| |
| |||||||
Log-Analyse und Auswertung: 19 bösartige Risiken gefunden!..bin hilflosWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
06.08.2013, 08:25
| #1 |
 |  19 bösartige Risiken gefunden!..bin hilflos Hallo Community, wie im Titel zu lesen, hat das Programm Malwarebytes Anti-Malware 19 bösartige Risiken entdeckt. Es war alles so..... Schon seit 1 Monat oder so kam immer bei jedem Autostart eine Meldung wo vom Programm "HomeTab" die updater.dll nicht gefunden werden konnte (...RunDLL... "Das Angegebene Modul wurde nicht gefunden"). Nach ner Zeit fing ich zu überlegen und dachte mir nichts, dann als es richtig Genervt hat, bin ich dem Link gefolgt im PC und wollte dieses Programm manuell löschen, doch es war nicht zu finden. Ich kannte es nicht einmal. Gut, seit 2 Tagen bin ich am googlen und googlen und bin wie im ersten Satz auf das Programm "Malwarebytes..." gestoßen. Und ja er fand 19 Dateien. Ich bin dene gefolgt mit Rechtsklick und dann "Springe zur Position". Und ich hab gesehen das ist irgendwas Installiert Namens, Tarma Installer und im Roaming Ordner ein Ordner der Windows Net Data heist und noch andere diverse Sachen. Zu einem kann mir einer erklären was das für Programme oder Dateien sind die im Logfile stehen, also zB Tarma Installer u.s.w..? Oder wie im Logfile, Hijack.SearchPage... ist das ein SearchToolbar? Warum sollte ich so etwas Installieren ich benutze NUR Google. Und noch viel wichtiger: Kann mir einer Sagen wie ich diese 19 Dateien KOMPLETT von meinem Pc entferne und das sicher? Manche Empfehlen dieses Programm "Combofix", es soll sehr Stark sein. Noch eine Info: Habe x22 Benutzt musste DEP und UAC deaktivieren für ne Zeit lang. UAC ist seit heute wieder Aktiv. Und bei DEP hab vergessen was das ist, auf jeden Fall ist es Deaktiviert. AntiVirusProgramm: NORTON Ihr seit meine letzte Hoffnung, wie entferne ich diese Dateien/Programme? Und bitte antwortet nicht mit, " kannst ihn weghaun.." oder sowas in der Art. Großen Dank im Voraus Leute. ------------------------------- Für die, die die Logdatei nicht Downloaden wollen. Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.06.01 Windows 8 x64 NTFS Internet Explorer 10.0.9200.16635 Daniel Gruber :: DANIEL [Administrator] Schutz: Aktiviert 06.08.2013 08:29:24 MBAM-log-2013-08-06 (08-47-19).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 465663 Laufzeit: 17 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 1 C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\net.exe (PUP.Optional.NetData.A) -> 5336 -> Keine Aktion durchgeführt. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 4 HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q=) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Search Page (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q=) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q=) Gut: (hxxp://www.google.com) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (Hijack.SearchPage) -> Bösartig: (hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q=) Gut: (hxxp://www.google.com/) -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 4 C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data (PUP.Optional.NetData.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 10 C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\Users\Daniel Gruber\AppData\Local\DownloadGuide\Offers\plushd.exe (Heuristics.Shuriken) -> Keine Aktion durchgeführt. C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\well.dat (PUP.Optional.NetData.A) -> Keine Aktion durchgeführt. C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\id.dat (PUP.Optional.NetData.A) -> Keine Aktion durchgeführt. C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\net.exe (PUP.Optional.NetData.A) -> Keine Aktion durchgeführt. C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\uninstaller.exe (PUP.Optional.NetData.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. (Ende) Geändert von Jackoo (06.08.2013 um 09:21 Uhr) |
|
06.08.2013, 09:25
| #2 |
| /// TB-Ausbilder  |  19 bösartige Risiken gefunden!..bin hilflos!! Hinweis an Mitlesende !! Dieses Thema und die Anweisungen sind nur für diesen speziellen Fall gedacht. Sie könnten andere Computer schwer beschädigen. Öffnet bitte euer eigenes Thema.  Ich werde dir bei deinem Problem helfen. Die Bereinigung funktioniert nur, wenn du dich an die folgenden Regeln hälst:  Bitte lesen:Regeln für die Bereinigung
Schritt 1: (Erinnerung: Antworte mir erst, wenn du alle Schritte abgearbeitet hast!) Deinstallation von Programmen
Schritt 2: AdwCleaner: Werbeprogramme suchen und löschen Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 3: Scan mit DDS (mit attach) Downloade dir bitte DDS (von sUBs) und speichere die Datei auf deinem Desktop.
__________________ |
|
06.08.2013, 09:48
| #3 |
| | 19 bösartige Risiken gefunden!..bin hilflos Also erstmal der AdwCleaner:
__________________Code:
ATTFilter # AdwCleaner v2.306 - Datei am 06/08/2013 um 10:36:01 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzer : Daniel Gruber - DANIEL
# Bootmodus : Normal
# Ausgeführt unter : D:\Chrome Downloads\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Program Files\Covus Freemium
Ordner Gelöscht : C:\Program Files\SoftwareUpdater
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Covus Freemium
Ordner Gelöscht : C:\Users\Daniel Gruber\AppData\LocalLow\HomeTab
Ordner Gelöscht : C:\Users\Daniel Gruber\AppData\LocalLow\SimplyTech
Ordner Gelöscht : C:\Users\Daniel Gruber\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Daniel Gruber\AppData\Roaming\SimplyTech
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\HomeTab
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3FC27B34-0C19-49DA-875E-1875DDD4A6B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.Band
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.Band.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.NotificationSource
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.NotificationSource.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.SourceSinkImpl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.SourceSinkImpl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.ToolbarInfo
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wtb.ToolbarInfo.1
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A928E66C-F501-4E66-9953-855C712F93B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer
Schlüssel Gelöscht : HKU\S-1-5-21-2397980888-2884532311-1803219999-1002\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKU\S-1-5-21-2397980888-2884532311-1803219999-1002\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16537
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Search Bar] = hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q= --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Search Page] = hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q= --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Search Bar] = hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q= --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Search Page] = hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q= --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=Somoto&dpid=Somoto&co=DE&userid=665e24d6-0ead-4372-9228-ca6807c2c0e9&searchtype=ds&q={searchTerms}&installDate=31/05/2013 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - (Default)] = hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=Somoto&dpid=Somoto&co=DE&userid=665e24d6-0ead-4372-9228-ca6807c2c0e9&searchtype=ds&q={searchTerms}&installDate=31/05/2013 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - (Default)] = hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s --> hxxp://www.google.com
-\\ Google Chrome v28.0.1500.95
Datei : C:\Users\Daniel Gruber\AppData\Local\Google\Chrome\User Data\Default\Preferences
Gelöscht [l.3794] : urls_to_restore_on_startup = [ "hxxp://www.google.com", "hxxp://mystart.incredibar.com/mb178?[...]
*************************
AdwCleaner[S1].txt - [16200 octets] - [06/08/2013 10:36:01]
########## EOF - C:\AdwCleaner[S1].txt - [16261 octets] ##########
Jetzt die dds.txt Datei: DDS Logfile: Code:
ATTFilter DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.25.2
Run by Daniel Gruber at 10:40:39 on 2013-08-06
Microsoft Windows 8 6.2.9200.0.1252.49.1031.18.8134.6416 [GMT 2:00]
.
