Windows 7: Kaspersky Internet Security 2013 findet Trojaner HEUR:Exploit.Java.CVE-2013-1493.gen

schrauber · 26.08.2013, 17:55

Sollte dich zu filepony führen wo du den entsprechenden Browser aussuchen kannst

Erik1000 · 27.08.2013, 10:14

Hallo Schrauber,

kam durch deinen Link auch auf die filepony-Seite, aber mit dem Link zum Runterladen tat sich nichts. Habe auf der Startseite von filepony aber WOT für firefox gefunden. Allerdings konnte ich es nicht entpacken. Habe dann den angegebenen zip-opener darunter runtergeladen. Der hat aber vieles durcheinandergebracht. Da kam dann zusätzlich Deltasearch (hat Kaspersky sofort gemeckert wegen vieler Sicherheitslücken und mein GMX Zugang war auch umständlicher geworden) und noch andere Programme (price beep...) Winpatrol hat auch viel gebellt.
Habe dann das System zurückgesetzt und nun ist alles wieder gut. Hast Du noch eine Lösung? Ansonsten geht es auch ohne WOT.
Viele Grüße Erik1000

schrauber · 27.08.2013, 11:10

Du hast auf die WErbung geklickt anstatt auf den Download. Poste ein frisches FRST log, ich schau kurz drüber.

Erik1000 · 27.08.2013, 13:56

Hallo Schrauber,

anbei der frische FRST.

Gruß Erik1000

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-08-2013 02 (ATTENTION: ====> FRST version is 6 days old and could be outdated)
Ran by eh (administrator) on 27-08-2013 14:52:49
Running from C:\Users\eh\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\system32\sdclt.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-04-12] (Google Inc.)
HKCU\...\Run: [WinPatrol] - C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [439360 2013-08-13] (BillP Studios)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [688128 2011-07-06] ()
HKLM-x32\...\Run: [CLX3180_Scan2Pc] - C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [3180 Scan2PC] - C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-11-16] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1481280 2013-07-01] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1601488 2013-08-06] (APN)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/tb/ie_startpage
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {0BFFCEE0-9808-4EDA-8D13-2D1D414BC027} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {19167A5C-815E-4BED-A280-EEE7D4CD3E3D} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL = hxxp://go.mail.com/br/ie8_search_web/?su={searchTerms}
SearchScopes: HKCU - {8D9A183F-79E7-4986-A0DA-302A21EEF529} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {B0B60347-DD99-4B69-B9A5-CE72259C1ED2} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: GMX Konfiguration - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Homepage: hxxp://go.gmx.net/tb/mff_startpage
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\webde-suche.xml
FF Extension: DealPly  Shopping - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979}
FF Extension: pricepeep - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\pricepeep@getpricepeep.com.xpi
FF Extension: toolbar - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\toolbar@gmx.net.xpi
FF Extension: toolbar_ORJ-V7 - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Kaspersky URL Advisor) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: (DealPly  Shopping) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0
CHR Extension: (Virtual Keyboard) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (Anti-Banner) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

==================== Services (Whitelisted) =================

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-08-06] (APN LLC.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-11-16] (Kaspersky Lab ZAO)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2011-10-07] ()

==================== Drivers (Whitelisted) ====================

S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-24] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-11-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-11-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-24] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-27 10:29 - 2013-08-27 10:29 - 00000000 ____D C:\Users\eh\AppData\Roaming\Optimizer Pro
2013-08-27 10:24 - 2013-08-27 10:42 - 00000000 ____D C:\Users\eh\AppData\Roaming\BabSolution
2013-08-27 10:24 - 2013-08-27 10:42 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-08-26 14:04 - 2013-08-26 14:04 - 00001468 _____ C:\Users\eh\Desktop\psi - Verknüpfung.lnk
2013-08-26 12:17 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-08-26 12:17 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-08-26 12:17 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-08-26 12:17 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-08-26 12:17 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-08-26 12:17 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-08-26 12:17 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-08-26 12:17 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-08-26 12:17 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-08-26 12:17 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-08-26 12:17 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-26 12:17 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-08-26 12:17 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-08-26 12:17 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-26 12:17 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-08-26 12:17 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-26 12:17 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-08-26 12:17 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-08-26 12:17 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-26 12:17 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-08-26 12:17 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-08-26 12:17 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-08-26 12:17 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-08-26 12:17 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-26 12:17 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-26 12:16 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-08-26 12:16 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-08-26 12:16 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-08-26 12:16 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-08-26 12:16 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-26 12:16 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-08-26 12:16 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-08-26 12:15 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-08-26 12:15 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-08-26 12:11 - 2013-08-26 12:11 - 00261990 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-25 18:49 - 2013-08-25 18:49 - 00922152 _____ (BillP Studios) C:\Users\eh\Desktop\wpsetup.exe
2013-08-24 13:35 - 2013-08-24 13:35 - 00000005 _____ C:\Users\eh\AppData\Roaming\WBPU-TTL.DAT
2013-08-24 12:41 - 2013-08-25 18:50 - 00000000 ____D C:\ProgramData\InstallMate
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Users\eh\AppData\Roaming\WinPatrol
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-08-24 12:34 - 2013-08-25 18:40 - 00000000 ____D C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
2013-08-24 12:34 - 2013-08-25 18:40 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\DSite
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Dealply
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Local\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-08-24 12:07 - 2013-08-26 14:17 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-24 12:07 - 2013-08-24 12:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 12:06 - 2013-08-24 12:06 - 02434048 _____ C:\Users\eh\Desktop\msxml.msi
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Users\eh\AppData\Local\Secunia PSI
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-24 11:59 - 2013-08-24 11:59 - 03272136 _____ (Secunia) C:\Users\eh\Desktop\PSISetup711.exe
2013-08-23 17:22 - 2013-08-23 17:22 - 00448512 _____ (OldTimer Tools) C:\Users\eh\Desktop\TFC.exe
2013-08-23 09:10 - 2013-08-23 09:10 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\APN
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-08-22 14:19 - 2013-08-22 14:19 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-22 14:19 - 2013-08-22 14:19 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-22 13:07 - 2013-08-22 13:07 - 01576476 _____ (Farbar) C:\Users\eh\Desktop\FRST64.exe
2013-08-22 03:38 - 2013-08-22 03:38 - 00891115 _____ C:\Users\eh\Desktop\SecurityCheck.exe
2013-08-21 14:32 - 2013-08-21 17:52 - 00000000 ____D C:\AdwCleaner
2013-08-21 14:31 - 2013-08-21 14:31 - 00975858 _____ C:\Users\eh\Desktop\adwcleaner.exe
2013-08-21 14:15 - 2013-08-25 18:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-21 14:15 - 2013-08-21 14:15 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\Users\eh\AppData\Roaming\Malwarebytes
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 14:15 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-21 14:09 - 2013-08-21 14:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\eh\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-21 14:01 - 2013-08-27 10:27 - 00000000 ____D C:\Users\eh\Trojaner Board
2013-08-21 12:06 - 2013-08-21 12:06 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-21 12:03 - 2013-08-21 12:03 - 01110476 _____ C:\Users\eh\Desktop\7z920.exe
2013-08-21 11:51 - 2013-08-21 11:51 - 00017512 _____ C:\ComboFix.txt
2013-08-21 11:30 - 2013-08-21 11:51 - 00000000 ____D C:\ComboFix
2013-08-21 11:30 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-21 11:30 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-21 11:30 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-21 11:30 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-21 11:30 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-21 11:30 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-21 11:30 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-21 11:30 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-21 11:29 - 2013-08-21 11:51 - 00000000 ____D C:\Qoobox
2013-08-21 11:29 - 2013-08-21 11:50 - 00000000 ____D C:\Windows\erdnt
2013-08-21 11:27 - 2013-08-21 11:27 - 05109244 ____R (Swearware) C:\Users\eh\Desktop\ComboFix.exe
2013-08-21 11:19 - 2013-08-21 11:19 - 00473448 _____ C:\Windows\Minidump\082113-263704-01.dmp
2013-08-21 09:06 - 2013-08-21 09:06 - 00377856 _____ C:\Users\eh\Desktop\g0ns0w1j.exe
2013-08-21 09:00 - 2013-08-21 09:00 - 00000000 ____D C:\FRST
2013-08-21 08:50 - 2013-08-21 08:50 - 00000000 _____ C:\Users\eh\defogger_reenable
2013-08-21 08:47 - 2013-08-21 08:47 - 00050477 _____ C:\Users\eh\Desktop\Defogger.exe
2013-08-20 09:48 - 2013-08-22 14:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 11:11 - 2013-08-20 10:48 - 00000000 ____D C:\Users\eh\Versorgungsamt
2013-08-15 10:05 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 10:05 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 10:05 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 10:05 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 10:05 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 10:05 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 10:05 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 10:05 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 10:05 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 10:05 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 10:05 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 10:05 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 09:36 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-15 09:36 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-15 09:36 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 09:36 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-15 09:36 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 09:36 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 09:36 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-15 09:36 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 09:36 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 09:36 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-15 09:36 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-15 09:36 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-15 09:36 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-15 09:36 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-15 09:36 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-15 09:36 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-15 09:36 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 09:36 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-10 10:27 - 2013-08-10 10:27 - 00000000 ____D C:\Users\eh\AppData\Local\{F3A2DFDC-6138-4305-A3DB-37ACD2F47FDF}
2013-08-07 17:45 - 2013-08-07 17:46 - 00000000 ____D C:\Users\eh\AppData\Local\{7D396E2D-3A7B-4A7A-9C6B-B3ADBE0B4862}

