| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Der Bundestrojaner hat mich erwischt was soll ich tun?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.09.2013, 20:34
| #1 |
 |  Der Bundestrojaner hat mich erwischt was soll ich tun? ich habe schon mit malewarebytes gescannt und er hat ein paar backdoors gelöscht, aber manchmal hängen youtube videos noch, vllt ist der trojaner noch erhalten? hier der log von meinem computer: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013
Ran by robin (administrator) on ROBIN-PC on 01-09-2013 21:22:21
Running from C:\Users\robin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
() C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Anvisoft) C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google) C:\Users\robin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\robin\Downloads\FRST64 (2).exe
==================== Registry (Whitelisted) ==================
HKCU\...\Run: [Steam] - C:\desktop\Steam.exe [1811880 2013-08-28] (Valve Corporation)
MountPoints2: E - E:\Autorun.exe
MountPoints2: {057561c7-1d72-11e2-93cd-806e6f6e6963} - E:\Autorun.exe
MountPoints2: {057561c8-1d72-11e2-93cd-806e6f6e6963} - F:\autorun.exe
MountPoints2: {1a845c2e-3580-11e2-9c5a-bcaec58adf4a} - G:\SETUP.EXE
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\..\Interfaces\{B31DEBB0-610E-458B-A1F8-89B230C701C6}: [NameServer]217.0.43.129 217.0.43.145
FireFox:
========
FF ProfilePath: C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default
FF NetworkProxy: "gopher", ""
FF NetworkProxy: "gopher_port", 0
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\robin\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\robin\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\searchplugins\icq.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\Extensions\{51d8c82e-1773-4c4b-b23e-f5723ca44642}
FF Extension: support - C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\Extensions\support@free-hideip.com.xpi
FF Extension: No Name - C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\robin\AppData\Local\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\robin\AppData\Local\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\robin\AppData\Local\Google\Chrome\Application\29.0.1547.57\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Uplay PC) - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
CHR Plugin: (Google Update) - C:\Users\robin\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Google Talk Plugin) - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.6_0
CHR Extension: (Freemake Video Converter) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Late Night) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgbdhkpacgdhfabeceekiafonfkipohm\1.0_0
CHR Extension: (Gmail) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2012-07-11] (SUPERAntiSpyware.com)
R2 AdblockerSrv; C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe [315600 2013-06-07] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 asdsrv; C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe [739400 2013-06-08] (Anvisoft)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-08-19] ()
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393080 2012-10-25] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384888 2012-10-25] (BlueStack Systems, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R2 asdnet; C:\Windows\system32\DRIVERS\asdnet.sys [19280 2012-09-07] ()
R2 asdnet; C:\Windows\system32\DRIVERS\asdnet.sys [19280 2012-09-07] ()
R1 asdrm; C:\Windows\System32\DRIVERS\asdrm.sys [18768 2012-11-07] (Anvisoft)
R2 asdrs; C:\Windows\system32\DRIVERS\asdrs.sys [23376 2012-11-07] (Anvisoft)
R2 asdrs; C:\Windows\system32\DRIVERS\asdrs.sys [23376 2012-11-07] (Anvisoft)
R2 asdws; C:\Windows\system32\DRIVERS\asdws.sys [17232 2012-11-07] ()
R2 asdws; C:\Windows\system32\DRIVERS\asdws.sys [17232 2012-11-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [71032 2012-10-25] (BlueStack Systems)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [71032 2012-10-25] (BlueStack Systems)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-11-25] (DT Soft Ltd)
R0 FSProFilter; C:\Windows\System32\Drivers\FSPFltd.sys [54848 2010-07-22] (FSPro Labs)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 RTLE8023x64; C:\Windows\System32\DRIVERS\Rtenic64.sys [280344 2010-07-06] (Realtek Semiconductor Corporation )
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 ALSysIO; \??\C:\Users\robin\AppData\Local\Temp\ALSysIO64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-01 21:21 - 2013-09-01 21:21 - 00000552 _____ C:\Users\robin\Downloads\defogger_disable.log
2013-09-01 21:21 - 2013-09-01 21:21 - 00000178 _____ C:\Users\robin\defogger_reenable
2013-09-01 21:20 - 2013-09-01 21:20 - 00050477 _____ C:\Users\robin\Downloads\Defogger.exe
2013-09-01 21:15 - 2013-09-01 21:15 - 00064832 _____ C:\Users\robin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-01 01:25 - 2013-09-01 01:30 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607 (1).7z
2013-09-01 01:17 - 2013-09-01 01:20 - 55441069 _____ C:\Users\robin\Downloads\WATER_1-75b-13268-1-75b.7z
2013-09-01 01:15 - 2013-09-01 01:15 - 00129168 _____ C:\Users\robin\Downloads\Horse_Whistle_DV.7z
