5d663f9dfadb03e093cb84fcf500a1f0e2e5ba1c9d81db12cc799c6539af0cc35682d95cb789c745a452bd8b38e6cf08e0579da1ab43ad0858d0305f961b15a79c1090f4867040ea2bd36cf6512aab44ce5a1098efe039134f23bf057777fef3e68e45827b0487924cad4e5f0b1c3b4f5a0e3853b39640eb0782d78888fe92c3b68624e84ff6a5eded87be62d34ce858f34e5fffbba75f014df0f648988b51a72de1ff54d5c7a4b8ecb10c5e9ef51de98c01ef8c406f9824a0c15a29e16b5a53e3643b0065a4263ecae50d2cb976d3d2ea6255a65f1c6cc86167f1784a27b832037db4ce1e262475334f3b2430f86c7a24456eea82ab678aba91bb4c0cc82c877b80b6d3574007257272c3e126c17a8b36aa8aa9431ff01bf658f82d8153eddea6804cdc564a3f5e9967b08feeb823d3db9356a4acdd80e883ca58a1c661d01d145f80a3ab67e8036c0bae1bb7bc43204eb0cf38214bc74a9aef036a31d5a9c552d93a25c0e84057bce5437b1634680d04a77472d631432d2baa7a3acd64220efcf9e7848f8fd9801bef7561a470a1822032160eb59edc0f977882dce4fb2872d89d27ff076dba74a9672f86909956579c28853fa8de7002cc8458d09256d42a39f1a4bdb6b56d36d51488e7368686e54c1bbbfff48884e0d536be362e59bd7f18329a4b82aed396e4f92865f594d0da38f7cace7a4603af60c1a53bdfd19476094aac6e4a8f31fc1257d48d03bb0ef515d8460b9441532c8b5043d0531d5881adb6d997bb184fd8caf4d8e6c759c3f7143b9e32bc7a0ec6234b68adf4111ca1d136721438e5e6d7125d480ce982d84aea7703b4010cd27867d6ddc5e0c970385196f020e48eddb24c56972f9e61e6cc29c1712551583828f899534aacfffc66f99999ea2ba2731d52a7fd2fa262a22b075da52a5aa58f5b41aa9cdc9181406717f3f75e7c475090121966838125236e4dc6291ae3874968e8208b983aadb03ca60acd935e6da1b829407f70a77340e4439f22fdc2fc4218de0f25d2f886c0aaeb693c2b23db0eab9953bf806c2173e0bc9d0d7ef0e763775bc1432ff48d6035b1214294c81b71cd98c42831014090cd99cb74929ae853f88132e559104d4fea98ad40f17da4100a909a6981bad9efb240a79520927aa12232a56f4d8893bff92bfc2bd42cf3dc09bdc484dfdba3a10c609186104ce33e3024f44000be34814ff5dc9872d44b4157fb3a6655b985f6cc5ef4586f2abfee12dcbdb90181b396f95fe3213f094d1f3dd3d7fed800f4ed21290f613b62048e0fc1f1328d9f87a5653b489d36f727be9d755523def0472f1c1d5ac90ee665379ff39d06e863c244890f5333a0b89b92022c1a8198029fe5f8c203b3dd211d4398958ee190108dd50b7850e20d8abe2b927d53d28f3b8ca26be81bc6b83c0e2b3b1dda28066c63860cea89df82708ef21d4d36b84663e87b4385a3e37bd3ff1eb2bf64184c44723490669af4da092d45ba21a569a352e513d9a9b43e9cd4b812055822626efc55f950009232b8b3bb2d63d44a8b0bd9bd4e84c5a724496a2326f63c97dbcb235366ec0cf6096b5f4988d073c34bd3a084130cea8d6ee22e542b411c1e18599667b3fd6dde0669ad82c85a1c10ca5862213cb1bb277e6c4f6564f20a9bcea1b48170504c47235d78ed0a0441987c8c17d90d7b56cf487c46733ba4a6848fec42b97ce4048f3c6d9c493322f052ef93f02f142b3940a10921bd15c911e7a97aa4a20dc383c62cd288d252ba937b3f60761e6653568a01241bb573664de04811cf3f59b4c2d7e8a6c55da16f468383456aa751697697397c2a5e5abfa0f1099d80447d49da509aa1347f3943ee9baa1fdad2a0e69410b34253ad4991282d0e952260f52ab9f02a3d00b37098cf60354424f862066e45e92ac475c99a00e7380766e589abf66271619142795cf7a7fbd138a6cc5bd7e135122341d1f06eb5b436c59be0adedc71bc03d7c63c16751ad56c69e36decfe9e8214c719fcdf2e9fe2dc971f03c1c2ad6b6d368fe8b11d0389650c73d1c7e73708145fa05992a150e6a909656ea786e244bdf1cd71f4b0fd05b1335d703182ffa9d96c99108297b1fe327a83bf4f69d2a9c3d1eb73a9dd8cee2b3220904ac31011fd6407a5ba427facb46227fdedb13d1ca6443ded3dc3b6cf06a59dc9b9226fbf357334abf58412605fd206e7b6125fa19e5d68f75783fa08205b05c0a12d1830068317f6105958c4eb37bcb1beae6a401c267641aa58274a410d76b4d2a03e418020869b6886bb81964761b3fcd8ea68050ad6cff99649cde8fa53f04b0c96e271c0b092e24d81ea2d723775799e713ea9da6967ef57aaafe1c6732f2f047556027f021c65fc20c1c3bcb392acf8ff7a9e14d9728a5aaacd255fc3866b041e9c96dcf592083d78c9e405ddd7991d2e2536d2eb1ba0f0ece3dfb6a34c2665cfac2d1850fd478f617fdd4e9dd4492c553bd375cfd33f4744d642006f3a5216a1ff7d73643ed751caecdfdcb56247aa2f66fbcb8315daaa86006a99e0350a72d5d5260d6bb77ac53cdd7abacb859586c279b7facdf076c922ac27f3e907fb3b4ec977ca634a28df064162165222dcce674dab60a4e9d48e7fcea267abb1f8e0a2012aa6db532a4ce74fbaf583e2c292fa1b56be585d14ee073cdafe3fc0c19050e698ec41b9d27f5db41a779208118a5d3f8f74333b2ad2fe3cee273bbfea485ead817effedf1260c1a125070589b6f0f31984ed498cbd273e84a718f54c82cbc2747e678f8437dde23c9ea3c877823034b7c70731c2d01cc09d11d3364e7945b6480b9b416acb54cd1194b46c6d2e147619ac1c1fa915af80a5098647247ebcf0449634f69c96afc740bce61993228183d98d0f85406d8ffd934
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer5"=wdmaud.drv
.