==================== One Month Modified Files and Folders =======

2013-08-27 14:49 - 2012-05-12 15:41 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-27 14:47 - 2012-04-12 15:52 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-27 14:46 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-27 14:46 - 2009-07-14 06:51 - 00238125 _____ C:\Windows\setupact.log
2013-08-27 11:15 - 2012-04-12 15:51 - 01538354 _____ C:\Windows\WindowsUpdate.log
2013-08-27 11:08 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-27 11:08 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-27 10:43 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh
2013-08-27 10:42 - 2013-08-27 10:24 - 00000000 ____D C:\Users\eh\AppData\Roaming\BabSolution
2013-08-27 10:42 - 2013-08-27 10:24 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-08-27 10:42 - 2012-11-23 12:45 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-27 10:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-27 10:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-27 10:29 - 2013-08-27 10:29 - 00000000 ____D C:\Users\eh\AppData\Roaming\Optimizer Pro
2013-08-27 10:27 - 2013-08-21 14:01 - 00000000 ____D C:\Users\eh\Trojaner Board
2013-08-27 08:47 - 2013-05-05 11:28 - 00100352 ___SH C:\Users\eh\Thumbs.db
2013-08-26 14:30 - 2012-04-12 15:52 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-26 14:17 - 2013-08-24 12:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-26 14:04 - 2013-08-26 14:04 - 00001468 _____ C:\Users\eh\Desktop\psi - Verknüpfung.lnk
2013-08-26 12:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-26 12:11 - 2013-08-26 12:11 - 00261990 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-26 12:06 - 2010-11-21 05:47 - 00057632 _____ C:\Windows\PFRO.log
2013-08-26 12:01 - 2012-04-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-26 11:38 - 2012-04-12 16:59 - 00000099 _____ C:\Users\Public\LMDebug.log
2013-08-25 18:50 - 2013-08-24 12:41 - 00000000 ____D C:\ProgramData\InstallMate
2013-08-25 18:49 - 2013-08-25 18:49 - 00922152 _____ (BillP Studios) C:\Users\eh\Desktop\wpsetup.exe
2013-08-25 18:41 - 2013-08-21 14:15 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 18:40 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
2013-08-25 18:40 - 2013-08-24 12:34 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-08-25 18:40 - 2011-08-22 19:09 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-08-25 18:40 - 2011-08-22 19:09 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-08-25 18:40 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-08-24 13:35 - 2013-08-24 13:35 - 00000005 _____ C:\Users\eh\AppData\Roaming\WBPU-TTL.DAT
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Users\eh\AppData\Roaming\WinPatrol
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\DSite
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Dealply
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Local\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-08-24 12:10 - 2011-03-14 16:08 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-08-24 12:07 - 2013-08-24 12:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 12:07 - 2012-04-19 21:32 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-24 12:07 - 2011-08-22 19:09 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-24 12:06 - 2013-08-24 12:06 - 02434048 _____ C:\Users\eh\Desktop\msxml.msi
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Users\eh\AppData\Local\Secunia PSI
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-24 11:59 - 2013-08-24 11:59 - 03272136 _____ (Secunia) C:\Users\eh\Desktop\PSISetup711.exe
2013-08-24 11:10 - 2012-06-20 11:41 - 00000000 ____D C:\Users\eh\privat
2013-08-24 11:10 - 2012-04-12 18:04 - 00000000 ____D C:\Users\eh\Documents\Post
2013-08-23 17:22 - 2013-08-23 17:22 - 00448512 _____ (OldTimer Tools) C:\Users\eh\Desktop\TFC.exe
2013-08-23 09:11 - 2012-04-13 14:35 - 00000000 ____D C:\Users\eh\AppData\Local\Adobe
2013-08-23 09:10 - 2013-08-23 09:10 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-23 09:03 - 2012-07-06 08:21 - 00000000 ____D C:\Users\eh\AppData\Local\Mozilla
2013-08-23 09:03 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh\AppData\Roaming\Macromedia
2013-08-23 09:03 - 2012-04-12 15:56 - 00000000 ____D C:\Program Files (x86)\Memeo
2013-08-22 15:12 - 2010-11-21 09:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-22 14:48 - 2011-08-22 19:00 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-22 14:34 - 2011-08-22 19:00 - 00000000 ____D C:\ProgramData\Adobe
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\APN
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-08-22 14:19 - 2013-08-22 14:19 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-22 14:19 - 2013-08-22 14:19 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-22 14:19 - 2011-11-23 20:34 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-22 14:19 - 2011-11-23 20:34 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-22 14:18 - 2013-08-20 09:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-22 13:07 - 2013-08-22 13:07 - 01576476 _____ (Farbar) C:\Users\eh\Desktop\FRST64.exe
2013-08-22 03:48 - 2012-04-12 16:18 - 00000000 ____D C:\Users\eh\AppData\Local\Google
2013-08-22 03:38 - 2013-08-22 03:38 - 00891115 _____ C:\Users\eh\Desktop\SecurityCheck.exe
2013-08-22 01:34 - 2012-04-12 15:53 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-21 17:52 - 2013-08-21 14:32 - 00000000 ____D C:\AdwCleaner
2013-08-21 14:31 - 2013-08-21 14:31 - 00975858 _____ C:\Users\eh\Desktop\adwcleaner.exe
2013-08-21 14:15 - 2013-08-21 14:15 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\Users\eh\AppData\Roaming\Malwarebytes
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 14:09 - 2013-08-21 14:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\eh\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-21 12:42 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh\AppData\Local\VirtualStore
2013-08-21 12:06 - 2013-08-21 12:06 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-21 12:03 - 2013-08-21 12:03 - 01110476 _____ C:\Users\eh\Desktop\7z920.exe
2013-08-21 11:51 - 2013-08-21 11:51 - 00017512 _____ C:\ComboFix.txt
2013-08-21 11:51 - 2013-08-21 11:30 - 00000000 ____D C:\ComboFix
2013-08-21 11:51 - 2013-08-21 11:29 - 00000000 ____D C:\Qoobox
2013-08-21 11:50 - 2013-08-21 11:29 - 00000000 ____D C:\Windows\erdnt
2013-08-21 11:50 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-21 11:27 - 2013-08-21 11:27 - 05109244 ____R (Swearware) C:\Users\eh\Desktop\ComboFix.exe
2013-08-21 11:19 - 2013-08-21 11:19 - 00473448 _____ C:\Windows\Minidump\082113-263704-01.dmp
2013-08-21 11:19 - 2013-07-12 15:38 - 00000000 ____D C:\Windows\Minidump
2013-08-21 11:15 - 2013-07-12 15:38 - 697460971 _____ C:\Windows\MEMORY.DMP
2013-08-21 09:06 - 2013-08-21 09:06 - 00377856 _____ C:\Users\eh\Desktop\g0ns0w1j.exe
2013-08-21 09:00 - 2013-08-21 09:00 - 00000000 ____D C:\FRST
2013-08-21 08:54 - 2012-05-16 11:43 - 00000000 ____D C:\Users\eh\tests
2013-08-21 08:50 - 2013-08-21 08:50 - 00000000 _____ C:\Users\eh\defogger_reenable
2013-08-21 08:47 - 2013-08-21 08:47 - 00050477 _____ C:\Users\eh\Desktop\Defogger.exe
2013-08-20 15:22 - 2011-03-11 11:20 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-08-20 15:22 - 2011-03-11 11:20 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-08-20 15:22 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-20 11:39 - 2012-07-06 08:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-20 10:48 - 2013-08-16 11:11 - 00000000 ____D C:\Users\eh\Versorgungsamt
2013-08-19 18:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-16 11:39 - 2012-04-12 16:59 - 00012048 _____ C:\Users\eh\AppData\Roaming\SmarThruOptions.xml
2013-08-15 21:24 - 2012-09-12 21:21 - 00000000 ____D C:\Users\eh\Doris
2013-08-15 10:02 - 2013-07-25 14:52 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 10:01 - 2011-03-14 16:08 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 18:11 - 2012-04-13 10:11 - 00000000 ____D C:\Users\eh\Bewerbungen 2012
2013-08-10 10:27 - 2013-08-10 10:27 - 00000000 ____D C:\Users\eh\AppData\Local\{F3A2DFDC-6138-4305-A3DB-37ACD2F47FDF}
2013-08-07 17:46 - 2013-08-07 17:45 - 00000000 ____D C:\Users\eh\AppData\Local\{7D396E2D-3A7B-4A7A-9C6B-B3ADBE0B4862}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-22 13:59

==================== End Of Log ============================

--- --- ---

schrauber · 27.08.2013, 13:58

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

2013-08-27 10:29 - 2013-08-27 10:29 - 00000000 ____D C:\Users\eh\AppData\Roaming\Optimizer Pro
2013-08-27 10:24 - 2013-08-27 10:42 - 00000000 ____D C:\Users\eh\AppData\Roaming\BabSolution
2013-08-27 10:24 - 2013-08-27 10:42 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-08-24 12:34 - 2013-08-25 18:40 - 00000000 ____D C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
2013-08-24 12:34 - 2013-08-25 18:40 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\DSite
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Dealply
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Local\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\APN
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-08-27 10:42 - 2013-08-27 10:24 - 00000000 ____D C:\Users\eh\AppData\Roaming\BabSolution
2013-08-27 10:42 - 2013-08-27 10:24 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Erik1000 · 27.08.2013, 14:09

Hallo Schrauber,

Du hast mir nur eine Code-Liste geschickt???

Gruß Erik1000

schrauber · 27.08.2013, 20:10

ehm, ich versteh das Problem gerade nicht

In der Codebox stehen Sachen, mit denen so verfahren wie es im Text oben steht

Erik1000 · 30.08.2013, 08:50

Guten Morgen Schrauber,

gestern habe ich noch einmal versucht, WOT zu installieren, habe es auch nach paar Anläufen mit Programmen entpacken können. Fand aber keine exe, stattdessen einen Ordner Chrome obwohl ich die Firefox Version heruntergeladen hatte. Lasse es nun sein.

Vielen Dank noch einmal für die tolle Hilfe bei dem Trojaner! Habe PSI, TFC und Winpatrol installiert und einiges dazugelernt. Malwarebytes Anti-Malware läuft in 5 Tagen aus, aber das kann man ja bei Bedarf wieder frisch herunterladen.

Ich denke, Du kannst dann dieses Thema schließen.

Viele Grüße und alles Gute

Erik1000

schrauber · 30.08.2013, 19:59

Hast Du obiges noch gemacht?

Erik1000 · 03.09.2013, 14:55

Hallo Schrauber,

hatte nicht gesehen, dass es im Trojanerboard bei den Antwortschreiben mehr als eine Seite gibt. In meinen eMails hat meist der erste Teil Deiner Antworten gefehlt. Daher haben wir gegen Ende auch aneinander vorbeigeredet. Bin nun soweit, als Du noch ein frisches (letztes) FRST angefordert hast. Habe daher FRST nochmal runtergeladen. Anbei das aktuelle FRST und auch noch das Addition-file (für alle Fälle). Schau bitte mal rüber, was ich noch zu machen habe. Vielen dank!!! Erik1000

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 01
Ran by eh (administrator) on EH-PC on 03-09-2013 15:42:40
Running from C:\Users\eh\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\hsscp.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe
() C:\Program Files (x86)\Hotspot Shield\bin\openvpn.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbwmgr.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbw.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbw.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbw.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-04-12] (Google Inc.)
HKCU\...\Run: [WinPatrol] - C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [439360 2013-08-13] (BillP Studios)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [688128 2011-07-06] ()
HKLM-x32\...\Run: [CLX3180_Scan2Pc] - C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [3180 Scan2PC] - C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-11-16] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1481280 2013-07-01] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1601488 2013-08-06] (APN)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/tb/ie_startpage
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {0BFFCEE0-9808-4EDA-8D13-2D1D414BC027} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {19167A5C-815E-4BED-A280-EEE7D4CD3E3D} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL = hxxp://go.mail.com/br/ie8_search_web/?su={searchTerms}
SearchScopes: HKCU - {8D9A183F-79E7-4986-A0DA-302A21EEF529} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {B0B60347-DD99-4B69-B9A5-CE72259C1ED2} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: GMX Konfiguration - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Homepage: hxxp://go.gmx.net/tb/mff_startpage
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\staged
FF Extension: DealPly  Shopping - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979}
FF Extension: pricepeep - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\pricepeep@getpricepeep.com.xpi
FF Extension: toolbar - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\toolbar@gmx.net.xpi
FF Extension: toolbar_ORJ-V7 - C:\Users\eh\AppData\Roaming\Mozilla\Firefox\Profiles\9cs3grat.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afext@anchorfree.com
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Kaspersky URL Advisor) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: (DealPly  Shopping) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0
CHR Extension: (Virtual Keyboard) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (Anti-Banner) - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