2013-09-01 01:12 - 2013-09-01 01:12 - 00002913 _____ C:\Users\robin\Downloads\LMBetuchtereHaendlerDV.7z
2013-09-01 01:10 - 2013-09-01 01:10 - 00041965 _____ C:\Users\robin\Downloads\Skyrim Universal 4GB Memory Patch-3211-1-0.rar
2013-09-01 00:54 - 2013-09-01 00:54 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5 (1).zip
2013-09-01 00:45 - 2013-09-01 00:45 - 01725584 _____ C:\Users\robin\Downloads\Enhanced Night Skyrim v04 Color Galaxy-85-0-4.zip
2013-09-01 00:40 - 2013-09-01 01:27 - 00000000 ____D C:\Users\robin\Desktop\The Elder Scrolls V- Skyrim
2013-09-01 00:40 - 2013-09-01 00:40 - 00000604 _____ C:\Users\Public\Desktop\Steam.lnk
2013-09-01 00:40 - 2013-09-01 00:40 - 00000000 ____D C:\dumps
2013-09-01 00:37 - 2013-09-01 00:38 - 00000000 ____D C:\Users\robin\Desktop\Saves Skyrim
2013-09-01 00:31 - 2013-09-01 00:31 - 00001501 _____ C:\Users\robin\Downloads\No NPC Greetings-746-1-1.7z
2013-08-31 23:19 - 2013-09-01 00:06 - 141941828 _____ C:\Users\robin\Downloads\TESVSUP9E.rar
2013-08-31 21:10 - 2013-08-31 21:10 - 00000000 ____D C:\ProgramData\Steam
2013-08-31 21:09 - 2013-09-01 00:36 - 00000000 ____D C:\Users\robin\Desktop\X original skyrim dateien
2013-08-31 20:59 - 2013-08-31 21:00 - 00000000 ____D C:\Users\robin\Desktop\skyrim update 13
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.rar
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r09
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r08
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r07
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r06
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r05
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r04
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r01
2013-08-31 20:59 - 2013-03-23 03:17 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r00
2013-08-31 20:59 - 2013-03-23 03:17 - 04082181 _____ C:\Users\robin\Desktop\rld-tesvsu13.r10
2013-08-31 20:59 - 2013-03-23 03:16 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r03
2013-08-31 20:59 - 2013-03-23 03:16 - 15000000 _____ C:\Users\robin\Desktop\rld-tesvsu13.r02
2013-08-31 20:11 - 2013-08-12 13:57 - 00000000 ____D C:\Users\robin\Downloads\Tor Browser
2013-08-31 20:06 - 2013-08-31 20:07 - 28117938 _____ (Igor Pavlov) C:\Users\robin\Downloads\tor-browser-2.3.25-12_de.exe
2013-08-31 19:48 - 2013-08-31 20:44 - 170764161 _____ C:\Users\robin\Downloads\Th.Eld3r.Scr0lls.V.Skyr1m.Update.13.rar
2013-08-31 18:53 - 2013-08-31 18:53 - 00024837 _____ C:\Users\robin\Downloads\Addition.txt
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64.exe
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (1).exe
2013-08-31 18:50 - 2013-08-31 18:50 - 00000000 ____D C:\FRST
2013-08-30 18:06 - 2013-08-30 19:11 - 00000000 ____D C:\AdwCleaner
2013-08-30 09:52 - 2013-08-30 09:52 - 00586952 _____ C:\Users\robin\Downloads\AntiBundestrojaner_Globell_V_1_3_3.zip
2013-08-30 09:42 - 2013-08-30 09:43 - 00007662 _____ C:\Users\robin\AppData\Local\Resmon.ResmonCfg
2013-08-30 09:27 - 2013-08-30 09:27 - 00001113 ____H C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-30 09:27 - 2013-08-30 09:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-30 09:27 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-30 09:26 - 2013-08-30 09:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\robin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-30 09:26 - 2013-08-30 09:26 - 00994642 _____ C:\Users\robin\Downloads\adwcleaner.exe
2013-08-30 09:24 - 2013-08-30 09:24 - 01072975 _____ (Farbar) C:\Users\robin\Downloads\FRST.exe
2013-08-30 09:20 - 2013-08-30 09:20 - 00112154 _____ C:\Users\robin\Downloads\CtfmonRemoverDE-v2.3.zip
2013-08-30 09:20 - 2009-07-14 03:14 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ctfmon.exe.backup
2013-08-29 21:09 - 2013-08-29 21:09 - 00630687 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (2).7z
2013-08-29 13:53 - 2013-08-29 13:55 - 41601136 _____ C:\Users\robin\Downloads\Enhanced Blood Textures 3_5b-60-3-5b.rar
2013-08-28 02:14 - 2013-08-28 03:03 - 708661259 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Towns-607.7z
2013-08-28 02:13 - 2013-08-28 02:15 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (2).7z
2013-08-28 02:13 - 2013-08-28 02:13 - 00001037 _____ C:\Users\robin\Downloads\WATER Falskaar V2-13268-1-75.7z
2013-08-27 15:05 - 2013-08-27 15:06 - 00001335 _____ C:\DelFix.txt
2013-08-27 12:45 - 2013-08-27 12:47 - 53785544 _____ C:\Users\robin\Downloads\Enhanced Lights and FX-27043-0-3-2.7z
2013-08-27 12:41 - 2013-08-27 12:41 - 00125208 _____ C:\Users\robin\Downloads\WATER_1_6_Compatibility_Patch-30936-1-0.zip
2013-08-27 12:39 - 2013-08-27 12:39 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (1).7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630850 _____ C:\Users\robin\Downloads\Option A - Performance - V2_1e - CoT - RLO-30936-2-1e.7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630766 _____ C:\Users\robin\Downloads\Option B - FULL - V2_2i - CoT - ELFX-30936-2-2i.7z
2013-08-27 12:36 - 2013-08-27 12:36 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f.7z
2013-08-27 12:00 - 2013-08-27 12:01 - 15201702 _____ C:\Users\robin\Downloads\Realistic Nude Female-7841.zip