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\dwm.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Windows\system32\dashost.exe
C:\Windows\system32\IProsetMonitor.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
C:\Windows\SysWOW64\PnkBstrA.exe
D:\Tobit Radio.fx\Server\rfx-server.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\taskhostex.exe
C:\Windows\Explorer.EXE
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
D:\Origin\Origin.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
D:\iTunes System\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe
C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Nero\Update\NASvc.exe
C:\Windows\system32\wwahost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:newtab
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://acer13.msn.com
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = about:newtab
mSearch Bar = hxxp://www.google.com
mSearch Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mWinlogon: Userinit = userinit.exe,
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - <orphaned>
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - <orphaned>
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
uRun: [Steam] "D:\SteamLibrary\Steam\steam.exe" -silent
uRun: [EADM] "D:\Origin\Origin.exe" -AutoStart
uRun: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
uRun: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
uRun: [com.apple.dav.bookmarks.daemon] C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
uRun: [rfxsrvtray] "D:\Tobit Radio.fx\Client\rfx-tray.exe"
uRun: [SkyDrive] "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" /background
uRun: [Vidalia] "C:\Program Files (x86)\Vidalia Bridge Bundle\Vidalia\vidalia.exe"
uRunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64] C:\Windows\System32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64"
uRunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112] C:\Windows\System32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112"
uRunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530\amd64] C:\Windows\System32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530\amd64"
uRunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530] C:\Windows\System32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "D:\iTunes System\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
dRunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid}
StartupFolder: C:\Users\DANIEL~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\net.lnk - C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\net.exe
StartupFolder: C:\Users\DANIEL~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\BERWAC~1.LNK - C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\RADIOF~1.LNK - D:\Tobit Radio.fx\Client\rfx-client.exe
IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll
IE: {92808042-fb78-4fa0-bb4f-c9a95e0e9c10} - {ba696155-d96e-4281-b467-0367a0456474}
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{817a0ea8-3020-4bc2-b0d8-6e02d3dde5ca} : DHCPNameServer = 192.168.2.1
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs= C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll, C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
x64-BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - <orphaned>
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
x64-BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - <orphaned>
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
x64-Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;C:\Windows\System32\Drivers\NISx64\1404000.028\symds64.sys [2013-7-31 493656]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\Drivers\NISx64\1404000.028\symefa64.sys [2013-7-31 1139800]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [2013-7-15 1393240]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\System32\Drivers\NISx64\1404000.028\ccsetx64.sys [2013-7-31 169048]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\Drivers\dtsoftbus01.sys [2013-6-25 283200]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20130804.001\IDSviA64.sys [2013-8-6 513184]
R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\System32\Drivers\mwlPSDFilter.sys [2012-9-7 22648]
R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\System32\Drivers\mwlPSDNserv.sys [2012-9-7 20520]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\System32\Drivers\mwlPSDVDisk.sys [2012-9-7 62776]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\Drivers\NISx64\1404000.028\ironx64.sys [2013-7-31 224416]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\Drivers\NISx64\1404000.028\symnets.sys [2013-7-31 433752]
R2 CCDMonitorService;CCDMonitorService;C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2012-8-23 2435728]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2013-6-24 2464400]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-2-13 731648]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;C:\Windows\System32\IPROSetMonitor.exe [2013-4-5 183560]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2013-1-31 169432]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-8-6 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-8-6 701512]
R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2011-11-26 687400]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe [2013-7-31 144368]
R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-7-31 14984480]
R2 OfficeSvc;Microsoft Office-Dienst;C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-6-2 1900728]
R2 Radio.fx;Radio.fx Server;D:\Tobit Radio.fx\Server\rfx-server.exe [2013-6-13 3999512]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-7-25 414496]
R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\Drivers\TurboB.sys [2012-5-30 16168]
R3 ePowerSvc;ePower Service;C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2012-8-22 658576]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-7-31 138912]
R3 huawei_enumerator;huawei_enumerator;C:\Windows\System32\Drivers\ew_jubusenum.sys [2013-6-5 87040]
R3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);C:\Windows\System32\Drivers\ICCWDT.sys [2010-8-18 26136]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\Drivers\mbam.sys [2013-8-6 25928]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\Drivers\nvvad64v.sys [2013-7-31 39712]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\Drivers\RtsUStor.sys [2013-1-31 243712]
S0 SymELAM;Symantec ELAM Driver;C:\Windows\System32\Drivers\NISx64\1404000.028\symelam.sys [2013-7-31 23448]
S3 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2012-7-12 174160]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\Windows\System32\Drivers\ew_hwusbdev.sys [2013-6-5 117248]
S3 ew_usbenumfilter;huawei_CompositeFilter;C:\Windows\System32\Drivers\ew_usbenumfilter.sys [2013-6-5 13952]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 huawei_cdcacm;huawei_cdcacm;C:\Windows\System32\Drivers\ew_jucdcacm.sys [2013-6-5 98304]
S3 huawei_ext_ctrl;huawei_ext_ctrl;C:\Windows\System32\Drivers\ew_juextctrl.sys [2013-6-5 28672]
S3 huawei_wwanecm;huawei_wwanecm;C:\Windows\System32\Drivers\ew_juwwanecm.sys [2013-6-5 227840]
S3 iaStorA;iaStorA;C:\Windows\System32\Drivers\iaStorA.sys [2013-4-22 677360]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-2-13 820184]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0-Netzwerkadapter;C:\Windows\System32\Drivers\RTL8192su.sys [2012-5-22 694416]
S3 SmbDrvI;SmbDrvI;C:\Windows\System32\Drivers\Smb_driver_Intel.sys [2013-6-24 33008]
S3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.6;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2012-5-30 149544]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]
S3 WUDFWpdMtp;WUDFWpdMtp;C:\Windows\System32\Drivers\WUDFRd.sys [2012-7-26 198656]
.
=============== Created Last 30 ================
.
2013-08-06 06:28:06 -------- d-----w- C:\Users\Daniel Gruber\AppData\Roaming\Malwarebytes
2013-08-06 06:28:02 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-08-06 06:28:02 -------- d-----w- C:\ProgramData\Malwarebytes
2013-08-06 06:28:02 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-05 22:20:39 -------- d-----w- C:\ProgramData\Freemake
2013-08-05 22:20:36 -------- d-----w- C:\Program Files (x86)\Freemake
2013-08-05 22:15:16 -------- d-----w- C:\Users\Daniel Gruber\AppData\Roaming\Canneverbe Limited
2013-08-05 22:15:16 -------- d-----w- C:\ProgramData\Canneverbe Limited
2013-08-04 16:35:27 -------- d-----w- C:\tmp
2013-07-31 15:17:49 796760 ----a-w- C:\Windows\System32\drivers\NISx64\1404000.028\srtsp64.sys
2013-07-31 15:17:49 493656 ----a-w- C:\Windows\System32\drivers\NISx64\1404000.028\symds64.sys
2013-07-31 15:17:49 433752 ----a-w- C:\Windows\System32\drivers\NISx64\1404000.028\symnets.sys
2013-07-31 15:17:49 36952 ----a-w- C:\Windows\System32\drivers\NISx64\1404000.028\srtspx64.sys
2013-07-31 15:17:49 23448 ----a-r- C:\Windows\System32\drivers\NISx64\1404000.028\symelam.sys
2013-07-31 15:17:49 224416 ----a-w- C:\Windows\System32\drivers\NISx64\1404000.028\ironx64.sys
2013-07-31 15:17:49 169048 ----a-w- C:\Windows\System32\drivers\NISx64\1404000.028\ccsetx64.sys
2013-07-31 15:17:49 1139800 ----a-w- C:\Windows\System32\drivers\NISx64\1404000.028\symefa64.sys
2013-07-31 15:17:45 -------- d-----w- C:\Windows\System32\drivers\NISx64\1404000.028
2013-07-31 13:28:58 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
2013-07-31 13:06:02 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2013-07-31 13:06:02 -------- d-----w- C:\Program Files\Symantec
2013-07-31 13:06:02 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2013-07-31 13:05:47 -------- d-----w- C:\Windows\System32\drivers\NISx64
2013-07-31 13:05:46 -------- d-----w- C:\Program Files (x86)\Norton Internet Security
2013-07-31 12:39:59 -------- d-----w- C:\NvidiaLogging
2013-07-31 12:39:30 39712 ----a-w- C:\Windows\System32\drivers\nvvad64v.sys
2013-07-31 12:39:30 29984 ----a-w- C:\Windows\System32\nvaudcap64v.dll
2013-07-31 12:39:30 28448 ----a-w- C:\Windows\SysWow64\nvaudcap32v.dll
2013-07-25 21:19:16 571168 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
2013-07-18 14:32:40 2035200 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
2013-07-18 14:29:33 31520 ----a-w- C:\Windows\System32\nvhdap64.dll
2013-07-18 14:29:33 196384 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys
2013-07-18 14:29:33 1882912 ----a-w- C:\Windows\System32\nvdispco6432619.dll
2013-07-18 14:29:33 1511712 ----a-w- C:\Windows\System32\nvdispgenco6432619.dll
2013-07-16 18:06:54 -------- d-----w- C:\ProgramData\Caphyon
2013-07-16 18:05:40 -------- d-----w- C:\Users\Daniel Gruber\AppData\Local\Temp421e99854eba0cac6b21c57ea80de720
2013-07-16 18:05:39 -------- d-----w- C:\Users\Daniel Gruber\ChromeExtensions
2013-07-16 18:05:39 -------- d-----w- C:\Users\Daniel Gruber\AppData\Local\Temp1cfb5cdb8ab23f7daa45d5a0e61fcda7
2013-07-16 18:05:24 -------- d-----w- C:\Users\Daniel Gruber\AppData\Roaming\NVIDIA
2013-07-13 22:05:31 -------- d-----w- C:\Users\Daniel Gruber\AppData\Local\ElevatedDiagnostics
2013-07-13 21:58:25 -------- d-----w- C:\Users\Daniel Gruber\AppData\Roaming\Steganos VPN
2013-07-13 21:58:16 -------- d-----w- C:\Program Files (x86)\Common Files\Steganos
2013-07-13 21:57:35 -------- d-----w- C:\Users\Daniel Gruber\AppData\Roaming\Steganos
2013-07-11 09:58:15 2479616 ----a-w- C:\Windows\SysWow64\710371500.exe
2013-07-10 19:08:24 2479616 ----a-w- C:\Windows\SysWow64\52519776.exe
.
==================== Find3M ====================
.