==================== Services (Whitelisted) =================

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-08-06] (APN LLC.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-11-16] (Kaspersky Lab ZAO)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [852264 2013-08-16] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2013-08-13] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [555304 2013-08-16] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2011-10-07] ()

==================== Drivers (Whitelisted) ====================

S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [46792 2013-08-13] (AnchorFree Inc.)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-24] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-11-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-11-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-24] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-08-13] (Anchorfree Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-04-24] (Kaspersky Lab ZAO)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-03 15:41 - 2013-09-03 15:41 - 01950474 _____ (Farbar) C:\Users\eh\Desktop\FRST64.exe
2013-09-01 18:37 - 2013-09-01 18:38 - 00448512 _____ (OldTimer Tools) C:\Users\eh\Desktop\TFC.exe
2013-08-31 12:03 - 2013-08-31 12:03 - 00001075 _____ C:\DelFix.txt
2013-08-31 12:03 - 2013-08-31 12:03 - 00000000 ____D C:\Windows\ERUNT
2013-08-29 11:31 - 2013-08-29 11:31 - 00376576 _____ C:\Users\eh\Downloads\wot_safe_surfing-20130515-fx(1).zip
2013-08-29 11:25 - 2013-08-29 11:25 - 00000000 ____D C:\Users\eh\Cyberlink
2013-08-29 11:16 - 2013-08-29 11:16 - 00000000 ____D C:\Users\eh\AppData\Local\WinZip
2013-08-29 11:15 - 2013-08-29 11:53 - 00000000 ____D C:\Program Files (x86)\WinZip
2013-08-29 11:15 - 2013-08-29 11:16 - 00000000 ____D C:\ProgramData\WinZip
2013-08-29 11:12 - 2013-08-29 11:12 - 00000000 ____D C:\Program Files (x86)\Universal Extractor
2013-08-29 11:10 - 2013-08-29 11:10 - 05556306 _____ (Jared Breland                                               ) C:\Users\eh\Desktop\uniextract161.exe
2013-08-29 11:05 - 2013-08-29 11:07 - 49928560 _____ C:\Users\eh\Downloads\winzip175-32.exe
2013-08-29 10:57 - 2013-08-29 10:57 - 01110476 _____ C:\Users\eh\Desktop\7z920.exe
2013-08-28 14:53 - 2013-08-30 10:53 - 00000000 ____D C:\Users\eh\pdf Test
2013-08-28 14:51 - 2013-08-30 10:51 - 00000000 ____D C:\Users\eh\AppData\Local\CutePDF Writer
2013-08-28 14:42 - 2013-08-28 14:42 - 00001124 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-08-28 14:41 - 2013-08-28 14:41 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:42 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Users\eh\AppData\Roaming\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\GPLGS
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\Acro Software
2013-08-28 14:40 - 2013-08-13 01:07 - 00046792 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-08-28 14:40 - 2012-10-04 19:49 - 00087152 _____ C:\Windows\system32\cpwmon64.dll
2013-08-28 14:37 - 2013-08-28 14:37 - 02013504 _____ (Acro Software Inc.                                          ) C:\Users\eh\Desktop\CuteWriter.exe
2013-08-27 10:29 - 2013-08-27 10:29 - 00000000 ____D C:\Users\eh\AppData\Roaming\Optimizer Pro
2013-08-27 10:24 - 2013-08-27 10:42 - 00000000 ____D C:\Users\eh\AppData\Roaming\BabSolution
2013-08-27 10:24 - 2013-08-27 10:42 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-08-26 14:04 - 2013-08-26 14:04 - 00001468 _____ C:\Users\eh\Desktop\psi - Verknüpfung.lnk
2013-08-26 12:17 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-08-26 12:17 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-08-26 12:17 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-08-26 12:17 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-08-26 12:17 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-08-26 12:17 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-08-26 12:17 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-08-26 12:17 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-08-26 12:17 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-08-26 12:17 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-08-26 12:17 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-26 12:17 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-08-26 12:17 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-08-26 12:17 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-26 12:17 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-08-26 12:17 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-26 12:17 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-08-26 12:17 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-08-26 12:17 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-26 12:17 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-08-26 12:17 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-08-26 12:17 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-08-26 12:17 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-08-26 12:17 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-26 12:17 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-26 12:16 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-08-26 12:16 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-08-26 12:16 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-08-26 12:16 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-08-26 12:16 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-26 12:16 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-08-26 12:16 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-08-26 12:15 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-08-26 12:15 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-08-26 12:11 - 2013-08-26 12:11 - 00261990 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-25 18:49 - 2013-08-25 18:49 - 00922152 _____ (BillP Studios) C:\Users\eh\Desktop\wpsetup.exe
2013-08-24 13:35 - 2013-08-24 13:35 - 00000005 _____ C:\Users\eh\AppData\Roaming\WBPU-TTL.DAT
2013-08-24 12:41 - 2013-08-25 18:50 - 00000000 ____D C:\ProgramData\InstallMate
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Users\eh\AppData\Roaming\WinPatrol
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-08-24 12:34 - 2013-08-25 18:40 - 00000000 ____D C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
2013-08-24 12:34 - 2013-08-25 18:40 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\DSite
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Dealply
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Local\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-08-24 12:07 - 2013-09-03 08:17 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-24 12:07 - 2013-08-24 12:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 12:06 - 2013-08-24 12:06 - 02434048 _____ C:\Users\eh\Desktop\msxml.msi
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Users\eh\AppData\Local\Secunia PSI
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-24 11:59 - 2013-08-24 11:59 - 03272136 _____ (Secunia) C:\Users\eh\Desktop\PSISetup711.exe
2013-08-23 09:10 - 2013-08-23 09:10 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\APN
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-08-22 14:19 - 2013-08-22 14:19 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-22 14:19 - 2013-08-22 14:19 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-21 14:32 - 2013-08-21 17:52 - 00000000 ____D C:\AdwCleaner
2013-08-21 14:15 - 2013-08-25 18:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-21 14:15 - 2013-08-21 14:15 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\Users\eh\AppData\Roaming\Malwarebytes
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 14:15 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-21 14:09 - 2013-08-21 14:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\eh\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-21 14:01 - 2013-09-01 18:38 - 00000000 ____D C:\Users\eh\Trojaner Board
2013-08-21 12:06 - 2013-08-21 12:06 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-21 11:29 - 2013-08-21 11:50 - 00000000 ____D C:\Windows\erdnt
2013-08-21 11:19 - 2013-08-21 11:19 - 00473448 _____ C:\Windows\Minidump\082113-263704-01.dmp
2013-08-21 09:06 - 2013-08-21 09:06 - 00377856 _____ C:\Users\eh\Desktop\g0ns0w1j.exe
2013-08-20 09:48 - 2013-08-22 14:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 11:11 - 2013-08-20 10:48 - 00000000 ____D C:\Users\eh\Versorgungsamt
2013-08-15 10:05 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 10:05 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 10:05 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 10:05 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 10:05 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 10:05 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 10:05 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 10:05 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 10:05 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 10:05 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 10:05 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 10:05 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 09:36 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-15 09:36 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-15 09:36 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 09:36 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-15 09:36 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 09:36 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 09:36 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-15 09:36 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 09:36 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 09:36 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-15 09:36 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-15 09:36 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-15 09:36 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-15 09:36 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-15 09:36 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-15 09:36 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-15 09:36 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 09:36 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 01:10 - 2013-08-13 01:10 - 00042184 _____ (Anchorfree Inc.) C:\Windows\system32\Drivers\taphss6.sys
2013-08-10 10:27 - 2013-08-10 10:27 - 00000000 ____D C:\Users\eh\AppData\Local\{F3A2DFDC-6138-4305-A3DB-37ACD2F47FDF}
2013-08-07 17:45 - 2013-08-07 17:46 - 00000000 ____D C:\Users\eh\AppData\Local\{7D396E2D-3A7B-4A7A-9C6B-B3ADBE0B4862}