2013-08-27 11:58 - 2013-08-27 11:58 - 01345792 _____ C:\Users\robin\Downloads\Mods-fr-Skyrim--Top-10-Downloads-Setup.exe
2013-08-27 11:52 - 2013-08-27 11:55 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female (1).rar
2013-08-27 11:48 - 2013-08-27 11:48 - 00002330 _____ C:\Users\robin\Desktop\Google Chrome.lnk
2013-08-27 11:48 - 2013-08-27 11:48 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-08-27 11:46 - 2013-08-27 11:47 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757(1).exe
2013-08-27 11:34 - 2013-08-27 11:39 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female.rar
2013-08-26 23:46 - 2013-08-26 23:47 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757.exe
2013-08-26 22:09 - 2013-08-26 22:14 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607.7z
2013-08-26 21:51 - 2013-08-26 21:53 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (1).7z
2013-08-26 21:49 - 2013-08-26 21:51 - 47688161 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75.7z
2013-08-26 21:42 - 2013-08-26 23:26 - 00000000 ____D C:\Users\robin\AppData\Local\Black_Tree_Gaming
2013-08-26 21:42 - 2013-08-26 21:42 - 00000000 ____D C:\Users\robin\Documents\Nexus Mod Manager
2013-08-26 21:41 - 2013-08-26 21:42 - 04123248 _____ (Black Tree Gaming ) C:\Users\robin\Downloads\Nexus Mod Manager-0.45.6.exe
2013-08-26 21:31 - 2013-08-26 21:36 - 126014880 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Landscape-607.7z
2013-08-26 20:24 - 2013-08-26 20:25 - 05216840 _____ C:\Users\robin\Downloads\EDT 1-6-1598-1-6.7z
2013-08-26 13:41 - 2013-08-26 13:41 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5.zip
2013-08-26 13:39 - 2013-08-26 21:44 - 00000000 ____D C:\Users\robin\AppData\Local\Skyrim
2013-08-26 13:38 - 2013-08-26 13:38 - 00090834 _____ C:\Users\robin\Desktop\Skyrim4GB_-_Binaries_and_Source_-_Update_5-1013-1-5[1].zip
2013-08-26 12:17 - 2013-08-26 12:17 - 00090834 _____ C:\Users\robin\Desktop\Skyrim4GB_-_Binaries_and_Source_-_Update_5-1013-1-5.zip
2013-08-26 12:00 - 2013-08-26 23:53 - 00000000 ____D C:\Users\robin\Desktop\Neuer Ordner (2)
2013-08-24 11:35 - 2013-08-24 11:35 - 12569271 _____ C:\Users\robin\Downloads\Silua - By Metens.Sims3Pack
2013-08-24 11:34 - 2013-08-24 11:35 - 03409749 _____ C:\Users\robin\Downloads\The Granture.Sims3Pack
2013-08-24 11:22 - 2013-08-24 11:30 - 00000000 ____D C:\Users\robin\Desktop\Neuer Ordner
2013-08-23 16:37 - 2013-08-23 16:37 - 00083363 _____ C:\Users\robin\Downloads\remus.zip
2013-08-23 15:43 - 2013-08-23 15:43 - 00017674 _____ C:\Users\robin\AppData\Local\recently-used.xbel
2013-08-21 21:05 - 2013-08-21 21:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-21 16:47 - 2013-08-21 16:47 - 00394347 _____ (Ray Siegl ) C:\Users\robin\Downloads\ram_clean_tool_setup.exe
2013-08-21 07:41 - 2013-08-26 23:39 - 00000000 ____D C:\Users\robin\Desktop\Originals
2013-08-19 22:08 - 2013-08-27 15:05 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 09:31 - 2013-08-19 09:31 - 00377856 _____ C:\Users\robin\Downloads\gmer_2.1.19163.exe
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Program Files\Realtek
2013-08-19 06:52 - 2013-03-29 21:42 - 03379272 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2013-08-19 06:52 - 2013-03-29 18:04 - 21170176 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2013-08-19 06:52 - 2013-03-29 17:52 - 00914992 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2013-08-19 06:52 - 2013-03-29 17:10 - 00449481 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2013-08-19 06:52 - 2013-03-27 16:57 - 00135240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2013-08-19 06:52 - 2013-03-26 17:06 - 02797128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2013-08-19 06:52 - 2013-03-26 17:04 - 02734624 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2013-08-19 06:52 - 2013-03-26 15:40 - 03693128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2013-08-19 06:52 - 2013-03-26 14:38 - 01659464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2013-08-19 06:52 - 2013-03-25 17:32 - 03180264 _____ C:\Windows\system32\Drivers\rtvienna.dat
2013-08-19 06:52 - 2013-03-23 03:43 - 00208072 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2013-08-19 06:52 - 2013-03-20 13:17 - 09123608 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnA64.dll
2013-08-19 06:52 - 2013-03-20 13:16 - 02102040 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll
2013-08-19 06:52 - 2013-03-20 13:16 - 01900312 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek264.dll
2013-08-19 06:52 - 2013-03-20 13:16 - 00910104 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2013-08-19 06:52 - 2013-03-15 19:34 - 04957976 _____ (A-volute) C:\Windows\system32\RTKSMlfx.dll
2013-08-19 06:52 - 2013-03-15 19:33 - 00887640 _____ (A-Volute) C:\Windows\system32\RTKSMSettingsIPC.dll
2013-08-19 06:52 - 2013-03-12 18:16 - 00613448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2013-08-19 06:52 - 2013-03-08 12:51 - 00904752 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll
2013-08-19 06:52 - 2013-02-28 13:10 - 14021912 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll
2013-08-19 06:52 - 2013-02-28 13:10 - 02032408 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00823072 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00633632 _____ (SRS Labs, Inc.) C:\Windows\system32\sltech64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00517408 _____ (SRS Labs, Inc.) C:\Windows\system32\sl3apo64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00213792 _____ (TODO: <Company name>) C:\Windows\system32\slprp64.dll
2013-08-19 06:52 - 2013-02-21 17:26 - 00858032 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll
2013-08-19 06:52 - 2013-02-21 17:26 - 00148912 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll
2013-08-19 06:52 - 2013-02-21 17:25 - 00569256 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll
2013-08-19 06:52 - 2013-02-20 18:55 - 01284680 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2013-08-19 06:52 - 2013-02-19 18:52 - 00991816 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2013-08-19 06:52 - 2013-01-17 19:32 - 00719640 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2013-08-19 06:52 - 2013-01-16 16:02 - 02079816 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2013-08-19 06:52 - 2012-12-12 11:17 - 00395208 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2013-08-19 06:52 - 2012-10-02 14:41 - 00501192 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2013-08-19 06:52 - 2012-10-02 14:41 - 00487368 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2013-08-19 06:52 - 2012-10-02 14:41 - 00415688 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2013-08-19 06:52 - 2012-09-10 20:06 - 00612728 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll
2013-08-19 06:52 - 2012-08-31 19:18 - 07164176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00434960 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00141584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00124176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00075024 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2013-08-19 06:52 - 2012-07-15 21:13 - 00394616 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2013-08-19 06:52 - 2012-06-20 17:26 - 00110592 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2013-08-19 06:52 - 2012-03-08 11:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2013-08-19 06:52 - 2012-01-30 11:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2013-08-19 06:52 - 2012-01-10 10:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2013-08-19 06:52 - 2011-12-20 15:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2013-08-19 06:52 - 2011-11-22 16:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2013-08-19 06:52 - 2011-09-02 14:21 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2013-08-19 06:52 - 2011-09-02 14:21 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2013-08-19 06:52 - 2011-09-02 14:21 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2013-08-19 06:52 - 2011-08-23 17:00 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2013-08-19 06:52 - 2011-03-17 12:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2013-08-19 06:52 - 2011-03-07 17:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2013-08-19 06:52 - 2010-11-03 18:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2013-08-19 06:52 - 2010-09-27 09:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2013-08-19 06:52 - 2010-07-22 16:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2013-08-18 07:14 - 2013-08-18 07:14 - 04251202 _____ C:\Users\robin\Downloads\Linna Modern.Sims3Pack
2013-08-18 06:23 - 2013-08-18 06:24 - 25435192 _____ C:\Users\robin\Downloads\Дом на утёсе by Laura13.rar
2013-08-17 23:45 - 2013-08-17 23:45 - 00538775 _____ C:\Users\robin\Downloads\Koposov_Set_No.8_Electronics_TV_1.sims3pack
2013-08-17 23:43 - 2013-08-17 23:43 - 00164221 _____ C:\Users\robin\Downloads\DT456 HD Television.sims3pack
2013-08-17 08:11 - 2013-08-17 08:11 - 03279645 _____ C:\Users\robin\Downloads\Tattoos.rar
2013-08-17 07:57 - 2013-08-17 08:33 - 215000000 _____ C:\Users\robin\Downloads\SiStObPrem_decrap.part1.rar
2013-08-16 23:53 - 2013-08-16 23:53 - 06931546 _____ C:\Users\robin\Downloads\KT_StoreFix_Fixes.zip
2013-08-16 23:53 - 2013-08-16 23:53 - 00237452 _____ C:\Users\robin\Downloads\KT_StoreFix_DecrapFixes.zip
2013-08-15 18:31 - 2010-06-15 11:58 - 00098496 _____ C:\Users\robin\Desktop\GTA IV Trainer +11 v1.0.7.0.exe
2013-08-15 03:04 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 03:04 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 03:04 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 03:04 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 03:04 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 03:04 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 03:04 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 03:04 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 03:04 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 03:04 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 03:04 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 03:04 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 17:10 - 2013-08-14 17:11 - 32462994 _____ (Realtek Semiconductor Corp.) C:\Users\robin\Downloads\WDM_R271.exe
2013-08-14 15:36 - 2013-08-24 13:46 - 00000000 ____D C:\Users\robin\AppData\Roaming\Media Player Classic