2013-07-26 04:59:39 6601504 ----a-w- C:\Windows\System32\nvcpl.dll
2013-07-26 04:59:39 3452704 ----a-w- C:\Windows\System32\nvsvc64.dll
2013-07-26 04:59:35 920864 ----a-w- C:\Windows\System32\nvvsvc.exe
2013-07-26 04:59:35 63776 ----a-w- C:\Windows\System32\nvshext.dll
2013-07-26 04:59:35 2559776 ----a-w- C:\Windows\System32\nvsvcr.dll
2013-07-26 04:59:35 219424 ----a-w- C:\Windows\System32\nvmctray.dll
2013-07-22 19:12:40 3282455 ----a-w- C:\Windows\System32\nvcoproc.bin
2013-06-27 22:04:51 78200 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-27 22:04:51 693112 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-25 18:02:56 283200 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys
2013-06-23 10:11:01 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-23 10:11:01 867240 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-06-23 10:11:01 789416 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2013-06-21 12:06:36 1832224 ----a-w- C:\Windows\System32\nvdispco6432049.dll
2013-06-21 12:06:36 1511712 ----a-w- C:\Windows\System32\nvdispgenco6432049.dll
2013-06-16 22:41:31 997632 ----a-w- C:\Windows\System32\drivers\ndis.sys
2013-06-13 03:58:44 31816 ----a-w- C:\Windows\Launcher.exe
2013-06-11 23:43:37 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-06-11 23:43:00 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-06-11 23:26:20 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-06-11 23:25:16 3958784 ----a-w- C:\Windows\System32\jscript9.dll
2013-06-07 15:59:16 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2013-06-07 15:59:16 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2013-06-04 18:50:29 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2013-06-01 11:54:16 194816 ----a-w- C:\Windows\System32\drivers\sdbus.sys
2013-06-01 11:54:10 125184 ----a-w- C:\Windows\System32\drivers\dumpsd.sys
2013-06-01 11:34:21 2391280 ----a-w- C:\Windows\explorer.exe
2013-06-01 11:33:13 2233600 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2013-06-01 11:29:35 337152 ----a-w- C:\Windows\System32\drivers\USBXHCI.SYS
2013-06-01 11:29:35 213248 ----a-w- C:\Windows\System32\drivers\UCX01000.SYS
2013-06-01 11:29:17 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe
2013-06-01 11:26:33 327936 ----a-w- C:\Windows\System32\drivers\volsnap.sys
2013-06-01 11:26:31 6987008 ----a-w- C:\Windows\System32\ntoskrnl.exe
2013-06-01 10:24:46 2106176 ----a-w- C:\Windows\SysWow64\explorer.exe
2013-06-01 09:25:52 364544 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
2013-06-01 09:25:05 67584 ----a-w- C:\Windows\SysWow64\samlib.dll
2013-06-01 09:25:03 496640 ----a-w- C:\Windows\SysWow64\qedit.dll
2013-06-01 09:24:19 493056 ----a-w- C:\Windows\SysWow64\mscms.dll
2013-06-01 09:24:09 850944 ----a-w- C:\Windows\SysWow64\mfasfsrcsnk.dll
2013-06-01 09:24:09 1453568 ----a-w- C:\Windows\SysWow64\mfcore.dll
2013-06-01 09:23:46 1842176 ----a-w- C:\Windows\SysWow64\dwmcore.dll
2013-06-01 09:23:06 680960 ----a-w- C:\Windows\System32\vds.exe
2013-06-01 09:22:47 80896 ----a-w- C:\Windows\System32\MbaeParserTask.exe
2013-06-01 09:22:33 523264 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
2013-06-01 09:22:33 446976 ----a-w- C:\Windows\System32\wwansvc.dll
2013-06-01 09:22:09 190976 ----a-w- C:\Windows\System32\vdsutil.dll
2013-06-01 09:21:39 729600 ----a-w- C:\Windows\System32\samsrv.dll
2013-06-01 09:21:39 106496 ----a-w- C:\Windows\System32\samlib.dll
2013-06-01 09:21:34 595968 ----a-w- C:\Windows\System32\qedit.dll
2013-06-01 09:20:45 583168 ----a-w- C:\Windows\System32\mscms.dll
2013-06-01 09:20:34 1527808 ----a-w- C:\Windows\System32\mfcore.dll
2013-06-01 09:20:34 1048576 ----a-w- C:\Windows\System32\mfasfsrcsnk.dll
2013-06-01 09:20:04 2219520 ----a-w- C:\Windows\System32\dwmcore.dll
2013-06-01 09:19:58 207872 ----a-w- C:\Windows\System32\DeviceSetupManager.dll
2013-06-01 09:19:42 785408 ----a-w- C:\Windows\System32\audiosrv.dll
2013-06-01 03:08:57 37632 ----a-w- C:\Windows\System32\drivers\BthAvrcpTg.sys
2013-05-31 17:38:46 971680 ----a-w- C:\Windows\System32\deployJava1.dll
2013-05-31 17:38:46 1092512 ----a-w- C:\Windows\System32\npDeployJava1.dll
2013-05-31 17:38:46 108448 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2013-05-30 23:14:23 4036096 ----a-w- C:\Windows\System32\win32k.sys
2013-05-24 22:09:20 1403296 ----a-w- C:\Windows\System32\winload.efi
2013-05-24 22:09:20 1271584 ----a-w- C:\Windows\System32\winload.exe
2013-05-24 22:09:20 1217352 ----a-w- C:\Windows\System32\winresume.efi
2013-05-24 22:09:20 1093904 ----a-w- C:\Windows\System32\winresume.exe
2013-05-23 23:01:46 1300992 ----a-w- C:\Windows\System32\gdi32.dll
2013-05-23 22:27:05 1022464 ----a-w- C:\Windows\SysWow64\gdi32.dll
2013-05-22 14:08:06 2680832 ----a-w- C:\Windows\SysWow64\dvmsg.dll
2013-05-15 22:37:03 44032 ----a-w- C:\Windows\SysWow64\UXInit.dll
2013-05-15 22:35:49 53760 ----a-w- C:\Windows\System32\UXInit.dll
2013-05-15 22:35:47 144384 ----a-w- C:\Windows\System32\tssdisai.dll
2013-05-15 02:25:59 888320 ----a-w- C:\Windows\System32\autochk.exe
2013-05-15 02:25:44 542208 ----a-w- C:\Windows\System32\untfs.dll
2013-05-15 02:24:10 793088 ----a-w- C:\Windows\SysWow64\autochk.exe
2013-05-15 02:24:01 482816 ----a-w- C:\Windows\SysWow64\untfs.dll
2013-05-14 13:14:01 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-05-14 09:23:31 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-05-12 21:42:27 1832224 ----a-w- C:\Windows\System32\nvdispco6432018.dll
2013-05-12 21:42:27 1511712 ----a-w- C:\Windows\System32\nvdispgenco6432018.dll
.
============= FINISH: 10:40:50,88 ===============
------ Zum Schluss die attach.txt Datei: Code:
ATTFilter . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 8 Boot Device: \Device\HarddiskVolume2 Install Date: 31.05.2013 17:11:16 System Uptime: 06.08.2013 10:37:05 (0 hours ago) . Motherboard: Acer | | Predator G3620 Processor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz | SOCKET 0 | 3401/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 59 GiB total, 7,906 GiB free. D: is FIXED (NTFS) - 2770 GiB total, 2660,004 GiB free. E: is CDROM () F: is CDROM () G: is CDROM () H: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP26: 05.08.2013 23:42:13 - Google SketchUp 8 wurde entfernt . ==== Installed Programs ====================== . clear.fi SDK- Movie 2 clear.fi SDK - Video 2 Überwachungstool für die Intel® Turbo-Boost-Technik 2.6 Acer Power Management Acer Recovery Management AcerCloud AcerCloud Docs Apple Application Support Apple Mobile Device Support Apple Software Update Call of Duty: Black Ops Call of Duty: Black Ops - Multiplayer Call of Duty: Black Ops II - Zombies Call of Duty: Modern Warfare 2 Call of Duty: Modern Warfare 2 - Multiplayer Cheat Engine 6.3 clear.fi Media clear.fi Photo Counter-Strike: Source Crysis®3 D3DX10 Far Cry 3 FLAC To MP3 V4.0.4 Fotogalerie Free Driver Scout Google Chrome Google Update Helper Grand Theft Auto San Andreas Hotkey Utility iCloud Identity Card Intel(R) Control Center Intel(R) Management Engine Components Intel(R) Network Connections 18.3.72.0 Intel(R) Rapid Storage Technology Intel® Trusted Connect Service Client Intel® Watchdog Timer Driver (Intel® WDT) iTunes Java 7 Update 21 (64-bit) Java 7 Update 25 Java Auto Updater Live Updater Malwarebytes Anti-Malware Version 1.75.0.1300 Microsoft Application Error Reporting Microsoft Office 365 Home Premium - de-de Microsoft SkyDrive Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Visual Studio 2005 Tools for Office Runtime Movie Maker MSVCRT MSVCRT110 MSVCRT110_amd64 MyWinLocker MyWinLocker 4 MyWinLocker Suite Nero 12 Essentials OEM.a01 Nero ControlCenter Nero ControlCenter Help (CHM) Nero Core Components Nero Express Nero Express Help (CHM) Nero Launcher Nero Update Norton Internet Security NVIDIA 3D Vision Controller-Treiber 326.41 NVIDIA 3D Vision Treiber 326.41 NVIDIA GeForce Experience 1.6 NVIDIA Grafiktreiber 326.41 NVIDIA HD-Audiotreiber 1.3.26.4 NVIDIA Install Application NVIDIA PhysX NVIDIA PhysX-Systemsoftware 9.13.0604 NVIDIA Stereoscopic 3D Driver NVIDIA Systemsteuerung 326.41 NVIDIA Update 7.2.17 NVIDIA Update Components NVIDIA Virtual Audio 1.2.1 Office 15 Click-to-Run Extensibility Component Office 15 Click-to-Run Licensing Component Office 15 Click-to-Run Localization Component Office Addin Origin Photo Common Photo Gallery Prerequisite installer PunkBuster Services QuickTime Radio.fx Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader Shared C Run-time for x64 SHIELD Streaming Shredder Steam System Requirements Lab for Intel The Walking Dead Update Installer for WildTangent Games App Uplay Visual Studio 2005 Tools for Office Second Edition Runtime Visual Studio Tools for the Office system 3.0 Runtime Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Photo Common Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack . ==== End Of File =========================== Hier noch paar Anmerkungen von mir: Wunder dich nicht warum ich so wenig GB auf der Festplatte C habe, ist eine SSD deshalb.  |
|
06.08.2013, 09:52
| #4 |
| /// TB-Ausbilder | 19 bösartige Risiken gefunden!..bin hilflos Das ist soweit sauber und wir müssen nichts weiter machen.
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
06.08.2013, 09:57
| #5 |
| | 19 bösartige Risiken gefunden!..bin hilflos Und warum Öffnet sich immer noch nach jedem Neustart meine Computers, eine Meldung von der RunDLL dass, das angegebene Modul nicht gefunden werden konnte? Und zwar bei dem Programm "HomeTab" die TBupdater.dll Das Programm habe ich nichtmal auf dem Pc und es kommt trotzdem. |
|
06.08.2013, 10:02
| #6 |
| /// TB-Ausbilder | 19 bösartige Risiken gefunden!..bin hilflos Na das kommt eben WEIL du das Programm nicht mehr hast ... in diesem Logfile ist aber nichts zu sehen .... Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32bit oder FRST 64bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
__________________ --> 19 bösartige Risiken gefunden!..bin hilflos |
|
06.08.2013, 10:11
| #7 |
| | 19 bösartige Risiken gefunden!..bin hilflos FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-08-2013
Ran by Daniel Gruber (administrator) on 06-08-2013 11:09:55
Running from C:\Users\Daniel Gruber\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() D:\Tobit Radio.fx\Server\rfx-server.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
(Microsoft Corporation) C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) D:\iTunes System\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PMMUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13519432 2013-04-10] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-07-27] (NVIDIA Corporation)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4123 2012-05-30] ()
HKCU\...\Run: [Steam] - D:\SteamLibrary\Steam\steam.exe [1807272 2013-07-27] (Valve Corporation)
HKCU\...\Run: [EADM] - D:\Origin\Origin.exe [3549528 2013-07-30] (Electronic Arts)
HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-04-05] (Apple Inc.)
HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)
HKCU\...\Run: [com.apple.dav.bookmarks.daemon] - C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [59720 2013-04-05] (Apple Inc.)
HKCU\...\Run: [rfxsrvtray] - D:\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKCU\...\Run: [SkyDrive] - C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257136 2013-07-02] (Microsoft Corporation)
HKCU\...\Run: [Vidalia] - "C:\Program Files (x86)\Vidalia Bridge Bundle\Vidalia\vidalia.exe" [x]
HKCU\...\RunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64" [404992 2012-07-26] (Microsoft Corporation)
HKCU\...\RunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112" [404992 2012-07-26] (Microsoft Corporation)
HKCU\...\RunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530\amd64] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530\amd64" [404992 2012-07-26] (Microsoft Corporation)
HKCU\...\RunOnce: [Uninstall C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\17.0.2010.0530" [404992 2012-07-26] (Microsoft Corporation)
MountPoints2: {6d95c1aa-cdcf-11e2-be7b-7054d21fe1ee} - "G:\setup_vmb_lite.exe" /checkApplicationPresence
MountPoints2: {e81f18db-cde8-11e2-be7c-7054d21fe1ee} - "G:\setup_vmb_lite.exe" /checkApplicationPresence
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes System\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-13] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-08-13] (Acer Incorporated)
AppInit_DLLs: C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll, C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll C:\PROGRA~2\NVIDIA~1\3DVISI~1\NVSTIN~1.DLL, C:\PROGRA~1\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll, C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll [593696 2013-07-27] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Radio.fx.LNK
ShortcutTarget: Radio.fx.LNK -> D:\Tobit Radio.fx\Client\rfx-client.exe (Tobit.Software)
Startup: C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk
ShortcutTarget: net.lnk -> C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\net.exe (No File)
Startup: C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.6.lnk
ShortcutTarget: Überwachungstool für die Intel® Turbo-Boost-Technik 2.6.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {668A6FAC-57AA-47FE-BF75-0C2926D2D7CC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKCU - {668A6FAC-57AA-47FE-BF75-0C2926D2D7CC} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com", "hxxp://mystart.incredibar.com/mb178?a=6OyL2INVeq&i=26", "hxxp://mystart.incredibar.com/mb128?a=6OyL2INVeq&i=26", "hxxp://feed.snap.do/?publisher=Somoto&dpid=Somoto&co=DE&userid=665e24d6-0ead-4372-9228-ca6807c2c0e9&searchtype=hp&installDate=31/05/2013", "about:newtab?source=home"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: ( "name": "",) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: ( "name": "",) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (iTunes Application Detector) - D:\iTunes System\Mozilla Plugins\npitunes.dll ()
CHR Extension: (YouTube) - C:\Users\DANIEL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\DANIEL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\DANIEL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.4_0
CHR Extension: (Norton Identity Protection) - C:\Users\DANIEL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.0.10_0
CHR Extension: (Late Night) - C:\Users\DANIEL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgbdhkpacgdhfabeceekiafonfkipohm\1.0_0
CHR Extension: (Gmail) - C:\Users\DANIEL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [fgibjgmnimooanbagcfpnkmngejcojaf] - C:\Program Files (x86)\HomeTab\chrome\HomeTab.crx
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Daniel Gruber\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-23] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-22] (Acer Incorporated)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2464400 2012-09-07] (Realsil Microelectronics Inc.)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-21] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14984480 2013-07-27] (NVIDIA Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1900728 2013-06-09] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-06-01] ()
R2 Radio.fx; D:\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-07-15] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-07-15] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-06-25] (DT Soft Ltd)
R3 e1cexpress; C:\Windows\system32\DRIVERS\e1c63x64.sys [452432 2013-03-06] (Intel Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-07-31] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-07-31] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-07-31] (Symantec Corporation)
S3 huawei_wwanecm; C:\Windows\system32\DRIVERS\ew_juwwanecm.sys [227840 2012-03-16] (Huawei Technologies Co., Ltd.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20130804.001\IDSvia64.sys [513184 2013-07-30] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20130804.001\IDSvia64.sys [513184 2013-07-30] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-03-21] (Intel Corporation)
S3 NAL; C:\Windows\system32\Drivers\iqvw64e.sys [33616 2013-04-05] (Intel Corporation )
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130805.023\ENG64.SYS [126040 2013-07-31] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130805.023\ENG64.SYS [126040 2013-07-31] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130805.023\EX64.SYS [2098776 2013-07-31] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130805.023\EX64.SYS [2098776 2013-07-31] (Symantec Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39712 2013-05-14] (NVIDIA Corporation)
S3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-05-07] (Synaptics Incorporated)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\NISx64\1404000.028\SymELAM.sys [23448 2012-11-15] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-07-31] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-06 11:07 - 2013-08-06 11:07 - 01788685 _____ (Farbar) C:\Users\Daniel Gruber\Desktop\FRST64.exe
2013-08-06 10:40 - 2013-08-06 10:40 - 00026676 _____ C:\Users\Daniel Gruber\Desktop\dds.txt
2013-08-06 10:40 - 2013-08-06 10:40 - 00016227 _____ C:\Users\Daniel Gruber\Desktop\AdwCleaner[S1].txt
2013-08-06 10:40 - 2013-08-06 10:40 - 00004127 _____ C:\Users\Daniel Gruber\Desktop\attach.txt
2013-08-06 10:39 - 2013-08-06 10:39 - 00688992 ____R (Swearware) C:\Users\Daniel Gruber\Desktop\dds.exe
2013-08-06 10:36 - 2013-08-06 10:36 - 00016229 _____ C:\AdwCleaner[S1].txt
2013-08-06 08:28 - 2013-08-06 08:28 - 00001077 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-06 08:28 - 2013-08-06 08:28 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\Malwarebytes
2013-08-06 08:28 - 2013-08-06 08:28 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-06 08:28 - 2013-08-06 08:28 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-06 08:28 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-06 08:05 - 2013-08-06 10:37 - 00005872 _____ C:\Windows\PFRO.log
2013-08-06 01:39 - 2013-08-06 01:51 - 00079791 _____ C:\Windows\WindowsUpdate.log
2013-08-06 00:20 - 2013-08-06 00:29 - 00000000 ____D C:\ProgramData\Freemake
2013-08-06 00:20 - 2013-08-06 00:29 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-08-06 00:20 - 2013-08-06 00:20 - 00000000 ____D C:\Users\Daniel Gruber\Documents\Freemake
2013-08-06 00:15 - 2013-08-06 00:15 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\Canneverbe Limited
2013-08-06 00:15 - 2013-08-06 00:15 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-08-04 18:35 - 2013-08-04 18:37 - 00000309 _____ C:\11.txt
2013-08-04 18:35 - 2013-08-04 18:37 - 00000000 ____D C:\tmp
2013-08-04 18:33 - 2013-08-04 18:37 - 00000000 ____D C:\Users\Daniel Gruber\Desktop\Bullet for my Valentine
2013-07-31 21:32 - 2013-07-31 21:32 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security
2013-07-31 21:21 - 2013-07-31 21:21 - 00000000 ____D C:\Users\Daniel Gruber\Documents\Syncios
2013-07-31 16:09 - 2013-07-31 16:10 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Windows Live
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Windows\PCHEALTH
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Windows\de
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-07-31 15:06 - 2013-07-31 21:27 - 00003234 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2013-07-31 15:06 - 2013-07-31 21:27 - 00002465 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2013-07-31 15:06 - 2013-07-31 17:17 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2013-07-31 15:06 - 2013-07-31 17:17 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2013-07-31 15:06 - 2013-07-31 15:06 - 00000000 ____D C:\Program Files\Symantec
2013-07-31 15:06 - 2013-07-31 15:06 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-07-31 15:05 - 2013-07-31 21:27 - 00000000 ____D C:\Windows\system32\Drivers\NISx64
2013-07-31 15:05 - 2013-07-31 15:05 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2013-07-31 15:03 - 2013-07-31 15:03 - 00000000 ____D C:\Windows\LastGood.Tmp
2013-07-31 15:03 - 2013-07-26 08:09 - 29335328 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 22100768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 15701128 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 13626160 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 11262240 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-07-31 15:03 - 2013-07-26 08:09 - 09248072 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 07695320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 07648000 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 06329552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 02968352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 02789152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 02007328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 02007328 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6432641.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6432641.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 01223336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00681760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00603424 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00586016 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00515360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00458528 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00388384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00387536 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00326224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2013-07-31 15:03 - 2013-07-26 08:09 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2013-07-31 14:39 - 2013-07-31 14:39 - 00000000 ____D C:\NvidiaLogging
2013-07-31 14:39 - 2013-05-14 21:28 - 00039712 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-07-31 14:39 - 2013-05-14 21:27 - 00029984 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-07-31 14:39 - 2013-05-14 21:27 - 00028448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-07-25 23:19 - 2013-07-25 23:19 - 00571168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2013-07-21 10:59 - 2013-07-21 10:59 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\Google
2013-07-21 10:59 - 2013-07-21 10:59 - 00000000 ____D C:\ProgramData\Google