==================== One Month Modified Files and Folders =======

2013-09-03 15:42 - 2012-05-12 15:41 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-09-03 15:41 - 2013-09-03 15:41 - 01950474 _____ (Farbar) C:\Users\eh\Desktop\FRST64.exe
2013-09-03 15:34 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 15:34 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 15:33 - 2013-05-05 11:28 - 00120320 ___SH C:\Users\eh\Thumbs.db
2013-09-03 15:31 - 2012-04-12 16:59 - 00012033 _____ C:\Users\eh\AppData\Roaming\SmarThruOptions.xml
2013-09-03 15:30 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh
2013-09-03 15:30 - 2012-04-12 15:52 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-03 15:30 - 2012-04-12 15:52 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-03 15:30 - 2012-04-12 15:51 - 01740073 _____ C:\Windows\WindowsUpdate.log
2013-09-03 15:28 - 2012-04-12 18:04 - 00000000 ____D C:\Users\eh\Documents\Post
2013-09-03 15:26 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 15:26 - 2009-07-14 06:51 - 00239245 _____ C:\Windows\setupact.log
2013-09-03 15:10 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-03 08:17 - 2013-08-24 12:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-02 11:43 - 2012-06-20 11:41 - 00000000 ____D C:\Users\eh\privat
2013-09-01 18:38 - 2013-09-01 18:37 - 00448512 _____ (OldTimer Tools) C:\Users\eh\Desktop\TFC.exe
2013-09-01 18:38 - 2013-08-21 14:01 - 00000000 ____D C:\Users\eh\Trojaner Board
2013-08-31 12:03 - 2013-08-31 12:03 - 00001075 _____ C:\DelFix.txt
2013-08-31 12:03 - 2013-08-31 12:03 - 00000000 ____D C:\Windows\ERUNT
2013-08-31 11:42 - 2012-04-12 16:59 - 00000099 _____ C:\Users\Public\LMDebug.log
2013-08-30 10:53 - 2013-08-28 14:53 - 00000000 ____D C:\Users\eh\pdf Test
2013-08-30 10:51 - 2013-08-28 14:51 - 00000000 ____D C:\Users\eh\AppData\Local\CutePDF Writer
2013-08-30 09:38 - 2012-04-12 15:53 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-29 13:47 - 2012-09-12 21:21 - 00000000 ____D C:\Users\eh\Doris
2013-08-29 11:53 - 2013-08-29 11:15 - 00000000 ____D C:\Program Files (x86)\WinZip
2013-08-29 11:53 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-29 11:52 - 2011-08-22 19:38 - 00000000 ____D C:\Users\Public\CyberLink
2013-08-29 11:52 - 2011-08-22 19:10 - 00000000 ____D C:\ProgramData\CyberLink
2013-08-29 11:31 - 2013-08-29 11:31 - 00376576 _____ C:\Users\eh\Downloads\wot_safe_surfing-20130515-fx(1).zip
2013-08-29 11:25 - 2013-08-29 11:25 - 00000000 ____D C:\Users\eh\Cyberlink
2013-08-29 11:25 - 2012-04-12 17:48 - 00000000 ____D C:\Users\eh\Documents\CyberLink
2013-08-29 11:25 - 2012-04-12 17:48 - 00000000 ____D C:\Users\eh\AppData\Roaming\CyberLink
2013-08-29 11:16 - 2013-08-29 11:16 - 00000000 ____D C:\Users\eh\AppData\Local\WinZip
2013-08-29 11:16 - 2013-08-29 11:15 - 00000000 ____D C:\ProgramData\WinZip
2013-08-29 11:12 - 2013-08-29 11:12 - 00000000 ____D C:\Program Files (x86)\Universal Extractor
2013-08-29 11:10 - 2013-08-29 11:10 - 05556306 _____ (Jared Breland                                               ) C:\Users\eh\Desktop\uniextract161.exe
2013-08-29 11:07 - 2013-08-29 11:05 - 49928560 _____ C:\Users\eh\Downloads\winzip175-32.exe
2013-08-29 10:57 - 2013-08-29 10:57 - 01110476 _____ C:\Users\eh\Desktop\7z920.exe
2013-08-28 17:38 - 2010-11-21 05:47 - 00066078 _____ C:\Windows\PFRO.log
2013-08-28 14:42 - 2013-08-28 14:42 - 00001124 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-08-28 14:42 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-08-28 14:41 - 2013-08-28 14:41 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Users\eh\AppData\Roaming\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\GPLGS
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\Acro Software
2013-08-28 14:37 - 2013-08-28 14:37 - 02013504 _____ (Acro Software Inc.                                          ) C:\Users\eh\Desktop\CuteWriter.exe
2013-08-27 17:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-27 10:42 - 2013-08-27 10:24 - 00000000 ____D C:\Users\eh\AppData\Roaming\BabSolution
2013-08-27 10:42 - 2013-08-27 10:24 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-08-27 10:42 - 2012-11-23 12:45 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-27 10:29 - 2013-08-27 10:29 - 00000000 ____D C:\Users\eh\AppData\Roaming\Optimizer Pro
2013-08-26 14:04 - 2013-08-26 14:04 - 00001468 _____ C:\Users\eh\Desktop\psi - Verknüpfung.lnk
2013-08-26 12:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-26 12:11 - 2013-08-26 12:11 - 00261990 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-26 12:01 - 2012-04-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-25 18:50 - 2013-08-24 12:41 - 00000000 ____D C:\ProgramData\InstallMate
2013-08-25 18:49 - 2013-08-25 18:49 - 00922152 _____ (BillP Studios) C:\Users\eh\Desktop\wpsetup.exe
2013-08-25 18:41 - 2013-08-21 14:15 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 18:40 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
2013-08-25 18:40 - 2013-08-24 12:34 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-08-25 18:40 - 2011-08-22 19:09 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-08-25 18:40 - 2011-08-22 19:09 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-08-25 18:40 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-08-24 13:35 - 2013-08-24 13:35 - 00000005 _____ C:\Users\eh\AppData\Roaming\WBPU-TTL.DAT
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Users\eh\AppData\Roaming\WinPatrol
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\DSite
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Dealply
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Roaming\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Users\eh\AppData\Local\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\ProgramData\Babylon
2013-08-24 12:34 - 2013-08-24 12:34 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-08-24 12:10 - 2011-03-14 16:08 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-08-24 12:07 - 2013-08-24 12:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 12:07 - 2012-04-19 21:32 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-24 12:07 - 2011-08-22 19:09 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-24 12:06 - 2013-08-24 12:06 - 02434048 _____ C:\Users\eh\Desktop\msxml.msi
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Users\eh\AppData\Local\Secunia PSI
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-24 11:59 - 2013-08-24 11:59 - 03272136 _____ (Secunia) C:\Users\eh\Desktop\PSISetup711.exe
2013-08-23 09:11 - 2012-04-13 14:35 - 00000000 ____D C:\Users\eh\AppData\Local\Adobe
2013-08-23 09:10 - 2013-08-23 09:10 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-23 09:03 - 2012-07-06 08:21 - 00000000 ____D C:\Users\eh\AppData\Local\Mozilla
2013-08-23 09:03 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh\AppData\Roaming\Macromedia
2013-08-23 09:03 - 2012-04-12 15:56 - 00000000 ____D C:\Program Files (x86)\Memeo
2013-08-22 15:12 - 2010-11-21 09:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-22 14:48 - 2011-08-22 19:00 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-22 14:34 - 2011-08-22 19:00 - 00000000 ____D C:\ProgramData\Adobe
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\ProgramData\APN
2013-08-22 14:21 - 2013-08-22 14:21 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-08-22 14:19 - 2013-08-22 14:19 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-22 14:19 - 2013-08-22 14:19 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-22 14:19 - 2011-11-23 20:34 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-22 14:19 - 2011-11-23 20:34 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-22 14:18 - 2013-08-20 09:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-22 03:48 - 2012-04-12 16:18 - 00000000 ____D C:\Users\eh\AppData\Local\Google
2013-08-21 17:52 - 2013-08-21 14:32 - 00000000 ____D C:\AdwCleaner
2013-08-21 14:15 - 2013-08-21 14:15 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\Users\eh\AppData\Roaming\Malwarebytes
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 14:09 - 2013-08-21 14:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\eh\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-21 12:42 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh\AppData\Local\VirtualStore
2013-08-21 12:06 - 2013-08-21 12:06 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-21 11:50 - 2013-08-21 11:29 - 00000000 ____D C:\Windows\erdnt
2013-08-21 11:50 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-21 11:19 - 2013-08-21 11:19 - 00473448 _____ C:\Windows\Minidump\082113-263704-01.dmp
2013-08-21 11:19 - 2013-07-12 15:38 - 00000000 ____D C:\Windows\Minidump
2013-08-21 11:15 - 2013-07-12 15:38 - 697460971 _____ C:\Windows\MEMORY.DMP
2013-08-21 09:06 - 2013-08-21 09:06 - 00377856 _____ C:\Users\eh\Desktop\g0ns0w1j.exe
2013-08-21 08:54 - 2012-05-16 11:43 - 00000000 ____D C:\Users\eh\tests
2013-08-20 15:22 - 2011-03-11 11:20 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-08-20 15:22 - 2011-03-11 11:20 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-08-20 15:22 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-20 11:39 - 2012-07-06 08:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-20 10:48 - 2013-08-16 11:11 - 00000000 ____D C:\Users\eh\Versorgungsamt
2013-08-15 10:02 - 2013-07-25 14:52 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 10:01 - 2011-03-14 16:08 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 18:11 - 2012-04-13 10:11 - 00000000 ____D C:\Users\eh\Bewerbungen 2012
2013-08-13 01:10 - 2013-08-13 01:10 - 00042184 _____ (Anchorfree Inc.) C:\Windows\system32\Drivers\taphss6.sys
2013-08-13 01:07 - 2013-08-28 14:40 - 00046792 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-08-10 10:27 - 2013-08-10 10:27 - 00000000 ____D C:\Users\eh\AppData\Local\{F3A2DFDC-6138-4305-A3DB-37ACD2F47FDF}
2013-08-07 17:46 - 2013-08-07 17:45 - 00000000 ____D C:\Users\eh\AppData\Local\{7D396E2D-3A7B-4A7A-9C6B-B3ADBE0B4862}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-02 15:19