2013-08-14 10:03 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 10:03 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 10:03 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 10:03 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 10:03 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 10:03 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 10:03 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 10:03 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 10:02 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 10:02 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 10:02 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 10:02 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 10:02 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 10:02 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 10:02 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 10:02 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 10:02 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 10:02 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 10:02 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 10:02 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 10:02 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 10:02 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 10:02 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 10:02 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 10:02 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 10:02 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 10:02 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 09:09 - 2013-08-14 09:09 - 17960298 _____ ( ) C:\Users\robin\Downloads\K-Lite_Codec_Pack_995_Full.exe
2013-08-14 09:09 - 2012-06-09 19:21 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-08-14 09:03 - 2013-08-14 09:06 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup (1).exe
2013-08-14 08:52 - 2013-08-14 08:53 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup.exe
2013-08-14 08:52 - 2013-08-14 08:53 - 00000000 ____D C:\Users\robin\Documents\Freemake
2013-08-14 08:52 - 2013-08-14 08:53 - 00000000 ____D C:\ProgramData\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-08-14 08:36 - 2013-08-14 08:36 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\nodewave
2013-08-14 08:35 - 2013-08-14 08:36 - 00000000 ____D C:\Users\robin\AppData\Local\Deployment
2013-08-14 08:35 - 2013-08-14 08:35 - 00000000 ____D C:\Users\robin\AppData\Local\Apps\2.0
2013-08-10 14:01 - 2013-08-10 14:01 - 00000282 _____ C:\Windows\Tasks\RDReminder.job
2013-08-04 23:06 - 2013-08-04 23:06 - 00000000 ____D C:\ProgramData\Caphyon
2013-08-04 23:02 - 2013-08-04 23:02 - 00000000 ____D C:\Users\robin\AppData\Roaming\TJMM Assemblys
2013-08-04 23:01 - 2013-08-04 23:01 - 00000000 ___HD C:\Users\Default\AppData\Roaming\Macromedia
2013-08-04 23:01 - 2013-08-04 23:01 - 00000000 ___HD C:\Users\Default User\AppData\Roaming\Macromedia
2013-08-03 13:57 - 2013-08-03 13:57 - 00000000 ____D C:\Program Files\CPUID
2013-08-03 13:52 - 2013-08-03 13:52 - 00000000 ___SD C:\Users\robin\Documents\Passwords Database
2013-08-02 07:19 - 2013-08-02 07:19 - 00000000 ____D C:\ProgramData\F-Secure
2013-08-02 07:15 - 2013-08-02 07:15 - 00000000 ____D C:\Users\robin\AppData\Roaming\QuickScan
2013-08-02 06:55 - 2013-08-03 13:53 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-02 06:20 - 2013-08-04 20:48 - 00000000 ____D C:\Windows\Super nude patch 3
2013-08-02 02:29 - 2013-08-02 02:29 - 00000240 _____ C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job
==================== One Month Modified Files and Folders =======
2013-09-01 21:21 - 2013-09-01 21:21 - 01590206 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (2).exe
2013-09-01 21:21 - 2013-09-01 21:21 - 00000552 _____ C:\Users\robin\Downloads\defogger_disable.log
2013-09-01 21:21 - 2013-09-01 21:21 - 00000178 _____ C:\Users\robin\defogger_reenable
2013-09-01 21:21 - 2012-10-24 02:38 - 00000000 ____D C:\Users\robin
2013-09-01 21:20 - 2013-09-01 21:20 - 00050477 _____ C:\Users\robin\Downloads\Defogger.exe
2013-09-01 21:15 - 2013-09-01 21:15 - 00064832 _____ C:\Users\robin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-01 21:15 - 2012-11-25 02:53 - 00000000 ____D C:\Users\robin\AppData\Roaming\DAEMON Tools Pro
2013-09-01 21:15 - 2012-11-02 19:45 - 00000000 ____D C:\Users\robin\AppData\Local\CrashDumps
2013-09-01 21:15 - 2012-10-26 21:09 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-01 17:51 - 2013-07-24 22:03 - 01199373 ____N C:\Windows\WindowsUpdate.log
2013-09-01 15:45 - 2009-07-14 06:45 - 00014944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-01 15:45 - 2009-07-14 06:45 - 00014944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-01 01:30 - 2013-09-01 01:25 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607 (1).7z
2013-09-01 01:27 - 2013-09-01 00:40 - 00000000 ____D C:\Users\robin\Desktop\The Elder Scrolls V- Skyrim
2013-09-01 01:20 - 2013-09-01 01:17 - 55441069 _____ C:\Users\robin\Downloads\WATER_1-75b-13268-1-75b.7z
2013-09-01 01:15 - 2013-09-01 01:15 - 00129168 _____ C:\Users\robin\Downloads\Horse_Whistle_DV.7z
2013-09-01 01:12 - 2013-09-01 01:12 - 00002913 _____ C:\Users\robin\Downloads\LMBetuchtereHaendlerDV.7z