2013-07-20 00:20 - 2013-07-20 00:20 - 00421880 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-18 16:33 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-18 16:33 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-18 16:33 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-18 16:33 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-18 16:33 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-18 16:33 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-18 16:33 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-18 16:33 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-18 16:33 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-18 16:33 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-18 16:33 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-18 16:33 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-18 16:33 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-18 16:33 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-18 16:33 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-18 16:33 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-18 16:33 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-18 16:33 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-18 16:33 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-18 16:33 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-18 16:33 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-18 16:33 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-18 16:33 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-18 16:33 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-18 16:33 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-18 16:33 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-18 16:33 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-18 16:33 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-18 16:33 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-18 16:33 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-18 16:33 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-18 16:33 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-18 16:33 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-18 16:33 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-18 16:33 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-18 16:32 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-18 16:32 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-18 16:32 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-18 16:32 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-18 16:32 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-18 16:32 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-18 16:32 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-18 16:32 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-18 16:32 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-18 16:32 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-18 16:32 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-18 16:32 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-18 16:32 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-18 16:32 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-18 16:32 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-18 16:32 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-18 16:32 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-18 16:32 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-18 16:32 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-18 16:32 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-18 16:32 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-18 16:32 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-18 16:32 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-18 16:32 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-18 16:29 - 2013-07-14 03:17 - 01882912 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6432619.dll
2013-07-18 16:29 - 2013-07-14 03:17 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6432619.dll
2013-07-18 16:29 - 2013-06-16 14:38 - 00196384 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2013-07-18 16:29 - 2013-06-16 14:38 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2013-07-16 20:06 - 2013-07-16 20:06 - 00000000 ____D C:\ProgramData\Caphyon
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Temp421e99854eba0cac6b21c57ea80de720
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Temp1cfb5cdb8ab23f7daa45d5a0e61fcda7
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\Daniel Gruber\ChromeExtensions
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\NVIDIA
2013-07-12 21:49 - 2013-07-12 21:49 - 00000000 ____D C:\Users\Daniel Gruber\Documents\Telltale Games
2013-07-12 21:17 - 2013-07-12 21:17 - 00000215 _____ C:\Users\Daniel Gruber\Desktop\The Walking Dead.url
2013-07-11 11:58 - 2013-07-11 11:59 - 00000112 _____ C:\Windows\SysWOW64\710371500.ini
2013-07-11 11:58 - 2013-07-11 11:58 - 02479616 _____ C:\Windows\SysWOW64\710371500.exe
2013-07-10 21:11 - 2013-07-11 12:02 - 00000673 _____ C:\Windows\SysWOW64\BO_xRadar_Default.ini
2013-07-10 21:08 - 2013-07-10 21:11 - 00000112 _____ C:\Windows\SysWOW64\52519776.ini
2013-07-10 21:08 - 2013-07-10 21:08 - 02479616 _____ C:\Windows\SysWOW64\52519776.exe
2013-07-07 22:25 - 2013-07-31 21:28 - 00000000 ____D C:\Users\Daniel Gruber\Desktop\x22 - xRadar
2013-07-07 22:24 - 2013-07-07 22:24 - 00001079 _____ C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\258468253.lnk
161
==================== One Month Modified Files and Folders =======
2013-08-06 11:09 - 2013-08-06 11:09 - 00000000 ____D C:\FRST
2013-08-06 11:07 - 2013-08-06 11:07 - 01788685 _____ (Farbar) C:\Users\Daniel Gruber\Desktop\FRST64.exe
2013-08-06 11:02 - 2013-05-31 17:47 - 00001138 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-06 11:00 - 2013-06-13 21:29 - 00005160 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Daniel-Daniel Gruber Daniel
2013-08-06 11:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-06 10:43 - 2013-01-31 23:23 - 00751892 _____ C:\Windows\system32\perfh007.dat
2013-08-06 10:43 - 2013-01-31 23:23 - 00155620 _____ C:\Windows\system32\perfc007.dat
2013-08-06 10:43 - 2012-07-26 09:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-06 10:42 - 2013-05-31 17:17 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2397980888-2884532311-1803219999-1001
2013-08-06 10:40 - 2013-08-06 10:40 - 00026676 _____ C:\Users\Daniel Gruber\Desktop\dds.txt
2013-08-06 10:40 - 2013-08-06 10:40 - 00016227 _____ C:\Users\Daniel Gruber\Desktop\AdwCleaner[S1].txt
2013-08-06 10:40 - 2013-08-06 10:40 - 00004127 _____ C:\Users\Daniel Gruber\Desktop\attach.txt
2013-08-06 10:39 - 2013-08-06 10:39 - 00688992 ____R (Swearware) C:\Users\Daniel Gruber\Desktop\dds.exe
2013-08-06 10:37 - 2013-08-06 08:05 - 00005872 _____ C:\Windows\PFRO.log
2013-08-06 10:37 - 2013-06-02 20:51 - 00000000 ___RD C:\Users\Daniel Gruber\SkyDrive
2013-08-06 10:37 - 2013-05-31 17:47 - 00001134 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-06 10:37 - 2013-01-31 14:50 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-06 10:37 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-06 10:36 - 2013-08-06 10:36 - 00016229 _____ C:\AdwCleaner[S1].txt
2013-08-06 08:28 - 2013-08-06 08:28 - 00001077 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-06 08:28 - 2013-08-06 08:28 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\Malwarebytes
2013-08-06 08:28 - 2013-08-06 08:28 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-06 08:28 - 2013-08-06 08:28 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-06 08:21 - 2013-06-24 11:38 - 00004196 _____ C:\Windows\System32\Tasks\Software Updater
2013-08-06 08:21 - 2013-06-24 11:38 - 00004184 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-08-06 01:51 - 2013-08-06 01:39 - 00079791 _____ C:\Windows\WindowsUpdate.log
2013-08-06 01:42 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-06 00:29 - 2013-08-06 00:20 - 00000000 ____D C:\ProgramData\Freemake
2013-08-06 00:29 - 2013-08-06 00:20 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-08-06 00:20 - 2013-08-06 00:20 - 00000000 ____D C:\Users\Daniel Gruber\Documents\Freemake
2013-08-06 00:15 - 2013-08-06 00:15 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\Canneverbe Limited
2013-08-06 00:15 - 2013-08-06 00:15 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-08-05 23:51 - 2013-05-31 18:08 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\CrashDumps
2013-08-05 23:43 - 2013-05-31 17:47 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Google
2013-08-05 00:28 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-08-04 18:37 - 2013-08-04 18:35 - 00000309 _____ C:\11.txt
2013-08-04 18:37 - 2013-08-04 18:35 - 00000000 ____D C:\tmp
2013-08-04 18:37 - 2013-08-04 18:33 - 00000000 ____D C:\Users\Daniel Gruber\Desktop\Bullet for my Valentine
2013-08-04 11:01 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\ELAM
2013-08-03 12:54 - 2013-06-05 16:19 - 00000000 ____D C:\Users\Daniel Gruber\Documents\GTA San Andreas User Files
2013-08-01 10:02 - 2012-07-26 10:12 - 00000000 ___HD C:\Windows\ELAMBKUP
2013-07-31 21:32 - 2013-07-31 21:32 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security
2013-07-31 21:28 - 2013-07-07 22:25 - 00000000 ____D C:\Users\Daniel Gruber\Desktop\x22 - xRadar
2013-07-31 21:27 - 2013-07-31 15:06 - 00003234 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2013-07-31 21:27 - 2013-07-31 15:06 - 00002465 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2013-07-31 21:27 - 2013-07-31 15:05 - 00000000 ____D C:\Windows\system32\Drivers\NISx64
2013-07-31 21:27 - 2012-09-07 13:47 - 00000000 ____D C:\ProgramData\McAfee
2013-07-31 21:21 - 2013-07-31 21:21 - 00000000 ____D C:\Users\Daniel Gruber\Documents\Syncios
2013-07-31 20:03 - 2013-05-31 18:02 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-31 17:17 - 2013-07-31 15:06 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2013-07-31 17:17 - 2013-07-31 15:06 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2013-07-31 16:10 - 2013-07-31 16:09 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Windows Live
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Windows\PCHEALTH
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Windows\de
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-07-31 16:09 - 2013-07-31 16:09 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-07-31 16:09 - 2012-07-26 10:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-07-31 15:06 - 2013-07-31 15:06 - 00000000 ____D C:\Program Files\Symantec
2013-07-31 15:06 - 2013-07-31 15:06 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-07-31 15:06 - 2013-01-31 15:05 - 00000000 ____D C:\ProgramData\Norton
2013-07-31 15:05 - 2013-07-31 15:05 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2013-07-31 15:04 - 2013-01-31 14:49 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-07-31 15:03 - 2013-07-31 15:03 - 00000000 ____D C:\Windows\LastGood.Tmp
2013-07-31 14:39 - 2013-07-31 14:39 - 00000000 ____D C:\NvidiaLogging
2013-07-31 14:39 - 2013-01-31 14:48 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-07-26 08:09 - 2013-07-31 15:03 - 29335328 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 22100768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 15701128 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 13626160 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 11262240 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-07-26 08:09 - 2013-07-31 15:03 - 09248072 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 07695320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 07648000 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 06329552 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 02968352 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 02789152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 02007328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 02007328 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6432641.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6432641.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 01223336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00681760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00603424 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00586016 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00515360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00458528 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00388384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00387536 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00326224 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2013-07-26 08:09 - 2013-07-31 15:03 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2013-07-26 08:09 - 2013-01-31 14:49 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2013-07-26 08:09 - 2013-01-31 14:49 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2013-07-26 08:09 - 2013-01-31 14:48 - 15898352 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-07-26 08:09 - 2013-01-31 14:48 - 12944800 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2013-07-26 08:09 - 2013-01-31 14:48 - 02986160 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2013-07-26 08:09 - 2013-01-31 14:48 - 02630304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2013-07-26 08:09 - 2013-01-31 14:48 - 01412832 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2013-07-26 08:09 - 2013-01-31 14:48 - 00022581 _____ C:\Windows\system32\nvinfo.pb