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2013 01
Ran by eh at 2013-09-03 15:43:00
Running from C:\Users\eh\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
7-Zip 9.20 (x32)
Adobe AIR (x32 Version: 3.8.0.870)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AMD APP SDK Runtime (Version: 2.5.793.1)
AMD AVIVO64 Codecs (Version: 11.7.0.11013)
AMD Catalyst Install Manager (Version: 3.0.851.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.61013.1636)
Ask Toolbar (x32 Version: 12.3.0.7)
Asmedia ASM104x USB 3.0 Host Controller Driver (x32 Version: 1.12.9.0)
Audacity 1.2.6 (x32)
Catalyst Control Center (x32 Version: 2011.1013.1702.28713)
Catalyst Control Center InstallProxy (x32 Version: 2011.1013.1702.28713)
Catalyst Control Center Localization All (x32 Version: 2011.1013.1702.28713)
CCC Help Danish (x32 Version: 2011.1013.1701.28713)
CCC Help Dutch (x32 Version: 2011.1013.1701.28713)
CCC Help English (x32 Version: 2011.1013.1701.28713)
CCC Help Finnish (x32 Version: 2011.1013.1701.28713)
CCC Help French (x32 Version: 2011.1013.1701.28713)
CCC Help German (x32 Version: 2011.1013.1701.28713)
CCC Help Italian (x32 Version: 2011.1013.1701.28713)
CCC Help Japanese (x32 Version: 2011.1013.1701.28713)
CCC Help Norwegian (x32 Version: 2011.1013.1701.28713)
CCC Help Spanish (x32 Version: 2011.1013.1701.28713)
CCC Help Swedish (x32 Version: 2011.1013.1701.28713)
ccc-utility64 (Version: 2011.1013.1702.28713)
COMPUTERBILD Vorteil-Center (x32 Version: 1.1.23)
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2)
CVE-2012-4969
CyberLink LabelPrint (x32 Version: 2.5.3624)
CyberLink MediaEspresso (x32 Version: 6.5.1305_34270)
CyberLink MediaShow (x32 Version: 5.1.2023)
CyberLink PhotoDirector 2011 (x32 Version: 2.0.2211)
CyberLink PhotoNow (x32 Version: 1.1.7717)
CyberLink Power2Go (x32 Version: 7.0.0.1327)
CyberLink PowerDirector (Version: 9.0.0.3419a)
CyberLink PowerDirector (x32 Version: 9.0.0.3419a)
CyberLink PowerDVD 10 (x32 Version: 10.0.3510.52)
CyberLink PowerDVD Copy (x32 Version: 1.5.1306)
CyberLink PowerProducer (x32 Version: 5.0.2.3503)
CyberLink PowerRecover (x32 Version: 5.5.4125)
CyberLink WaveEditor (x32 Version: 1.0.1.3320)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
ePDF Writer 3.0 (Version:  3.0)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (x32 Version: 15.4.5722.2)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Free MP3 Sound Recorder v1.9 (x32 Version: 3.0)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
GMX Desktop Icons (x32 Version: 3.0.3.0)
GMX Internet Explorer Addon (x32 Version: 1.0.0.11)
GMX MailCheck für Internet Explorer (x32 Version: 2.3.0.2)
GMX Softwareaktualisierung (x32 Version: 3.0.0.55)
Google Chrome (x32 Version: 29.0.1547.62)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4413.1752)
Google Update Helper (x32 Version: 1.3.21.153)
Hotspot Shield 3.13 (x32 Version: 3.13)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.6.0.1002)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
McAfee Security Scan Plus (x32 Version: 3.0.318.3)
Medion Home Cinema (x32 Version: 8.0.3216)
Memeo Instant Backup (x32 Version: 4.60.0.7943)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Readiris Pro 10 (x32)
Realtek Ethernet Controller Driver (x32 Version: 7.46.610.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6438)
Samsung Scan Assistant (x32 Version: 1.04.20.00)
Secunia PSI (3.0.0.7011) (x32 Version: 3.0.0.7011)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)
SmarThru 4 (x32)
Universal Extractor 1.6.1 (x32 Version: 1.6.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2)
Versandhelfer (x32 Version: 0.9.511)
Wartung Samsung CLX-3180 Series (x32)
watchmi (x32 Version: 2.7.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
WinPatrol (Version: 28.6.2013.0)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (x32 Version: 15.4.5722.2)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-08-21 11:50 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {03E5EB57-F0E5-4BA0-A4E6-2C49E875D7C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-24] (Adobe Systems Incorporated)
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => start w32time task_started
Task: {261811F9-E35C-4ED9-B777-89D422373B16} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-12] (Google Inc.)
Task: {3EACEE01-34BA-480C-B4F5-DEC9E9FEC877} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {4A2CB871-EB5E-4B9D-985A-56491985C332} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-21] (Microsoft Corporation)
Task: {AAACBC82-7FF4-42B9-8004-8F1966484069} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => start osppsvc
Task: {B935DFEB-E42F-4820-B8C8-BC032F5CB822} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2013-06-18] (1&1 Mail & Media GmbH)
Task: {CD48E696-01AC-47EB-9871-BD62FCF0D458} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-12] (Google Inc.)
Task: {CEAFB20C-71C4-4496-B8F6-3200343F0635} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-01-05] (CyberLink)
Task: {DC033C8E-9F78-4E3F-9296-AB0FD57F8618} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {E305159F-B7D2-4FF1-9BB4-F22B375DBE24} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {F1CF4693-189C-407F-A154-6FD784D88CE4} - System32\Tasks\1und1 Konfiguration => C:\ProgramData\1und1InternetExplorerAddon\ConfigTask.exe [2011-04-19] (1und1 Mail und Media GmbH)
Task: {F6EA0878-E359-4DB1-BA80-8A7070D43276} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-11-23 20:20 - 2011-10-13 21:52 - 00040960 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2011-11-23 20:20 - 2011-10-13 22:33 - 00892416 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll
2011-11-23 20:20 - 2011-10-13 22:16 - 05041664 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll
2013-01-23 19:46 - 2013-01-23 19:46 - 00393864 _____ (1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Proxy.dll
2013-07-01 16:25 - 2013-07-01 16:25 - 01070144 _____ (1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Notification.DLL
2013-08-15 10:05 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-04-30 15:58 - 2013-04-30 15:58 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-02-27 12:34 - 2013-01-13 21:51 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\D3D10Warp.dll
2012-08-17 21:42 - 2012-08-17 21:42 - 00246712 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\gadget.dll
2012-08-17 21:42 - 2012-08-17 21:42 - 00252856 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\remote_eka_prague_loader.dll
2012-08-17 21:41 - 2012-08-17 21:41 - 00188344 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\prremote.dll
2012-08-17 21:43 - 2012-08-17 21:43 - 00507320 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\prloader.dll
2012-08-17 21:42 - 2012-08-17 21:42 - 00846264 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\service.dll
2012-08-17 21:42 - 2012-08-17 21:42 - 00315320 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\eka_meta.dll
2012-08-17 21:42 - 2012-08-17 21:42 - 00057272 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\pxstub.ppl
2012-08-17 21:42 - 2012-08-17 21:42 - 01988536 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\params.ppl
2012-08-17 21:42 - 2012-08-17 21:42 - 00129976 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\nfio.ppl
2012-08-17 21:42 - 2012-08-17 21:42 - 00047032 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\winreg.ppl
2012-08-17 21:42 - 2012-08-17 21:42 - 00047032 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\thpimpl.ppl
2013-04-30 15:58 - 2013-04-30 15:58 - 00281600 _____ (Microsoft Corporation) C:\Windows\System32\Dxtrans.dll
2009-07-14 01:41 - 2009-07-14 03:40 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\ddrawex.dll
2009-07-14 01:58 - 2009-07-14 03:41 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-04-30 15:58 - 2013-04-30 15:58 - 00452096 _____ (Microsoft Corporation) C:\Windows\System32\Dxtmsft.dll
2013-07-12 09:56 - 2013-04-24 00:56 - 09991832 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
2013-07-12 17:27 - 2013-07-12 17:27 - 15577088 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\88744044294787b99dd4a8704ab75a79\mscorlib.ni.dll
2013-01-09 15:03 - 2012-10-05 12:52 - 01574496 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll
2013-08-15 11:26 - 2013-08-15 11:26 - 10655744 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System\af0a0b96a02f9925eb84392ee65a5cfa\System.ni.dll
2013-08-15 11:26 - 2013-08-15 11:26 - 02320384 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\868d117286ad259249f31d3fe813d39a\System.Drawing.ni.dll
2013-08-15 11:26 - 2013-08-15 11:26 - 17383424 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\95674cb72317e3a5380ea450b913786f\System.Windows.Forms.ni.dll
2011-05-05 19:19 - 2010-11-13 02:08 - 00315392 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
2013-08-15 11:27 - 2013-08-15 11:27 - 01022976 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Runtime.Remo#\5d7208467b0ffffee644a83f4e76fa12\System.Runtime.Remoting.ni.dll
2013-08-15 11:27 - 2013-08-15 11:27 - 15362048 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web\1223cf3c9fcc905300e20364b7a26097\System.Web.ni.dll
2013-08-15 11:26 - 2013-08-15 11:26 - 06964736 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\3975acf49313ceea1280da91f0383480\System.Xml.ni.dll
2009-04-22 22:13 - 2009-04-22 22:13 - 00045056 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0601.dll
2010-03-04 10:27 - 2010-03-04 10:27 - 00016384 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Foundation.dll
2011-11-23 20:20 - 2011-10-13 22:31 - 00466944 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\ATIDEMGX.dll
2013-08-15 11:26 - 2013-08-15 11:26 - 01320448 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\1031b311ee568364d4ca1c4db634eaf0\System.Configuration.ni.dll
2013-08-15 11:26 - 2013-08-15 11:26 - 04962816 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\WindowsBase\ae3db946d20bb0ad28cf588eef06ecf0\WindowsBase.ni.dll
2009-01-20 23:51 - 2009-01-20 23:51 - 00007168 _____ ( ) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atixclib.dll
2013-08-15 11:26 - 2013-08-15 11:26 - 16542720 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationCore\455f1bf19319ef1c59b3e0c1e45c1c9c\PresentationCore.ni.dll
2013-08-15 11:27 - 2013-08-15 11:27 - 19197952 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\90ad207864957bd667f551bdd1c39ada\PresentationFramework.ni.dll
2013-07-12 09:56 - 2013-04-20 00:54 - 02256032 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\wpfgfx_v0300.dll
2011-06-21 16:31 - 2010-11-13 01:26 - 00434176 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
2011-10-14 03:01 - 2011-10-14 03:01 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-11-23 20:20 - 2011-10-13 21:51 - 00038912 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2011-11-23 20:20 - 2011-10-13 22:00 - 05510144 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll
2011-11-23 20:20 - 2011-10-13 22:19 - 04042752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2013-07-12 17:29 - 2013-07-12 17:29 - 00463360 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\56d7206478a1eb28089a8efbdf921bf2\PresentationFramework.Aero.ni.dll
2011-03-11 11:19 - 2011-03-11 11:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
2011-03-11 11:19 - 2011-03-11 11:19 - 00212992 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
2013-08-15 11:44 - 2013-08-15 11:44 - 03315712 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Core\296ad113496c7e97a1689ffef9550b19\System.Core.ni.dll
2009-07-14 03:01 - 2009-06-10 22:31 - 01165664 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2009-07-14 01:39 - 2009-07-14 03:41 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\msctfui.dll
2013-08-15 11:47 - 2013-08-15 11:47 - 00329216 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\WindowsFormsIntegra#\fffa833a307c3ad981d98b81311f2ad3\WindowsFormsIntegration.ni.dll
2009-07-14 01:19 - 2009-07-14 03:41 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\ktmw32.dll
2009-07-14 01:46 - 2009-07-14 03:41 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\tschannel.dll
2009-07-14 01:46 - 2009-07-14 03:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\TaskSchdPS.dll
2013-08-25 18:51 - 2013-07-15 19:29 - 00620718 ____N () C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll
2013-08-25 18:51 - 2013-08-13 03:34 - 00065080 ____N (BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\PATROLPRO.DLL
2013-07-12 09:56 - 2013-04-24 00:57 - 05932696 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
2013-07-12 17:30 - 2013-07-12 17:30 - 11499520 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll
2013-01-09 15:03 - 2012-10-05 12:53 - 00364656 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
2013-08-15 11:24 - 2013-08-15 11:24 - 07989760 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll
2013-08-15 11:40 - 2013-08-15 11:40 - 00492032 _____ (Intel Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\97ce162bb354fcf9c8d9eae8252ee216\IAStorUtil.ni.dll
2013-08-15 11:25 - 2013-08-15 11:25 - 01593344 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll
2013-08-15 11:25 - 2013-08-15 11:25 - 12436480 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\28ea347a952d20959ac6ae02d7457d39\System.Windows.Forms.ni.dll
2013-08-15 11:24 - 2013-08-15 11:24 - 00978432 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\8f7d83126a3cf283e5ac97f2d6d99f12\System.Configuration.ni.dll
2013-08-15 11:24 - 2013-08-15 11:24 - 05464064 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll
2011-08-22 18:03 - 2011-05-20 19:06 - 00032768 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\de-DE\IAStorIcon.resources.dll
2011-08-22 18:03 - 2011-05-20 19:05 - 01318912 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IntelVisualDesign.dll
2011-08-22 18:03 - 2011-05-20 19:06 - 00004608 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\de-DE\IntelVisualDesign.resources.dll
2013-08-15 11:25 - 2013-08-15 11:25 - 00771584 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e06dbdafb38c38517aef61ac41e2fd9d\System.Runtime.Remoting.ni.dll
2011-03-11 11:19 - 2011-03-11 11:19 - 00032768 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00572760 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
2013-08-15 11:24 - 2013-08-15 11:24 - 03348480 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1f6f220f9efe936d1158c79b9d4b451f\WindowsBase.ni.dll
2013-07-14 22:17 - 2013-07-14 22:17 - 00014336 _____ (Intel Corp.) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\22d36f517c7545fdb65ccddae680a3eb\IAStorCommon.ni.dll
2011-08-22 18:03 - 2011-05-20 19:05 - 00174592 _____ (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorUIHelper.dll
2013-08-15 11:25 - 2013-08-15 11:25 - 11914752 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\8dc1c182cd1f10cd2abcfecd01fe9eeb\System.Web.ni.dll
2010-08-04 01:39 - 2010-08-04 01:39 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.dll
2010-08-04 01:39 - 2010-08-04 01:39 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2012-04-12 16:55 - 2009-10-31 15:42 - 01384520 _____ () C:\Windows\twain_32\Samsung\CLX3180\ssole.dll
2012-04-12 16:55 - 2009-10-31 15:42 - 00081920 _____ (Samsung Electronics) C:\Windows\twain_32\Samsung\CLX3180\scantopc.dll
2012-08-17 21:40 - 2013-06-19 13:49 - 00083648 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ushata.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00013240 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avpinit.dll
2012-08-17 21:38 - 2013-04-24 14:08 - 00828096 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avpmain.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00097720 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\fssync.DLL
2012-08-17 21:39 - 2012-08-17 21:39 - 00147896 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\DumpWriter.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00611768 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\service.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00159672 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\prremote.DLL
2012-08-17 21:39 - 2012-08-17 21:39 - 00369080 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\prloader.dll
2012-08-17 21:41 - 2012-08-17 21:41 - 00110008 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\nfio.ppl
2012-08-17 21:41 - 2012-08-17 21:41 - 00021432 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\fsdrvplg.ppl
2012-08-17 21:41 - 2012-08-17 21:41 - 00038840 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\winreg.ppl
2012-08-17 21:41 - 2012-12-20 20:57 - 00045576 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\pxstub.ppl
2012-08-17 21:41 - 2013-02-27 11:25 - 01329008 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\params.ppl
2012-08-17 21:38 - 2012-08-17 21:38 - 01108408 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\app_core_legacy.dll
2012-08-17 21:39 - 2012-12-20 20:57 - 00609288 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\key_value_storage.DLL
2012-08-17 21:39 - 2012-08-17 21:39 - 00254392 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\eka_meta.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00253368 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\updater_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00126904 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\content_filtering_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00256440 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\am_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00434616 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ac_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00362936 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\app_core_meta.dll
2012-08-17 21:39 - 2012-12-06 16:52 - 00825784 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\product_metainfo.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00208824 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\plugins_meta.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00297400 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ksn_meta.dll
2012-08-17 21:40 - 2013-04-24 14:08 - 00238272 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ucp_meta.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00183224 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\klifpp_meta.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00097720 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\instrumental_meta.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00395192 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\storage.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00036280 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avpservice.dll
2012-08-17 21:41 - 2013-02-27 11:25 - 04885872 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avpgui.ppl
2012-08-17 21:39 - 2012-08-17 21:39 - 02321336 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtCore4.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 02289080 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtDeclarative4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 01296824 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtScript4.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00182200 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtSql4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 07269816 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtGui4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 02051512 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\QtNetwork4.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00479160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00963000 _____ (IBM Corporation and others) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\icuuc40.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 02962360 _____ (IBM Corporation and others) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\icudt40.dll
2012-08-17 21:41 - 2012-11-16 11:31 - 02162616 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\basegui.ppl
2012-08-17 21:41 - 2013-02-27 11:25 - 00041328 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\thpimpl.ppl
2012-08-17 21:39 - 2012-08-17 21:39 - 00085944 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\memmon.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00657336 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\localization_manager.dll
2012-08-17 21:39 - 2012-11-16 11:31 - 00288696 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\parental_control_gui.dll
2012-08-17 21:41 - 2012-08-17 21:41 - 00018360 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\hashmd5.ppl
2012-08-17 21:40 - 2012-08-17 21:40 - 00034232 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\imageformats\qgif4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00036792 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\imageformats\qico4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00189368 _____ (Digia Plc) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\imageformats\qjpeg4.dll
2012-08-17 21:41 - 2012-08-17 21:41 - 00088504 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\propmap.ppl
2013-08-16 23:39 - 2013-08-16 23:39 - 00764200 _____ () C:\Program Files (x86)\Hotspot Shield\bin\af_proxy.dll
2013-08-13 00:16 - 2013-08-13 00:16 - 00075264 _____ (Zlib) C:\Program Files (x86)\Hotspot Shield\bin\zlib1.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-04-30 15:58 - 2013-04-30 15:58 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dxtrans.dll
2009-07-14 01:28 - 2009-07-14 03:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ddrawex.dll
2013-04-30 15:58 - 2013-04-30 15:58 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dxtmsft.dll
2013-08-20 09:48 - 2013-08-20 09:48 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCenter.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00159672 _____ (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\prremote.dll
2013-07-12 17:29 - 2013-07-12 17:29 - 16166280 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Users\eh\Thumbs.db:encryptable