R1 kkpvbxdj;kkpvbxdj;c:\windows\system32\drivers\kkpvbxdj.sys;c:\windows\SYSNATIVE\drivers\kkpvbxdj.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
R3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\Drivers\CYUSB.sys;c:\windows\SYSNATIVE\Drivers\CYUSB.sys [x]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys;c:\windows\SYSNATIVE\drivers\dadder.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys;c:\windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 VKbms;Razer Gaming Device;c:\windows\system32\DRIVERS\VKbms.sys;c:\windows\SYSNATIVE\DRIVERS\VKbms.sys [x]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 WTabletServiceCon;Wacom Consumer Service;c:\program files\Tablet\Pen\WTabletServiceCon.exe;c:\program files\Tablet\Pen\WTabletServiceCon.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
S3 ha20x22k;Creative 20X2 HAL Driver;c:\windows\system32\drivers\ha20x22k.sys;c:\windows\SYSNATIVE\drivers\ha20x22k.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTCore64;RTCore64;c:\program files (x86)\MSI Afterburner\RTCore64.sys;c:\program files (x86)\MSI Afterburner\RTCore64.sys [x]
S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-19 10:30]
.
2013-07-24 c:\windows\Tasks\MSIAfterburner.job
- c:\program files (x86)\MSI Afterburner\MSIAfterburner.exe [2013-07-15 11:32]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Dredglol\AppData\Roaming\Mozilla\Firefox\Profiles\1wlwa6vl.default\
FF - ExtSQL: 2013-06-19 19:51; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Dredglol\AppData\Roaming\Mozilla\Firefox\Profiles\1wlwa6vl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files\Tablet\Pen\WacomHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-07-24 14:05:29 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-07-24 12:05
.
Vor Suchlauf: 8 Verzeichnis(se), 32.615.145.472 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 32.288.964.608 Bytes frei
.
- - End Of File - - 1DEB23FC057E86A3B2F8240B662E6280
A36C5E4F47E84449FF07ED3517B43A31
|
|
25.07.2013, 14:21
| #6 |
| | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) irgendwas auffälliges das beseitigt werden muss oder soll ich nun abwarten ob der virus wieder kommt? |
|
25.07.2013, 17:08
| #7 |
| /// TB-Ausbilder | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Weiter: Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ cheers, Leo |
|
25.07.2013, 19:30
| #8 |
| |  Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Scan Finished: No malware found! Congratulations, no cleanup is required! Kann ich den Windows Defender aus lassen? Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org
Database version: v2013.07.25.05
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Muster :: Muster-PC [administrator]
25.07.2013 20:25:07
mbar-log-2013-07-25 (20-25-07).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 234735
Time elapsed: 4 minute(s), 23 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
25.07.2013, 19:47
| #9 |
| /// TB-Ausbilder | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Ja, der Defender kann ausbleiben, wenn ein Antivirenprogramm läuft. Schritt 1 ESET Online Scanner
Schritt 2 Starte noch einmal FRST.
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
02.08.2013, 00:41
| #10 |
| /// TB-Ausbilder | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Hi, ich hab schon länger keine Antwort mehr von dir erhalten. Brauchst du weiterhin noch Hilfe? Wenn ich in den nächsten 24 Stunden nichts von dir höre, gehe ich davon aus, dass sich das Thema erledigt hat und lösche es aus meinen Abos. Hinweis: Wir sind noch nicht fertig! Auch wenn die Symptome verschwunden sein sollten, kann dein System weiterhin infiziert sein und über Sicherheitslücken verfügen, welche eine erneute Infektion möglich machen.
__________________ cheers, Leo |
|
03.08.2013, 09:16
| #11 |
| /// TB-Ausbilder | Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) Fehlende Rückmeldung Dieses Thema wurde aus meinen Abos gelöscht. Somit bekomme ich keine Benachrichtigung mehr über neue Antworten. Schreib mir eine PM, falls du das Thema doch wieder fortsetzen möchtest. Dann machen wir hier weiter. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass dein Rechner schon sauber ist. Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.
__________________ cheers, Leo |
|
| Themen zu Virus kommt immer wieder, mehrmals gelöscht, deaktiviert Firewall etc. (Sirefef?!) |
| 0x80041003, antivirus, avira, branding, datei, defender, explorer, farbar, farbar recovery scan tool, fehler, firewall, free, frst.txt, gelöscht, hijack, hijackthis, java, kommt immer wieder, malwarebytes, microsoft, neustart, papierkorb, plug-in, tablet, trojan:win32/sirefef.ab, trojan:win64/sirefef.ai, trojan:win64/sirefef.p, viren, virus, virus kommt immer wieder, warnung, win32/sirefef.ab, win64/sirefef.ai, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