2013-07-26 06:59 - 2013-01-31 14:49 - 06601504 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2013-07-26 06:59 - 2013-01-31 14:49 - 03452704 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2013-07-26 06:59 - 2013-01-31 14:49 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2013-07-26 06:59 - 2013-01-31 14:49 - 00920864 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2013-07-26 06:59 - 2013-01-31 14:49 - 00219424 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2013-07-26 06:59 - 2013-01-31 14:49 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2013-07-25 23:19 - 2013-07-25 23:19 - 00571168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2013-07-24 16:30 - 2013-05-31 17:11 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Packages
2013-07-24 16:18 - 2013-05-31 17:46 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Deployment
2013-07-22 21:12 - 2013-01-31 14:49 - 03282455 _____ C:\Windows\system32\nvcoproc.bin
2013-07-21 10:59 - 2013-07-21 10:59 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\Google
2013-07-21 10:59 - 2013-07-21 10:59 - 00000000 ____D C:\ProgramData\Google
2013-07-21 10:45 - 2013-05-31 17:47 - 00000000 ____D C:\Program Files (x86)\Google
2013-07-20 00:20 - 2013-07-20 00:20 - 00421880 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-18 21:52 - 2012-07-26 09:52 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-18 21:52 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-18 16:36 - 2013-06-01 07:39 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-16 20:06 - 2013-07-16 20:06 - 00000000 ____D C:\ProgramData\Caphyon
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Temp421e99854eba0cac6b21c57ea80de720
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\Temp1cfb5cdb8ab23f7daa45d5a0e61fcda7
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\Daniel Gruber\ChromeExtensions
2013-07-16 20:05 - 2013-07-16 20:05 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\NVIDIA
2013-07-16 20:05 - 2013-05-31 17:11 - 00000000 ___RD C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-16 20:05 - 2013-05-31 17:11 - 00000000 ____D C:\Users\Daniel Gruber
2013-07-15 16:27 - 2013-06-02 18:32 - 00000000 ____D C:\Program Files\Microsoft Office 15
2013-07-14 03:17 - 2013-07-18 16:29 - 01882912 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6432619.dll
2013-07-14 03:17 - 2013-07-18 16:29 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6432619.dll
2013-07-14 00:05 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\NDF
2013-07-13 22:16 - 2013-05-31 17:25 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\clear.fi
2013-07-12 21:49 - 2013-07-12 21:49 - 00000000 ____D C:\Users\Daniel Gruber\Documents\Telltale Games
2013-07-12 21:17 - 2013-07-12 21:17 - 00000215 _____ C:\Users\Daniel Gruber\Desktop\The Walking Dead.url
2013-07-12 21:17 - 2013-05-31 19:43 - 00000000 ____D C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-07-12 12:57 - 2013-05-31 17:47 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 12:57 - 2013-05-31 17:47 - 00003874 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 12:02 - 2013-07-10 21:11 - 00000673 _____ C:\Windows\SysWOW64\BO_xRadar_Default.ini
2013-07-11 11:59 - 2013-07-11 11:58 - 00000112 _____ C:\Windows\SysWOW64\710371500.ini
2013-07-11 11:58 - 2013-07-11 11:58 - 02479616 _____ C:\Windows\SysWOW64\710371500.exe
2013-07-10 21:11 - 2013-07-10 21:08 - 00000112 _____ C:\Windows\SysWOW64\52519776.ini
2013-07-10 21:08 - 2013-07-10 21:08 - 02479616 _____ C:\Windows\SysWOW64\52519776.exe
2013-07-10 15:14 - 2013-06-12 20:12 - 00000000 ____D C:\Users\DANIEL~1\AppData\Local\IW4M
2013-07-07 22:24 - 2013-07-07 22:24 - 00001079 _____ C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\258468253.lnk
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-31 13:29
==================== End Of Log ============================
-------- Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-08-2013 Ran by Daniel Gruber at 2013-08-06 11:10:12 Running from C:\Users\Daniel Gruber\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= clear.fi SDK - Video 2 (x32 Version: 2.1.1925) clear.fi SDK- Movie 2 (x32 Version: 2.1.2008) Acer Power Management (Version: 7.00.3006) Acer Recovery Management (Version: 6.00.3011) AcerCloud (x32 Version: 2.01.3115) AcerCloud Docs (x32 Version: 1.00.3201) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) Call of Duty: Black Ops - Multiplayer (x32) Call of Duty: Black Ops (x32) Call of Duty: Black Ops II - Zombies (x32) Call of Duty: Modern Warfare 2 - Multiplayer (x32) Call of Duty: Modern Warfare 2 (x32) Cheat Engine 6.3 (x32) clear.fi Media (x32 Version: 2.01.3108) clear.fi Photo (x32 Version: 2.01.3108) Counter-Strike: Source (x32) Crysis®3 (x32 Version: 1.0.0.0) D3DX10 (x32 Version: 15.4.2368.0902) Far Cry 3 (x32 Version: 1.05) FLAC To MP3 V4.0.4 (x32) Fotogalerie (x32 Version: 16.4.3508.0205) Free Driver Scout (Version: 1.0.0.101) Free Driver Scout (x32 Version: 1.0.0.101) Google Chrome (x32 Version: 28.0.1500.95) Google Update Helper (x32 Version: 1.3.21.153) Grand Theft Auto San Andreas (x32 Version: 1.00.00001) Hotkey Utility (x32 Version: 3.00.3003) iCloud (Version: 2.1.2.8) Identity Card (x32 Version: 2.00.3004) Intel(R) Control Center (x32 Version: 1.2.1.1008) Intel(R) Management Engine Components (x32 Version: 9.5.0.1428) Intel(R) Network Connections 18.3.72.0 (Version: 18.3.72.0) Intel(R) Rapid Storage Technology (x32 Version: 11.5.4.1001) Intel® Trusted Connect Service Client (Version: 1.27.798.1) Intel® Watchdog Timer Driver (Intel® WDT) (x32) iTunes (Version: 11.0.4.4) Java 7 Update 21 (64-bit) (Version: 7.0.210) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Live Updater (x32 Version: 2.00.3004) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft SkyDrive (HKCU Version: 17.0.2011.0627) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60940.0) Movie Maker (x32 Version: 16.4.3508.0205) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT110 (x32 Version: 16.4.1108.0727) MSVCRT110_amd64 (Version: 16.4.1109.0912) MyWinLocker (Version: 4.0.14.35) MyWinLocker 4 (x32 Version: 4.0.14.35) MyWinLocker Suite (x32 Version: 4.0.14.24) Nero 12 Essentials OEM.a01 (x32 Version: 12.5.00000) Nero ControlCenter (x32 Version: 11.0.14500.0.45) Nero ControlCenter Help (CHM) (x32 Version: 12.0.0003) Nero Core Components (x32 Version: 11.0.16900.1.27) Nero Express (x32 Version: 12.0.16001) Nero Express Help (CHM) (x32 Version: 12.0.1000) Nero Launcher (x32 Version: 12.0.3000) Nero Update (x32 Version: 11.0.11500.28.0) Norton Internet Security (x32 Version: 20.4.0.40) NVIDIA 3D Vision Controller-Treiber 326.41 (Version: 326.41) NVIDIA 3D Vision Treiber 326.41 (Version: 326.41) NVIDIA GeForce Experience 1.6 (Version: 1.6) NVIDIA Grafiktreiber 326.41 (Version: 326.41) NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4) NVIDIA Install Application (Version: 2.1002.132.865) NVIDIA PhysX (x32 Version: 9.13.0604) NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2641) NVIDIA Systemsteuerung 326.41 (Version: 326.41) NVIDIA Update 7.2.17 (Version: 7.2.17) NVIDIA Update Components (Version: 7.2.17) NVIDIA Virtual Audio 1.2.1 (Version: 1.2.1) Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4517.1005) Office 15 Click-to-Run Licensing Component (Version: 15.0.4517.1005) Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4517.1005) Office Addin (x32 Version: 2.01.3200) Origin (x32 Version: 9.1.15.109) Photo Common (x32 Version: 16.4.3508.0205) Photo Gallery (x32 Version: 16.4.3508.0205) Prerequisite installer (x32 Version: 12.0.0002) PunkBuster Services (x32 Version: 0.993) QuickTime (x32 Version: 7.74.80.86) Radio.fx (x32) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6886) Realtek USB 2.0 Card Reader (x32 Version: 6.2.8400.30143) rosoft Office 365 Home Premium - de-de (Version: 15.0.4517.1005) Shared C Run-time for x64 (Version: 10.0.0) SHIELD Streaming (Version: 1.05.19) Shredder (Version: 2.0.8.9) Shredder (x32 Version: 2.0.8.9) Steam (x32 Version: 1.0.0.0) System Requirements Lab for Intel (x32 Version: 4.5.13.0) The Walking Dead (x32) Überwachungstool für die Intel® Turbo-Boost-Technik 2.6 (Version: 2.6.2.0) Update Installer for WildTangent Games App (x32) Uplay (x32 Version: 2.0) Visual Studio 2005 Tools for Office Second Edition Runtime (x32) Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729) Visual Studio Tools for the Office system 3.0 Runtime (x32) Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (x32 Version: 1) Windows Live Communications Platform (x32 Version: 16.4.3508.0205) Windows Live Essentials (x32 Version: 16.4.3508.0205) Windows Live Installer (x32 Version: 16.4.3508.0205) Windows Live Photo Common (x32 Version: 16.4.3508.0205) Windows Live PIMT Platform (x32 Version: 16.4.3508.0205) Windows Live SOXE (x32 Version: 16.4.3508.0205) Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205) Windows Live UX Platform (x32 Version: 16.4.3508.0205) Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205) ==================== Restore Points ========================= 05-08-2013 21:42:13 Google SketchUp 8 wurde entfernt ==================== Hosts content: ========================== 2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {003D4475-9D03-44B7-8146-FB018828F5C7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-31] (Google Inc.) Task: {053F1CC7-2ACC-4E22-83AD-B174CCF0CA56} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2012-08-30] () Task: {09527602-9CEB-44A3-AA7C-9E90102EA38A} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation) Task: {12524E84-0A05-44AC-93A5-F04ADA63CF5E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler Task: {18A1E1CB-BD98-458B-BC60-BE21EDC2C759} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation) Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh Task: {2CDD26AE-B280-433F-BEAF-2C67F295E349} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe [2013-06-04] (Symantec Corporation) Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation) Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation) Task: {627E0D26-03F7-4E17-A934-717E8D1DAFE7} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall Task: {674B1103-7D2E-476C-B688-C11C8886951C} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {692DE29E-0D47-4AC4-8DB9-32C4AC5101B3} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation) Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation) Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update Task: {7CB2E637-BC2E-4B12-A8BE-7D3CED852672} - System32\Tasks\Hotkey Utility => C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [2012-08-06] (Acer Incorporated) Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance Task: {7ED12B70-4046-4E6F-8A74-8BF7E16339D1} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2012-06-22] () Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance Task: {85F64885-0EC7-4454-A029-5B7182F69742} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2012-07-12] (Egis Technology Inc.) Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode) Task: {876B549F-7FDF-4055-BADA-842D186293FA} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Task: {95F59F0E-81A3-45FB-8624-BB57A15F4E7D} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-08-22] (Acer Incorporated) Task: {98201EB9-61FB-42D7-BC39-1462F2290EDE} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic Task: {9A0EE62B-A3BF-466E-B0F9-8C875AF157EA} - System32\Tasks\Software Updater => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe No File Task: {9C1FFE84-D09C-44C6-B149-EFC911A3D067} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2397980888-2884532311-1803219999-500 Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask Task: {A8579644-384E-43BD-8C6B-81417F1AF4C9} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2013-04-05] (Apple Inc.) Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask Task: {ACE46D77-2E53-47A0-813B-991DA333E213} - System32\Tasks\Browser Updater\Browser Updater => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific Task: {BC9B3930-C0E7-4657-9677-0072A9A6CD1C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-31] (Google Inc.) Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender Task: {C53C5662-B33E-4213-93AE-FF32733A50B3} - System32\Tasks\Software Updater Ui => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Ui.exe No File Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork Task: {D211B692-5E64-474F-91A5-27314E8A9C65} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation) Task: {D30C6AA6-831D-4C3D-B959-35F4804263A4} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-06-09] (Microsoft Corporation) Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical Task: {DDB3F010-C45B-47EB-AFA5-BCC0C74C03D9} - System32\Tasks\FreeDriverScout => C:\Program Files\Covus Freemium\Free Driver Scout\1Click.exe No File Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery Task: {DF9A8280-55BF-4C21-AE8A-C16A6C4E3826} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Daniel-Daniel Gruber Daniel => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2013-07-10] (Microsoft Corporation) Task: {E2B3AC40-D356-4014-A392-B2DCE0EE9C50} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2397980888-2884532311-1803219999-1001 Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask Task: {E7D45AC6-25D6-475A-B657-00013E73FC9D} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2013-07-10] (Microsoft Corporation) Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation) Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM Task: {F5BEE7CC-8F5F-455B-A301-2C832C6E6D0E} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2012-07-12] (Egis Technology Inc.) Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/06/2013 10:37:13 AM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/06/2013 10:37:12 AM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] Error: (08/06/2013 08:41:45 AM) (Source: Office 2013 Licensing Service) (User: ) Description: Subscription licensing service failed: -1073415161 Error: (08/06/2013 08:39:40 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: Daniel) Description: Bei der Aktivierung der App „20100AronStifaniDanijelJa.ListenYoutube_sd22p9amghr9g!App“ ist folgender Fehler aufgetreten: -2144927150. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“. Error: (08/06/2013 08:05:35 AM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/06/2013 08:05:34 AM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] Error: (08/05/2013 11:32:45 PM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/05/2013 11:32:44 PM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] Error: (08/05/2013 09:20:07 AM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/05/2013 09:20:07 AM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] System errors: ============= Error: (08/06/2013 10:37:42 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (08/06/2013 10:37:42 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht. Error: (08/06/2013 08:05:33 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (08/05/2013 11:32:43 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (08/05/2013 09:20:05 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (08/05/2013 09:04:56 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (08/04/2013 11:00:07 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (08/03/2013 11:07:04 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (08/02/2013 10:00:27 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Error: (08/01/2013 10:03:02 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UAC-Dateivirtualisierung" wurde aufgrund folgenden Fehlers nicht gestartet: %%1275 Microsoft Office Sessions: ========================= Error: (08/06/2013 10:37:13 AM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/06/2013 10:37:12 AM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] Error: (08/06/2013 08:41:45 AM) (Source: Office 2013 Licensing Service)(User: ) Description: Subscription licensing service failed: -1073415161 Error: (08/06/2013 08:39:40 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: Daniel) Description: 20100AronStifaniDanijelJa.ListenYoutube_sd22p9amghr9g!App-2144927150 Error: (08/06/2013 08:05:35 AM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/06/2013 08:05:34 AM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] Error: (08/05/2013 11:32:45 PM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/05/2013 11:32:44 PM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] Error: (08/05/2013 09:20:07 AM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] Error: (08/05/2013 09:20:07 AM) (Source: NvStreamSvc)(User: ) Description: NvStreamSvcNvVAD endpoint registered successfully [0] ==================== Memory info =========================== Percentage of memory in use: 31% Total physical RAM: 8134.04 MB Available physical RAM: 5602.5 MB Total Pagefile: 9350.04 MB Available Pagefile: 6434.67 MB Total Virtual: 8192 MB Available Virtual: 8191.76 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:59.01 GB) (Free:7.82 GB) NTFS (Disk=0 Partition=4) Drive d: (DATA) (Fixed) (Total:2769.52 GB) (Free:2660 GB) NTFS (Disk=1 Partition=1) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 60 GB) (Disk ID: EDE21ECD) Partition: GPT Partition Type ======================================================== Disk: 1 (Size: 2795 GB) (Disk ID: EDE21EE1) Partition: GPT Partition Type ==================== End Of Log ============================ |
|
06.08.2013, 12:32
| #8 |
| /// TB-Ausbilder | 19 bösartige Risiken gefunden!..bin hilflos Da ist eigentlich nix mehr gross zu sehen: Schritt 1: (Erinnerung: Antworte mir erst, wenn du alle Schritte abgearbeitet hast!) Fix mit FRST Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter
Task: {C53C5662-B33E-4213-93AE-FF32733A50B3} - System32\Tasks\Software Updater Ui => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Ui.exe No File
C:\Program Files\SoftwareUpdater
CHR HKLM-x32\...\Chrome\Extension: [fgibjgmnimooanbagcfpnkmngejcojaf] - C:\Program Files (x86)\HomeTab\chrome\HomeTab.crx
CHR HKLM-x32\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Daniel Gruber\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx
C:\Program Files (x86)\HomeTab
C:\Users\Daniel Gruber\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg
Schritt 2: Scan mit SystemLook
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
06.08.2013, 13:26
| #9 |
| | 19 bösartige Risiken gefunden!..bin hilflosCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-08-2013
Ran by Daniel Gruber at 2013-08-06 14:20:43 Run:1
Running from C:\Users\Daniel Gruber\Desktop\Behebung bösartiger Malware
Boot Mode: Normal
==============================================
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C53C5662-B33E-4213-93AE-FF32733A50B3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C53C5662-B33E-4213-93AE-FF32733A50B3} => Key not found.
C:\Windows\System32\Tasks\Software Updater Ui => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Software Updater Ui => Key not found.
"C:\Program Files\SoftwareUpdater" => File/Directory not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\fgibjgmnimooanbagcfpnkmngejcojaf => Key deleted successfully.
"C:\Program Files (x86)\HomeTab\chrome\HomeTab.crx" => File/Directory not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg => Key deleted successfully.
C:\Users\Daniel Gruber\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx => Moved successfully.
"C:\Program Files (x86)\HomeTab" => File/Directory not found.
C:\Users\Daniel Gruber\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 14:22 on 06/08/2013 by Daniel Gruber
Administrator - Elevation successful
========== filefind ==========
Searching for "*hometab*"
C:\Users\Daniel Gruber\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\hometab.tmp.log --a---- 770 bytes [09:39 24/06/2013] [09:39 24/06/2013] B0C0B3D7141BC82A8F4FEC3EDF1B13D2
C:\Users\Daniel Gruber\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MZLUT317\style_hometab[1].css --a---- 23454 bytes [07:28 06/08/2013] [07:28 06/08/2013] 417CFF3D9B305862E157EAD8AF39157E
========== regfind ==========
Searching for "hometab"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Simplytech\HomeTab]
[HKEY_CURRENT_USER\Software\SimplyTech\HomeTab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\HomeTab.DLL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}\1.0\0\win32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}\1.0\HELPDIR]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25e93bf1-df51-467b-b51d-fd4bd3ddb4f9}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6fa0479b-417c-4317-b7cd-64b238930796}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{af02e7d2-e73d-468c-9bbc-87367e8a4faf}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ba696155-d96e-4281-b467-0367a0456474}]
@="HomeTab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ba696155-d96e-4281-b467-0367a0456474}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\HomeTab.DLL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}\1.0\0\win32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}\1.0\HELPDIR]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{92808042-fb78-4fa0-bb4f-c9a95e0e9c10}]
@="HomeTab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\HomeTab_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\HomeTab_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{25e93bf1-df51-467b-b51d-fd4bd3ddb4f9}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6fa0479b-417c-4317-b7cd-64b238930796}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{af02e7d2-e73d-468c-9bbc-87367e8a4faf}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ba696155-d96e-4281-b467-0367a0456474}]
@="HomeTab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ba696155-d96e-4281-b467-0367a0456474}\InprocServer32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\HomeTab.DLL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}\1.0\0\win32]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab\HomeTab.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}\1.0\HELPDIR]
@="C:\Users\Daniel Gruber\AppData\Roaming\HomeTab"
[HKEY_USERS\S-1-5-21-2397980888-2884532311-1803219999-1001\Software\AppDataLow\Software\Simplytech\HomeTab]
[HKEY_USERS\S-1-5-21-2397980888-2884532311-1803219999-1001\Software\SimplyTech\HomeTab]
-= EOF =-
|
|
06.08.2013, 13:42
| #10 |
| /// TB-Ausbilder | 19 bösartige Risiken gefunden!..bin hilflos Danach sollte eigentlich nix mehr da sein: Farbars MiniRegTool (Schlüssel löschen) Bitte lade dir die passende Programmversion auf deinen Desktop: MiniRegTool | MiniRegTool64
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
06.08.2013, 13:49
| #11 |
| | 19 bösartige Risiken gefunden!..bin hilflosCode:
ATTFilter MiniRegTool64 by Farbar Version:18-06-2013
Ran by Daniel Gruber (administrator) on 2013-08-06 14:49:00
====================================
"HKEY_CURRENT_USER\Software\AppDataLow\Software\Simplytech\HomeTab" deleted successfully.