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/03/2013 03:28:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 03:27:10 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/03/2013 03:07:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 03:06:14 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/03/2013 08:15:33 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 08:13:56 AM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/02/2013 05:15:47 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 05:14:23 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/02/2013 02:22:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 02:20:35 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)


System errors:
=============
Error: (09/03/2013 03:27:43 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/03/2013 03:27:43 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Live ID Sign-in Assistant erreicht.

Error: (09/03/2013 03:26:55 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (09/03/2013 03:06:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (09/03/2013 08:13:50 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (09/02/2013 05:14:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/02/2013 05:14:57 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Live ID Sign-in Assistant erreicht.

Error: (09/02/2013 05:14:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (09/02/2013 02:20:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147014847

Error: (09/02/2013 02:20:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20


Microsoft Office Sessions:
=========================
Error: (09/03/2013 03:28:39 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 03:27:10 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/03/2013 03:07:50 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 03:06:14 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/03/2013 08:15:33 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/03/2013 08:13:56 AM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/02/2013 05:15:47 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 05:14:23 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (09/02/2013 02:22:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/02/2013 02:20:35 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)


CodeIntegrity Errors:
===================================
  Date: 2013-08-29 12:55:34.285
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.285
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.285
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.270
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.270
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.270
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.254
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.254
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-29 12:55:34.254
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-27 17:03:58.278
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 36%
Total physical RAM: 6125.64 MB
Available physical RAM: 3863.38 MB
Total Pagefile: 12249.46 MB
Available Pagefile: 9380.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:1346.17 GB) (Free:769.86 GB) NTFS
Drive d: (Recover) (Fixed) (Total:50 GB) (Free:28.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1397 GB) (Disk ID: 355CB92B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-753589551104) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================

schrauber · 03.09.2013, 20:25

Mach bitte den Fix von hier:

http://www.trojaner-board.de/140184-...ml#post1141672

dann ein frisches FRST log.

Erik1000 · 05.09.2013, 13:44

Hallo Schrauber,

habe das Fix gemacht. Mit katastrophalem Ergebnis! Lief länger. Musste mich dann auch wieder neu anmelden. Die ganzen Dateien waren gelöscht!!! Habe dann das Backup von der externen Festplatte gestartet (war vorher nicht angeschlossen). Schließlich zeigte sich, dass das Backup nur bestimmte Ordner enthielt und nicht alle. Dann öffnete sich wieder das Fenster mit Fix, das wieder lief. Externe Festplatte liess sich nicht abmelden, da nicht als weitere Festplatte erkannt. Habe den den USB-Anschluss aus dem Computer gezogen. Systemwiederherstellung ging auch nur zu dem Punkt nach Fix! Hin und her. Wurde alles jedesmal schlechter in der Verfügbarkeit der Programme. Internet geht auch nicht mehr. Schreibe von einem fremden Computer.
Folgende Fehlermeldungen kommen:

IAStorIcon funktioniert nicht mehr (stopped working)

Catalyst Control Center: Host application funktioniert nicht mehr (stopped working), mit Liste Problemereignisname: CLR20r3

settings.ini wird von einem anderen Prozess verwendet

Generell gilt:

Sie verfügen momentan nicht über die Berechtigung des Zugriffs auf diesen Ordner (Option: Fortsetzen, aber nur in den Verzeichnissen, Dateien selbst sind für zugriff gesperrt)

keine Zugriffsberechtigung für dateispeicherort

Und beim Browser:

Ihr Profil Firefox kann nicht geladen werden. Es ist möglicherweise nicht vorhanden oder ein Zugriff ist nicht möglich.

Übrigens, als das Fix zu Ende war, sah ich in dem File (leider auch verschwunden), dass bei den verschwundenen Dateien dahinter stand "moved successfully"

FRST geht mittlerweile übrigens auch nicht mehr.

Wie geht es jetzt weiter??? Bin völlig am Boden!!!

Gruß Erik1000

schrauber · 05.09.2013, 14:06

Sehr komisch.

Zitat:

Systemwiederherstellung ging auch nur zu dem Punkt nach Fix

Waren keine anderen Punkte da?

Schau mal genau, eventuell mit Win DVD von aussen boten und die Systemwiederherstellung ansteuern.

edit:

Lösch mal die FRST vom Desktop, nur die vom Desktop. Und lad eine neue FRST Version. Scanne dann und poste das Logfile.

Erik1000 · 05.09.2013, 16:21

Hallo Schrauber,

wie meinst du das mit Win DVD von aussen boten?
Es war übrigens definitiv kein Systemwiederherstellungspunkt nach dem Fix vorhanden. Habe mich sehr gewundert!
Das FRST ziehe ich mir von einem anderen Computer und schiebe es dann auf meinen Computerdesktop, ok?