2013-09-01 01:10 - 2013-09-01 01:10 - 00041965 _____ C:\Users\robin\Downloads\Skyrim Universal 4GB Memory Patch-3211-1-0.rar
2013-09-01 00:58 - 2012-11-25 04:50 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-01 00:54 - 2013-09-01 00:54 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5 (1).zip
2013-09-01 00:45 - 2013-09-01 00:45 - 01725584 _____ C:\Users\robin\Downloads\Enhanced Night Skyrim v04 Color Galaxy-85-0-4.zip
2013-09-01 00:40 - 2013-09-01 00:40 - 00000604 _____ C:\Users\Public\Desktop\Steam.lnk
2013-09-01 00:40 - 2013-09-01 00:40 - 00000000 ____D C:\dumps
2013-09-01 00:38 - 2013-09-01 00:37 - 00000000 ____D C:\Users\robin\Desktop\Saves Skyrim
2013-09-01 00:36 - 2013-08-31 21:09 - 00000000 ____D C:\Users\robin\Desktop\X original skyrim dateien
2013-09-01 00:31 - 2013-09-01 00:31 - 00001501 _____ C:\Users\robin\Downloads\No NPC Greetings-746-1-1.7z
2013-09-01 00:06 - 2013-08-31 23:19 - 141941828 _____ C:\Users\robin\Downloads\TESVSUP9E.rar
2013-08-31 23:24 - 2009-07-14 19:58 - 00711222 _____ C:\Windows\system32\perfh007.dat
2013-08-31 23:24 - 2009-07-14 19:58 - 00152494 _____ C:\Windows\system32\perfc007.dat
2013-08-31 23:24 - 2009-07-14 07:13 - 01640784 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-31 21:10 - 2013-08-31 21:10 - 00000000 ____D C:\ProgramData\Steam
2013-08-31 21:00 - 2013-08-31 20:59 - 00000000 ____D C:\Users\robin\Desktop\skyrim update 13
2013-08-31 20:44 - 2013-08-31 19:48 - 170764161 _____ C:\Users\robin\Downloads\Th.Eld3r.Scr0lls.V.Skyr1m.Update.13.rar
2013-08-31 20:07 - 2013-08-31 20:06 - 28117938 _____ (Igor Pavlov) C:\Users\robin\Downloads\tor-browser-2.3.25-12_de.exe
2013-08-31 18:53 - 2013-08-31 18:53 - 00024837 _____ C:\Users\robin\Downloads\Addition.txt
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64.exe
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (1).exe
2013-08-31 18:50 - 2013-08-31 18:50 - 00000000 ____D C:\FRST
2013-08-30 19:11 - 2013-08-30 18:06 - 00000000 ____D C:\AdwCleaner
2013-08-30 09:52 - 2013-08-30 09:52 - 00586952 _____ C:\Users\robin\Downloads\AntiBundestrojaner_Globell_V_1_3_3.zip
2013-08-30 09:43 - 2013-08-30 09:42 - 00007662 _____ C:\Users\robin\AppData\Local\Resmon.ResmonCfg
2013-08-30 09:27 - 2013-08-30 09:27 - 00001113 ____H C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-30 09:27 - 2013-08-30 09:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-30 09:26 - 2013-08-30 09:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\robin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-30 09:26 - 2013-08-30 09:26 - 00994642 _____ C:\Users\robin\Downloads\adwcleaner.exe
2013-08-30 09:24 - 2013-08-30 09:24 - 01072975 _____ (Farbar) C:\Users\robin\Downloads\FRST.exe
2013-08-30 09:20 - 2013-08-30 09:20 - 00112154 _____ C:\Users\robin\Downloads\CtfmonRemoverDE-v2.3.zip
2013-08-30 09:20 - 2009-07-14 01:26 - 00024064 _____ (Gerhard Schlager) C:\Windows\SysWOW64\ctfmon.exe
2013-08-30 08:59 - 2013-08-01 06:58 - 00000000 ____D C:\Program Files (x86)\Driver Cleaner Pro
2013-08-29 21:09 - 2013-08-29 21:09 - 00630687 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (2).7z
2013-08-29 13:55 - 2013-08-29 13:53 - 41601136 _____ C:\Users\robin\Downloads\Enhanced Blood Textures 3_5b-60-3-5b.rar
2013-08-28 03:03 - 2013-08-28 02:14 - 708661259 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Towns-607.7z
2013-08-28 02:15 - 2013-08-28 02:13 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (2).7z
2013-08-28 02:13 - 2013-08-28 02:13 - 00001037 _____ C:\Users\robin\Downloads\WATER Falskaar V2-13268-1-75.7z
2013-08-27 23:28 - 2012-10-24 17:39 - 00000000 ____D C:\Users\robin\AppData\Local\ArmA 2 OA
2013-08-27 15:06 - 2013-08-27 15:05 - 00001335 _____ C:\DelFix.txt
2013-08-27 15:05 - 2013-08-19 22:08 - 00000000 ____D C:\Windows\ERUNT
2013-08-27 12:47 - 2013-08-27 12:45 - 53785544 _____ C:\Users\robin\Downloads\Enhanced Lights and FX-27043-0-3-2.7z
2013-08-27 12:41 - 2013-08-27 12:41 - 00125208 _____ C:\Users\robin\Downloads\WATER_1_6_Compatibility_Patch-30936-1-0.zip
2013-08-27 12:39 - 2013-08-27 12:39 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (1).7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630850 _____ C:\Users\robin\Downloads\Option A - Performance - V2_1e - CoT - RLO-30936-2-1e.7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630766 _____ C:\Users\robin\Downloads\Option B - FULL - V2_2i - CoT - ELFX-30936-2-2i.7z
2013-08-27 12:36 - 2013-08-27 12:36 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f.7z
2013-08-27 12:01 - 2013-08-27 12:00 - 15201702 _____ C:\Users\robin\Downloads\Realistic Nude Female-7841.zip
2013-08-27 11:58 - 2013-08-27 11:58 - 01345792 _____ C:\Users\robin\Downloads\Mods-fr-Skyrim--Top-10-Downloads-Setup.exe
2013-08-27 11:55 - 2013-08-27 11:52 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female (1).rar
2013-08-27 11:48 - 2013-08-27 11:48 - 00002330 _____ C:\Users\robin\Desktop\Google Chrome.lnk
2013-08-27 11:48 - 2013-08-27 11:48 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-08-27 11:48 - 2012-10-24 02:51 - 00000000 ____D C:\Users\robin\AppData\Local\Google
2013-08-27 11:47 - 2013-08-27 11:46 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757(1).exe
2013-08-27 11:39 - 2013-08-27 11:34 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female.rar