"HKEY_CURRENT_USER\Software\SimplyTech\HomeTab" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\HomeTab.DLL" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25e93bf1-df51-467b-b51d-fd4bd3ddb4f9}" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6fa0479b-417c-4317-b7cd-64b238930796}" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{af02e7d2-e73d-468c-9bbc-87367e8a4faf}" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ba696155-d96e-4281-b467-0367a0456474}" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{92808042-fb78-4fa0-bb4f-c9a95e0e9c10}" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\HomeTab_RASAPI32" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\HomeTab_RASMANCS" deleted successfully.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{25e93bf1-df51-467b-b51d-fd4bd3ddb4f9}" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6fa0479b-417c-4317-b7cd-64b238930796}" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{af02e7d2-e73d-468c-9bbc-87367e8a4faf}" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ba696155-d96e-4281-b467-0367a0456474}" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ba696155-d96e-4281-b467-0367a0456474}" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\HomeTab.DLL" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}" not found.
"HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{5B191EA7-F309-4D2F-AAA5-C77D84D29CCD}" not found.
"HKEY_USERS\S-1-5-21-2397980888-2884532311-1803219999-1001\Software\AppDataLow\Software\Simplytech\" deleted successfully.
"HKEY_USERS\S-1-5-21-2397980888-2884532311-1803219999-1001\Software\SimplyTech" deleted successfully.
" " not found.
|
|
06.08.2013, 13:55
| #12 |
| | 19 bösartige Risiken gefunden!..bin hilflos Schau mal im Anhang dieser Antwort ist ein Bild. Habe den Pc grad neugestartet, nachdem ich mit dem Tool, Farbars MiniRegTool, die Schlüssel gelöscht habe. Die Meldung kommt trotzdem. Ich habe gehört man muss dem irgendwie mit dem Autostart ausmachen aber ich habe keine Ahnung wie des geht, fällt dir vielleicht was dazu ein?  Ps: Habe Windows 8 da ist es bisschen anders Aufgebaut mit Task Manager, also bei der msconfig wenn du da auf den Reiter Autostart klickst steht da das der "Autostart" vom TaskManager übernommen wird bzw. im Taskmanager steht ein Reiter der Autostart heist aber des Blick ich alles nicht. |
|
06.08.2013, 15:56
| #13 |
| /// TB-Ausbilder | 19 bösartige Risiken gefunden!..bin hilflos Ich weiß durchaus über Windows 8 bescheid. Danke. Aber solange ich keinen Startpunkt für diese Datei sehe kann ich ihn auch nicht entfernen. Browserreset mit ZOEK Achtung! Sichere vorher deine Bookmarks und persönlichen Einstellungen! Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
07.08.2013, 10:48
| #14 |
| | 19 bösartige Risiken gefunden!..bin hilflosCode:
ATTFilter Zoek.exe Version 4.0.0.4 Updated 31-07-2013
Tool run by Daniel Gruber on 07.08.2013 at 11:34:07,44.
Microsoft Windows 8 6.2.9200 x64
Running in: Normal Mode Internet Access Detected
Launched: D:\Downloads\zoek.exe [Checkboxes used]
==== System Restore Info ======================
07.08.2013 11:35:06 Zoek.exe System Restore Point Created Succesfully.
==== Reset Hosts File ======================
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== Deleting Files \ Folders ======================
"C:\windows\SysNative\Tasks\Software Updater" deleted
"C:\Windows\Launcher.exe" deleted
"C:\Users\Daniel Gruber\ChromeExtensions" deleted
"C:\ProgramData\FreeDriverScout" deleted
"C:\ProgramData\Package Cache" deleted
==== Chrome Look ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx[31.05.2013 03:49]
AdBlock - Daniel Gruber - Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Norton Identity Protection - Daniel Gruber - Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com/ie"
"Default_Search_URL"="hxxp://www.google.com/ie"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
"Search Bar"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
"(Default)"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
"(Default)"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="hxxp://www.google.com"
"(Default)"="hxxp://www.google.com"
@="hxxp://www.google.com/search?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Bar"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
"Search Page"="hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.6&ts=1372066764915&tguid=46364-3869-1372066764915-58DAEFE7ADBBEE3D35578C7B39468612&st=chrome&q="
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://www.google.com/"
"Search Bar"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://www.google.com/"
"Search Bar"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://www.google.com/ie"
"SearchAssistant"="hxxp://www.google.com/ie"
"Search Bar"="hxxp://www.google.com"
"Search Page"="hxxp://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURI]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="hxxp://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="hxxp://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{668A6FAC-57AA-47FE-BF75-0C2926D2D7CC} Unknown Url="Not_Found"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{FE7F7C93-D833-4710-B5A4-159DE48B944D} Google Url="hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
==== Reset Google Chrome ======================
C:\users\Daniel Gruber\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\users\Daniel Gruber\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-2397980888-2884532311-1803219999-1001\Software\Microsoft\Internet Explorer\SearchScopes\{668A6FAC-57AA-47FE-BF75-0C2926D2D7CC} deleted successfully
==== Deleting CLSID Registry Values ======================
==== shortcuts on Users Desktops ======================
C:\Users\Daniel Gruber\Desktop\Computer.lnk -
C:\Users\Daniel Gruber\Desktop\DATA (D).lnk - D:\
C:\Users\Daniel Gruber\Desktop\Grand Theft Auto San Andreas.lnk - D:\Rockstar Games\Grand Theft Auto San Andreas\Grand Theft Auto San Andreas\gta_sa.exe
C:\Users\Daniel Gruber\Desktop\Play IW4M (Modern Warfare 2).lnk - C:\Users\Daniel Gruber\AppData\Local\IW4M\LaunchIW4M.exe
C:\Users\Daniel Gruber\Desktop\Privater Ordner - Verknüpfung.lnk -
C:\Users\Daniel Gruber\Desktop\Systemsteuerung.lnk -
C:\Users\Daniel Gruber\Desktop\Uplay.lnk - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay.exe
C:\Users\Daniel Gruber\Desktop\Word 2013.lnk - C:\Program Files (x86)\Microsoft Office 15\root\office15\WINWORD.EXE
C:\Users\Daniel Gruber\Desktop\Behebung bösartiger Malware\ Malwarebytes Anti-Malware .lnk -
==== shortcuts on All Users Desktop ======================
C:\Users\Public\Desktop\Crysis 3.lnk - D:\Origin\Origin Games\Crysis 3\bin32\Crysis3.exe
C:\Users\Public\Desktop\GeForce Experience.lnk - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\iTunes.lnk - D:\iTunes System\iTunes.exe
C:\Users\Public\Desktop\Norton Internet Security.lnk - C:\Program Files (x86)\Norton Internet Security\Engine64\20.4.0.40\uistub.exe
C:\Users\Public\Desktop\Origin.lnk - D:\Origin\Origin.exe
==== shortcuts in Users Start Menu ======================
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\258468253.lnk - C:\Users\Daniel Gruber\Desktop\rhhatha\xClient_v1.0_Build_v3.7\258468253.exe.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk - C:\Users\Daniel Gruber\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk - C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\net.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tixati\Tixati.lnk - D:\Programme\tixati\tixati.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Benutzerhandbuch für die Konsolenversion von RAR.lnk -
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Hilfe zu WinRAR.lnk - D:\Win.rar\WinRAR.chm
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk - D:\Win.rar\WinRAR.exe
==== shortcuts in All Users Start Menu ======================
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk - C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLAC To MP3\FLAC To MP3.lnk - D:\Programme\FLAC To MP3\flac2mp3.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLAC To MP3\Uninstall FLAC To MP3.lnk - D:\Programme\FLAC To MP3\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iPhone-Konfigurationsprogramm\iPhone-Konfigurationsprogramm.lnk - C:\Windows\Installer\{B90FCEB7-2B0C-4D27-95B5-54238DF059ED}\iPCUIco.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware entfernen.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Notifications.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\ Malwarebytes Anti-Malware .lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security\Norton Internet Security.lnk - C:\Program Files (x86)\Norton Internet Security\Engine64\20.4.0.40\uistub.exe /win8
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation\GeForce Experience.lnk - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vidalia Bridge Bundle\Uninstall.lnk - C:\Program Files (x86)\Vidalia Bridge Bundle\Uninstall.exe
==== shortcuts in Quick Launch ======================
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\3herosoft iPhone to Computer Transfer.lnk - D:\iPhone to Computer Transfer\iPodManager.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\djukebox.LNK - D:\Tobit Radio.fx\Client\djukebox.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FLAC To MP3.lnk - D:\Programme\FLAC To MP3\flac2mp3.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Radio.fx.LNK - D:\Tobit Radio.fx\Client\rfx-client.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Acer Power Button.lnk - C:\Program Files (x86)\Acer\Acer Power Management\ePowerButton.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AcerCloud Docs.lnk - C:\Program Files (x86)\Acer\AcerCloud Docs\AcerCloud Docs.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\clear.fi Media.lnk - C:\Program Files (x86)\Acer\clear.fi Media\ClearfiMedia.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\clear.fi Photo.lnk - C:\Program Files (x86)\Acer\clear.fi Photo\ClearfiPhoto.exe
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk - C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Libraries
C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
==== Empty IE Cache ======================
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Daniel Gruber\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Daniel Gruber\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
C:\users\Daniel Gruber\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\DANIEL~1\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on 07.08.2013 at 11:46:13,93 ======================
|
|
07.08.2013, 10:54
| #15 |
| /// TB-Ausbilder | 19 bösartige Risiken gefunden!..bin hilflos Ah jetzt. Schritt 1: (Erinnerung: Antworte mir erst, wenn du alle Schritte abgearbeitet hast!) Fix mit FRST Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter
Startup: C:\Users\Daniel Gruber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk
ShortcutTarget: net.lnk -> C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data\net.exe (No File)
C:\Users\Daniel Gruber\AppData\Roaming\Windows Net Data
Schritt 2:
Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus. Es wird nur eine FRST.txt erzeugt. Poste mir diese.
Schritt 3:
Das sollte es gewesen sein.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
| Themen zu 19 bösartige Risiken gefunden!..bin hilflos |
| anti-malware, combofix, deaktivieren, entdeck, heuristics.shuriken, hijack.searchpage, home, logfile, malware, malwarebytes, meldung, nichts, programm, programme, pup.optional.netdata.a, pup.optional.tarma.a, rechtsklick, roaming, tarma, trojaner, windows |
Linear-Darstellung