Gruß Erik1000

Hallo Schrauber,

bevor gar nichts mehr ging, habe ich noch ein FRST erstellen können. Ist vielleicht eine Hilfe (war nach dem Fix und dem Backup). Gruß Erik1000

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-08-2013 02 (ATTENTION: ====> FRST version is 15 days old and could be outdated)
Ran by eh (administrator) on 05-09-2013 08:54:20
Running from C:\Users\eh\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\hsscp.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe
() C:\Program Files (x86)\Hotspot Shield\bin\openvpn.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbwmgr.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbw.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbw.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\fbw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\klwtblfs.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-04-12] (Google Inc.)
HKCU\...\Run: [WinPatrol] - C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [439360 2013-08-13] (BillP Studios)
HKCU\...\Run: [BrowserChoice] - C:\Windows\System32\browserchoice.exe [294912 2010-02-23] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-09-28] (cyberlink)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [688128 2011-07-06] ()
HKLM-x32\...\Run: [CLX3180_Scan2Pc] - C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [3180 Scan2PC] - C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe [1990144 2011-04-29] ()
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-11-16] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1481280 2013-07-01] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [ApnTBMon] - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/tb/ie_startpage
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {0BFFCEE0-9808-4EDA-8D13-2D1D414BC027} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {19167A5C-815E-4BED-A280-EEE7D4CD3E3D} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL = hxxp://go.mail.com/br/ie8_search_web/?su={searchTerms}
SearchScopes: HKCU - {8D9A183F-79E7-4986-A0DA-302A21EEF529} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {B0B60347-DD99-4B69-B9A5-CE72259C1ED2} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: GMX Konfiguration - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - GMX MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - GMX MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afext@anchorfree.com
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: () - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi\3.5.0.0_0
CHR Extension: () - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: () - C:\Users\eh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

==================== Services (Whitelisted) =================

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-11-16] (Kaspersky Lab ZAO)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [852264 2013-08-16] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2013-08-13] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [555304 2013-08-16] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2011-10-07] ()
S2 APNMCP; "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe" [x]

==================== Drivers (Whitelisted) ====================

S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [46792 2013-08-13] (AnchorFree Inc.)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-04-24] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-11-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-11-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-24] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-08-13] (Anchorfree Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-05 04:19 - 2013-09-05 04:20 - 00000000 ____D C:\Users\eh\FRST
2013-09-04 18:38 - 2013-09-04 18:38 - 00094048 _____ C:\Users\eh\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-04 18:38 - 2013-09-04 18:38 - 00000020 ___SH C:\Users\eh\ntuser.ini
2013-09-03 15:42 - 2013-09-05 04:49 - 00000000 ____D C:\FRST
2013-08-31 12:03 - 2013-08-31 12:03 - 00001075 _____ C:\DelFix.txt
2013-08-31 12:03 - 2013-08-31 12:03 - 00000000 ____D C:\Windows\ERUNT
2013-08-29 11:25 - 2013-08-29 11:25 - 00000000 ____D C:\Users\eh\Cyberlink
2013-08-29 11:16 - 2013-09-04 17:59 - 00000000 ____D C:\Users\eh\AppData\Local\WinZip
2013-08-29 11:15 - 2013-08-29 11:53 - 00000000 ____D C:\Program Files (x86)\WinZip
2013-08-29 11:15 - 2013-08-29 11:16 - 00000000 ____D C:\ProgramData\WinZip
2013-08-29 11:12 - 2013-08-29 11:12 - 00000000 ____D C:\Program Files (x86)\Universal Extractor
2013-08-28 14:53 - 2013-09-04 16:51 - 00000000 ____D C:\Users\eh\pdf Test
2013-08-28 14:51 - 2013-08-30 10:51 - 00000000 ____D C:\Users\eh\AppData\Local\CutePDF Writer
2013-08-28 14:42 - 2013-08-28 14:42 - 00001124 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-08-28 14:41 - 2013-09-05 04:49 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:42 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Users\eh\AppData\Roaming\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\GPLGS
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\Acro Software
2013-08-28 14:40 - 2013-08-13 01:07 - 00046792 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-08-28 14:40 - 2012-10-04 19:49 - 00087152 _____ C:\Windows\system32\cpwmon64.dll
2013-08-26 12:17 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-08-26 12:17 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-08-26 12:17 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-08-26 12:17 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-08-26 12:17 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-08-26 12:17 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-08-26 12:17 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-08-26 12:17 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-08-26 12:17 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-08-26 12:17 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-08-26 12:17 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-26 12:17 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-08-26 12:17 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-08-26 12:17 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-26 12:17 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-08-26 12:17 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-26 12:17 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-08-26 12:17 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-08-26 12:17 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-26 12:17 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-08-26 12:17 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-08-26 12:17 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-08-26 12:17 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-08-26 12:17 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-26 12:17 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-26 12:16 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-08-26 12:16 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-08-26 12:16 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-08-26 12:16 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-08-26 12:16 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-26 12:16 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-08-26 12:16 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-08-26 12:15 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-08-26 12:15 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-08-26 12:11 - 2013-08-26 12:11 - 00261990 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-24 12:52 - 2013-08-24 12:52 - 00818944 _____ C:\Users\eh\Downloads\adblockplus-2.2.4.xpi.zip
2013-08-24 12:41 - 2013-09-04 17:56 - 00000000 ____D C:\Users\eh\AppData\Roaming\WinPatrol
2013-08-24 12:41 - 2013-08-25 18:50 - 00000000 ____D C:\ProgramData\InstallMate
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-08-24 12:07 - 2013-09-05 08:17 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-24 12:07 - 2013-08-24 12:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Users\eh\AppData\Local\Secunia PSI
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-23 17:22 - 2013-08-23 17:22 - 00448512 _____ (OldTimer Tools) C:\Users\eh\Desktop\TFC.exe
2013-08-23 09:10 - 2013-08-23 09:10 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-22 14:19 - 2013-08-22 14:19 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-22 14:19 - 2013-08-22 14:19 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-22 13:07 - 2013-08-22 13:07 - 01576476 _____ (Farbar) C:\Users\eh\Desktop\FRST64.exe
2013-08-22 03:45 - 2013-08-22 03:45 - 00001106 _____ C:\Users\eh\Desktop\checkup.txt
2013-08-22 03:38 - 2013-08-22 03:38 - 00891115 _____ C:\Users\eh\Desktop\SecurityCheck.exe
2013-08-21 18:03 - 2013-08-21 18:03 - 00001479 _____ C:\Users\eh\Desktop\AdwCleaner[S0].txt
2013-08-21 14:32 - 2013-08-21 17:52 - 00000000 ____D C:\AdwCleaner
2013-08-21 14:31 - 2013-08-21 14:31 - 00975858 _____ C:\Users\eh\Desktop\adwcleaner.exe
2013-08-21 14:15 - 2013-08-25 18:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-21 14:15 - 2013-08-21 14:15 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\Users\eh\AppData\Roaming\Malwarebytes
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 14:15 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-21 14:09 - 2013-08-21 14:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\eh\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-21 14:01 - 2013-09-04 16:48 - 00000000 ____D C:\Users\eh\Trojaner Board
2013-08-21 12:06 - 2013-08-21 12:06 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-21 12:03 - 2013-08-21 12:03 - 01110476 _____ C:\Users\eh\Desktop\7z920.exe
2013-08-21 11:29 - 2013-08-21 11:50 - 00000000 ____D C:\Windows\erdnt
2013-08-21 11:27 - 2013-08-21 11:27 - 05109244 ____R (Swearware) C:\Users\eh\Desktop\ComboFix.exe
2013-08-21 11:19 - 2013-08-21 11:19 - 00473448 _____ C:\Windows\Minidump\082113-263704-01.dmp
2013-08-21 09:50 - 2013-08-21 09:50 - 00003017 _____ C:\Users\eh\Desktop\Gmer.txt
2013-08-21 09:06 - 2013-08-21 09:06 - 00377856 _____ C:\Users\eh\Desktop\g0ns0w1j.exe
2013-08-21 09:01 - 2013-08-21 09:01 - 00039392 _____ C:\Users\eh\Desktop\Addition.txt
2013-08-21 08:50 - 2013-08-21 08:50 - 00000466 _____ C:\Users\eh\Desktop\defogger_disable.log
2013-08-21 08:47 - 2013-08-21 08:47 - 00050477 _____ C:\Users\eh\Desktop\Defogger.exe
2013-08-20 09:48 - 2013-08-22 14:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-16 11:11 - 2013-09-04 16:48 - 00000000 ____D C:\Users\eh\Versorgungsamt
2013-08-15 10:05 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 10:05 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 10:05 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 10:05 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 10:05 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 10:05 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 10:05 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 10:05 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 10:05 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 10:05 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 10:05 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 10:05 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 10:05 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 10:05 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 09:36 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-15 09:36 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-15 09:36 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 09:36 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-15 09:36 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 09:36 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 09:36 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-15 09:36 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 09:36 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 09:36 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 09:36 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-15 09:36 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-15 09:36 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-15 09:36 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-15 09:36 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-15 09:36 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-15 09:36 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-15 09:36 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-15 09:36 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-15 09:36 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 09:36 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 01:10 - 2013-08-13 01:10 - 00042184 _____ (Anchorfree Inc.) C:\Windows\system32\Drivers\taphss6.sys
2013-08-10 10:27 - 2013-08-10 10:27 - 00000000 ____D C:\Users\eh\AppData\Local\{F3A2DFDC-6138-4305-A3DB-37ACD2F47FDF}
2013-08-07 17:45 - 2013-08-07 17:46 - 00000000 ____D C:\Users\eh\AppData\Local\{7D396E2D-3A7B-4A7A-9C6B-B3ADBE0B4862}