2013-08-26 23:53 - 2013-08-26 12:00 - 00000000 ____D C:\Users\robin\Desktop\Neuer Ordner (2)
2013-08-26 23:52 - 2012-11-02 05:05 - 00000000 ____D C:\Users\robin\Documents\Camtasia Studio
2013-08-26 23:47 - 2013-08-26 23:46 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757.exe
2013-08-26 23:39 - 2013-08-21 07:41 - 00000000 ____D C:\Users\robin\Desktop\Originals
2013-08-26 23:26 - 2013-08-26 21:42 - 00000000 ____D C:\Users\robin\AppData\Local\Black_Tree_Gaming
2013-08-26 22:14 - 2013-08-26 22:09 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607.7z
2013-08-26 21:53 - 2013-08-26 21:51 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (1).7z
2013-08-26 21:51 - 2013-08-26 21:49 - 47688161 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75.7z
2013-08-26 21:44 - 2013-08-26 13:39 - 00000000 ____D C:\Users\robin\AppData\Local\Skyrim
2013-08-26 21:42 - 2013-08-26 21:42 - 00000000 ____D C:\Users\robin\Documents\Nexus Mod Manager
2013-08-26 21:42 - 2013-08-26 21:41 - 04123248 _____ (Black Tree Gaming ) C:\Users\robin\Downloads\Nexus Mod Manager-0.45.6.exe
2013-08-26 21:36 - 2013-08-26 21:31 - 126014880 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Landscape-607.7z
2013-08-26 20:36 - 2012-10-28 02:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-26 20:25 - 2013-08-26 20:24 - 05216840 _____ C:\Users\robin\Downloads\EDT 1-6-1598-1-6.7z
2013-08-26 19:31 - 2012-10-31 21:57 - 00000000 ____D C:\Users\robin\AppData\Roaming\Skype
2013-08-26 17:23 - 2012-10-25 20:25 - 00000000 ____D C:\Users\robin\AppData\Local\Microsoft Games
2013-08-26 13:41 - 2013-08-26 13:41 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5.zip
2013-08-26 13:39 - 2012-12-01 22:35 - 00000000 ____D C:\Users\robin\Documents\My Games
2013-08-26 13:38 - 2013-08-26 13:38 - 00090834 _____ C:\Users\robin\Desktop\Skyrim4GB_-_Binaries_and_Source_-_Update_5-1013-1-5[1].zip
2013-08-26 13:13 - 2013-02-08 17:38 - 00000000 ____D C:\Users\robin\Documents\Telltale Games
2013-08-26 12:17 - 2013-08-26 12:17 - 00090834 _____ C:\Users\robin\Desktop\Skyrim4GB_-_Binaries_and_Source_-_Update_5-1013-1-5.zip
2013-08-24 13:46 - 2013-08-14 15:36 - 00000000 ____D C:\Users\robin\AppData\Roaming\Media Player Classic
2013-08-24 11:35 - 2013-08-24 11:35 - 12569271 _____ C:\Users\robin\Downloads\Silua - By Metens.Sims3Pack
2013-08-24 11:35 - 2013-08-24 11:34 - 03409749 _____ C:\Users\robin\Downloads\The Granture.Sims3Pack
2013-08-24 11:30 - 2013-08-24 11:22 - 00000000 ____D C:\Users\robin\Desktop\Neuer Ordner
2013-08-23 22:38 - 2012-11-07 00:07 - 00006656 _____ C:\Users\robin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-23 16:37 - 2013-08-23 16:37 - 00083363 _____ C:\Users\robin\Downloads\remus.zip
2013-08-23 15:43 - 2013-08-23 15:43 - 00017674 _____ C:\Users\robin\AppData\Local\recently-used.xbel
2013-08-23 15:43 - 2013-07-20 02:26 - 00000000 ____D C:\Users\robin\AppData\Local\gtk-2.0
2013-08-23 15:43 - 2012-11-15 18:01 - 00000000 ____D C:\Users\robin\.gimp-2.8
2013-08-22 00:07 - 2012-11-15 21:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-22 00:07 - 2012-11-04 21:29 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-22 00:07 - 2012-11-04 21:29 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-22 00:07 - 2012-10-31 22:33 - 00000000 ____D C:\Users\robin\AppData\Local\Adobe
2013-08-22 00:05 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-21 21:05 - 2013-08-21 21:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-21 16:47 - 2013-08-21 16:47 - 00394347 _____ (Ray Siegl ) C:\Users\robin\Downloads\ram_clean_tool_setup.exe
2013-08-21 16:47 - 2013-07-20 13:59 - 00000000 ____D C:\Program Files (x86)\RAM Clean Tool
2013-08-21 04:32 - 2013-01-29 21:33 - 00000000 ____D C:\output
2013-08-21 04:23 - 2012-10-31 22:33 - 00000000 ____D C:\Users\robin\AppData\Roaming\Adobe
2013-08-19 09:31 - 2013-08-19 09:31 - 00377856 _____ C:\Users\robin\Downloads\gmer_2.1.19163.exe
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Program Files\Realtek
2013-08-19 06:52 - 2012-10-25 20:28 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-08-19 06:52 - 2012-10-25 20:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-18 07:14 - 2013-08-18 07:14 - 04251202 _____ C:\Users\robin\Downloads\Linna Modern.Sims3Pack
2013-08-17 23:45 - 2013-08-17 23:45 - 00538775 _____ C:\Users\robin\Downloads\Koposov_Set_No.8_Electronics_TV_1.sims3pack
2013-08-17 23:43 - 2013-08-17 23:43 - 00164221 _____ C:\Users\robin\Downloads\DT456 HD Television.sims3pack
2013-08-17 08:33 - 2013-08-17 07:57 - 215000000 _____ C:\Users\robin\Downloads\SiStObPrem_decrap.part1.rar
2013-08-17 08:11 - 2013-08-17 08:11 - 03279645 _____ C:\Users\robin\Downloads\Tattoos.rar
2013-08-17 04:12 - 2013-07-26 15:01 - 00000000 ____D C:\Users\robin\AppData\Local\Play withSIX
2013-08-17 04:12 - 2012-10-24 16:29 - 00000000 ____D C:\Users\robin\Documents\ArmA 2
2013-08-16 23:53 - 2013-08-16 23:53 - 06931546 _____ C:\Users\robin\Downloads\KT_StoreFix_Fixes.zip
2013-08-16 23:53 - 2013-08-16 23:53 - 00237452 _____ C:\Users\robin\Downloads\KT_StoreFix_DecrapFixes.zip
2013-08-16 04:10 - 2012-10-24 03:29 - 00000000 ____D C:\Windows\Panther
2013-08-15 19:45 - 2012-11-21 21:36 - 00000000 ____D C:\Program Files (x86)\SplitCam