==================== One Month Modified Files and Folders =======

2013-09-05 08:30 - 2012-04-12 15:52 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-05 08:17 - 2013-08-24 12:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-05 07:09 - 2012-05-12 15:41 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-09-05 04:58 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-05 04:58 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-05 04:56 - 2012-04-12 15:51 - 01779117 _____ C:\Windows\WindowsUpdate.log
2013-09-05 04:51 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh
2013-09-05 04:51 - 2012-04-12 15:52 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-05 04:51 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-05 04:51 - 2009-07-14 06:51 - 00239525 _____ C:\Windows\setupact.log
2013-09-05 04:50 - 2012-05-12 15:30 - 00000000 ____D C:\Users\eh\Downloads\Kaspersky
2013-09-05 04:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-09-05 04:49 - 2013-09-03 15:42 - 00000000 ____D C:\FRST
2013-09-05 04:49 - 2013-08-28 14:41 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-09-05 04:49 - 2012-07-06 08:21 - 00000000 ____D C:\Users\eh\AppData\Roaming\Mozilla
2013-09-05 04:49 - 2012-04-12 16:55 - 00000000 ____D C:\Users\eh\AppData\Local\S2PC
2013-09-05 04:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-09-05 04:20 - 2013-09-05 04:19 - 00000000 ____D C:\Users\eh\FRST
2013-09-05 04:13 - 2012-08-07 09:37 - 00000000 ____D C:\Users\eh\Bildschirmbilder
2013-09-05 04:13 - 2012-04-27 14:50 - 00000000 ____D C:\Users\eh\AppData\Local\Windows Live
2013-09-04 18:48 - 2012-04-12 18:04 - 00000000 ____D C:\Users\eh\Documents\Post
2013-09-04 18:38 - 2013-09-04 18:38 - 00094048 _____ C:\Users\eh\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-04 18:38 - 2013-09-04 18:38 - 00000020 ___SH C:\Users\eh\ntuser.ini
2013-09-04 18:05 - 2010-11-21 05:47 - 00083078 _____ C:\Windows\PFRO.log
2013-09-04 17:59 - 2013-08-29 11:16 - 00000000 ____D C:\Users\eh\AppData\Local\WinZip
2013-09-04 17:59 - 2012-04-12 17:20 - 00000000 ____D C:\Users\eh\AppData\Local\Microsoft Help
2013-09-04 17:59 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh\AppData\Local\VirtualStore
2013-09-04 17:57 - 2012-04-12 15:57 - 00000000 ___RD C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-04 17:57 - 2012-04-12 15:57 - 00000000 ___RD C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-09-04 17:57 - 2012-04-12 15:57 - 00000000 ___RD C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-04 17:57 - 2012-04-12 15:57 - 00000000 ___RD C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-09-04 17:57 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerRecover
2013-09-04 17:56 - 2013-08-24 12:41 - 00000000 ____D C:\Users\eh\AppData\Roaming\WinPatrol
2013-09-04 17:56 - 2012-04-13 10:11 - 00000000 ____D C:\Users\eh\Bewerbungen 2012
2013-09-04 17:56 - 2012-04-12 17:59 - 00000000 ____D C:\Users\eh\AppData\Roaming\WebApp
2013-09-04 17:31 - 2012-09-12 21:21 - 00000000 ____D C:\Users\eh\Doris
2013-09-04 17:20 - 2013-05-13 17:28 - 00000000 ____D C:\Users\eh\MLP
2013-09-04 17:20 - 2013-04-23 10:04 - 00000000 ____D C:\Users\eh\IGHA
2013-09-04 17:20 - 2012-05-12 15:30 - 00000000 ____D C:\Users\eh\Kaspersky
2013-09-04 16:51 - 2013-08-28 14:53 - 00000000 ____D C:\Users\eh\pdf Test
2013-09-04 16:50 - 2012-06-20 11:41 - 00000000 ____D C:\Users\eh\privat
2013-09-04 16:48 - 2013-08-21 14:01 - 00000000 ____D C:\Users\eh\Trojaner Board
2013-09-04 16:48 - 2013-08-16 11:11 - 00000000 ____D C:\Users\eh\Versorgungsamt
2013-09-04 16:48 - 2012-05-16 11:43 - 00000000 ____D C:\Users\eh\tests
2013-09-04 16:48 - 2012-04-28 10:29 - 00000000 ____D C:\Users\eh\Tracing
2013-09-03 15:10 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-31 12:03 - 2013-08-31 12:03 - 00001075 _____ C:\DelFix.txt
2013-08-31 12:03 - 2013-08-31 12:03 - 00000000 ____D C:\Windows\ERUNT
2013-08-31 11:42 - 2012-04-12 16:59 - 00000099 _____ C:\Users\Public\LMDebug.log
2013-08-30 10:51 - 2013-08-28 14:51 - 00000000 ____D C:\Users\eh\AppData\Local\CutePDF Writer
2013-08-30 09:38 - 2012-04-12 15:53 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-29 11:53 - 2013-08-29 11:15 - 00000000 ____D C:\Program Files (x86)\WinZip
2013-08-29 11:52 - 2011-08-22 19:38 - 00000000 ____D C:\Users\Public\CyberLink
2013-08-29 11:52 - 2011-08-22 19:10 - 00000000 ____D C:\ProgramData\CyberLink
2013-08-29 11:25 - 2013-08-29 11:25 - 00000000 ____D C:\Users\eh\Cyberlink
2013-08-29 11:25 - 2012-04-12 17:48 - 00000000 ____D C:\Users\eh\Documents\CyberLink
2013-08-29 11:25 - 2012-04-12 17:48 - 00000000 ____D C:\Users\eh\AppData\Roaming\CyberLink
2013-08-29 11:16 - 2013-08-29 11:15 - 00000000 ____D C:\ProgramData\WinZip
2013-08-29 11:12 - 2013-08-29 11:12 - 00000000 ____D C:\Program Files (x86)\Universal Extractor
2013-08-28 14:42 - 2013-08-28 14:42 - 00001124 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-08-28 14:42 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Users\eh\AppData\Roaming\Hotspot Shield
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\GPLGS
2013-08-28 14:40 - 2013-08-28 14:40 - 00000000 ____D C:\Program Files (x86)\Acro Software
2013-08-27 17:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-27 10:42 - 2012-11-23 12:45 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-26 12:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-26 12:11 - 2013-08-26 12:11 - 00261990 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-26 12:01 - 2012-04-12 17:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-25 18:50 - 2013-08-24 12:41 - 00000000 ____D C:\ProgramData\InstallMate
2013-08-25 18:41 - 2013-08-21 14:15 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 18:40 - 2011-08-22 19:09 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-08-25 18:40 - 2011-08-22 19:09 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-08-24 12:52 - 2013-08-24 12:52 - 00818944 _____ C:\Users\eh\Downloads\adblockplus-2.2.4.xpi.zip
2013-08-24 12:41 - 2013-08-24 12:41 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-08-24 12:10 - 2011-03-14 16:08 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-08-24 12:07 - 2013-08-24 12:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 12:07 - 2012-04-19 21:32 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-24 12:07 - 2011-08-22 19:09 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Users\eh\AppData\Local\Secunia PSI
2013-08-24 12:03 - 2013-08-24 12:03 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-23 17:22 - 2013-08-23 17:22 - 00448512 _____ (OldTimer Tools) C:\Users\eh\Desktop\TFC.exe
2013-08-23 09:11 - 2012-04-13 14:35 - 00000000 ____D C:\Users\eh\AppData\Local\Adobe
2013-08-23 09:10 - 2013-08-23 09:10 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-23 09:03 - 2012-07-06 08:21 - 00000000 ____D C:\Users\eh\AppData\Local\Mozilla
2013-08-23 09:03 - 2012-04-12 15:57 - 00000000 ____D C:\Users\eh\AppData\Roaming\Macromedia
2013-08-23 09:03 - 2012-04-12 15:56 - 00000000 ____D C:\Program Files (x86)\Memeo
2013-08-22 15:12 - 2010-11-21 09:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-22 14:48 - 2011-08-22 19:00 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-22 14:34 - 2011-08-22 19:00 - 00000000 ____D C:\ProgramData\Adobe
2013-08-22 14:19 - 2013-08-22 14:19 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-08-22 14:19 - 2013-08-22 14:19 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-22 14:19 - 2013-08-22 14:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-22 14:19 - 2011-11-23 20:34 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-22 14:19 - 2011-11-23 20:34 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-22 14:18 - 2013-08-20 09:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-22 13:07 - 2013-08-22 13:07 - 01576476 _____ (Farbar) C:\Users\eh\Desktop\FRST64.exe
2013-08-22 03:48 - 2012-04-12 16:18 - 00000000 ____D C:\Users\eh\AppData\Local\Google
2013-08-22 03:45 - 2013-08-22 03:45 - 00001106 _____ C:\Users\eh\Desktop\checkup.txt
2013-08-22 03:38 - 2013-08-22 03:38 - 00891115 _____ C:\Users\eh\Desktop\SecurityCheck.exe
2013-08-21 18:03 - 2013-08-21 18:03 - 00001479 _____ C:\Users\eh\Desktop\AdwCleaner[S0].txt
2013-08-21 17:52 - 2013-08-21 14:32 - 00000000 ____D C:\AdwCleaner
2013-08-21 14:31 - 2013-08-21 14:31 - 00975858 _____ C:\Users\eh\Desktop\adwcleaner.exe
2013-08-21 14:15 - 2013-08-21 14:15 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\Users\eh\AppData\Roaming\Malwarebytes
2013-08-21 14:15 - 2013-08-21 14:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-21 14:09 - 2013-08-21 14:09 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\eh\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-21 12:06 - 2013-08-21 12:06 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-21 12:03 - 2013-08-21 12:03 - 01110476 _____ C:\Users\eh\Desktop\7z920.exe
2013-08-21 11:50 - 2013-08-21 11:29 - 00000000 ____D C:\Windows\erdnt
2013-08-21 11:50 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-21 11:27 - 2013-08-21 11:27 - 05109244 ____R (Swearware) C:\Users\eh\Desktop\ComboFix.exe
2013-08-21 11:19 - 2013-08-21 11:19 - 00473448 _____ C:\Windows\Minidump\082113-263704-01.dmp
2013-08-21 11:19 - 2013-07-12 15:38 - 00000000 ____D C:\Windows\Minidump
2013-08-21 11:15 - 2013-07-12 15:38 - 697460971 _____ C:\Windows\MEMORY.DMP
2013-08-21 09:50 - 2013-08-21 09:50 - 00003017 _____ C:\Users\eh\Desktop\Gmer.txt
2013-08-21 09:06 - 2013-08-21 09:06 - 00377856 _____ C:\Users\eh\Desktop\g0ns0w1j.exe
2013-08-21 09:01 - 2013-08-21 09:01 - 00039392 _____ C:\Users\eh\Desktop\Addition.txt
2013-08-21 08:50 - 2013-08-21 08:50 - 00000466 _____ C:\Users\eh\Desktop\defogger_disable.log
2013-08-21 08:47 - 2013-08-21 08:47 - 00050477 _____ C:\Users\eh\Desktop\Defogger.exe
2013-08-20 15:22 - 2011-03-11 11:20 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-08-20 15:22 - 2011-03-11 11:20 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-08-20 15:22 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-20 11:39 - 2012-07-06 08:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-15 10:02 - 2013-07-25 14:52 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 10:01 - 2011-03-14 16:08 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-13 01:10 - 2013-08-13 01:10 - 00042184 _____ (Anchorfree Inc.) C:\Windows\system32\Drivers\taphss6.sys
2013-08-13 01:07 - 2013-08-28 14:40 - 00046792 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-08-10 10:27 - 2013-08-10 10:27 - 00000000 ____D C:\Users\eh\AppData\Local\{F3A2DFDC-6138-4305-A3DB-37ACD2F47FDF}
2013-08-07 17:46 - 2013-08-07 17:45 - 00000000 ____D C:\Users\eh\AppData\Local\{7D396E2D-3A7B-4A7A-9C6B-B3ADBE0B4862}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-02 15:19

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 06.09.2013, 08:02

Geh mal nach C:\FRST\Quarantine und mach davon nen Screenshot.

26.08.2013, 17:55	#16
schrauber /// the machine /// TB-Ausbilder	Windows 7: Kaspersky Internet Security 2013 findet Trojaner HEUR:Exploit.Java.CVE-2013-1493.gen Sollte dich zu filepony führen wo du den entsprechenden Browser aussuchen kannst __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

27.08.2013, 11:10	#18
schrauber /// the machine /// TB-Ausbilder	Windows 7: Kaspersky Internet Security 2013 findet Trojaner HEUR:Exploit.Java.CVE-2013-1493.gen Du hast auf die WErbung geklickt anstatt auf den Download. Poste ein frisches FRST log, ich schau kurz drüber. __________________ __________________

30.08.2013, 19:59	#24
schrauber /// the machine /// TB-Ausbilder	Windows 7: Kaspersky Internet Security 2013 findet Trojaner HEUR:Exploit.Java.CVE-2013-1493.gen Hast Du obiges noch gemacht? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

06.09.2013, 08:02	#30
schrauber /// the machine /// TB-Ausbilder	Windows 7: Kaspersky Internet Security 2013 findet Trojaner HEUR:Exploit.Java.CVE-2013-1493.gen Geh mal nach C:\FRST\Quarantine und mach davon nen Screenshot. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 7: Kaspersky Internet Security 2013 findet Trojaner HEUR:Exploit.Java.CVE-2013-1493.gen

Log-Analyse und Auswertung: Windows 7: Kaspersky Internet Security 2013 findet Trojaner HEUR:Exploit.Java.CVE-2013-1493.gen