2013-08-15 18:24 - 2013-08-01 11:53 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-08-15 18:24 - 2013-01-23 22:13 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-08-15 03:01 - 2013-07-12 11:54 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 03:00 - 2012-10-24 17:14 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 17:11 - 2013-08-14 17:10 - 32462994 _____ (Realtek Semiconductor Corp.) C:\Users\robin\Downloads\WDM_R271.exe
2013-08-14 16:13 - 2012-12-05 22:21 - 00000000 ____D C:\Users\robin\AppData\Roaming\SlimBrowser
2013-08-14 10:07 - 2012-12-07 01:36 - 00000000 ____D C:\Program Files (x86)\BlueStacks
2013-08-14 09:09 - 2013-08-14 09:09 - 17960298 _____ ( ) C:\Users\robin\Downloads\K-Lite_Codec_Pack_995_Full.exe
2013-08-14 09:09 - 2013-07-30 03:34 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack
2013-08-14 09:06 - 2013-08-14 09:03 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup (1).exe
2013-08-14 09:01 - 2012-12-07 01:33 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2013-08-14 08:53 - 2013-08-14 08:52 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup.exe
2013-08-14 08:53 - 2013-08-14 08:52 - 00000000 ____D C:\Users\robin\Documents\Freemake
2013-08-14 08:53 - 2013-08-14 08:52 - 00000000 ____D C:\ProgramData\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-08-14 08:36 - 2013-08-14 08:36 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\nodewave
2013-08-14 08:36 - 2013-08-14 08:35 - 00000000 ____D C:\Users\robin\AppData\Local\Deployment
2013-08-14 08:35 - 2013-08-14 08:35 - 00000000 ____D C:\Users\robin\AppData\Local\Apps\2.0
2013-08-13 00:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-12 13:57 - 2013-08-31 20:11 - 00000000 ____D C:\Users\robin\Downloads\Tor Browser
2013-08-10 14:01 - 2013-08-10 14:01 - 00000282 _____ C:\Windows\Tasks\RDReminder.job
2013-08-04 23:06 - 2013-08-04 23:06 - 00000000 ____D C:\ProgramData\Caphyon
2013-08-04 23:02 - 2013-08-04 23:02 - 00000000 ____D C:\Users\robin\AppData\Roaming\TJMM Assemblys
2013-08-04 23:01 - 2013-08-04 23:01 - 00000000 ___HD C:\Users\Default\AppData\Roaming\Macromedia
2013-08-04 23:01 - 2013-08-04 23:01 - 00000000 ___HD C:\Users\Default User\AppData\Roaming\Macromedia
2013-08-04 23:01 - 2012-10-31 22:15 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-04 23:01 - 2012-10-31 22:14 - 00000000 ____D C:\ProgramData\Adobe
2013-08-04 20:48 - 2013-08-02 06:20 - 00000000 ____D C:\Windows\Super nude patch 3
2013-08-04 10:34 - 2012-10-24 15:40 - 00000000 ____D C:\Program Files (x86)\Bohemia Interactive
2013-08-03 13:57 - 2013-08-03 13:57 - 00000000 ____D C:\Program Files\CPUID
2013-08-03 13:53 - 2013-08-02 06:55 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-03 13:52 - 2013-08-03 13:52 - 00000000 ___SD C:\Users\robin\Documents\Passwords Database
2013-08-02 07:19 - 2013-08-02 07:19 - 00000000 ____D C:\ProgramData\F-Secure
2013-08-02 07:15 - 2013-08-02 07:15 - 00000000 ____D C:\Users\robin\AppData\Roaming\QuickScan
2013-08-02 06:20 - 2013-08-01 00:51 - 00000000 ____D C:\Users\robin\Documents\Electronic Arts
2013-08-02 02:29 - 2013-08-02 02:29 - 00000240 _____ C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job
2013-08-02 00:22 - 2013-07-30 03:33 - 01617742 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
Files to move or delete:
====================
C:\Users\robin\AppData\Local\Temp\Uninstall.exe
C:\Users\robin\AppData\Local\Temp\Rar$EXa0.720\Skyrim_Memory_4gb_Patch\Skyrim.Memory.(4gb).Patch.exe
C:\Users\robin\AppData\Local\Temp\Rar$EXa0.122\Skyrim_Memory_4gb_Patch\Skyrim.Memory.(4gb).Patch.exe
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.836\skyrim4gb.exe
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.836\skyrim4gb_helper.dll
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.823\skyrim4gb.exe
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.823\skyrim4gb_helper.dll
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.611\skyrim4gb.exe
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.611\skyrim4gb_helper.dll
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.295\skyrim4gb.exe
C:\Users\robin\AppData\Local\Temp\Rar$DRa0.295\skyrim4gb_helper.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 00:38
==================== End Of Log ============================
dann noch der scan von malewarebytes sofort nach der infizierung vom Bundestrojaner: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.30.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 robin :: ROBIN-PC [Administrator] 30.08.2013 09:28:12 mbam-log-2013-08-30 (09-28-12).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 239821 Laufzeit: 2 Minute(n), 55 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 3 HKCR\AppID\{A2773ED4-83BD-488A-A186-73590706C916} (PUP.Optional.MixiDJToolbar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{514B7CC5-C131-4ACA-A821-89138AA85E33} (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{633048A1-4CE3-BFC8-CF22-841A0FAEFF1A} (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Users\robin\AppData\Roaming\Dir (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 8. C:\ProgramData\InstallMate\{514B7CC5-C131-4ACA-A821-89138AA85E33}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\InstallMate\{514B7CC5-C131-4ACA-A821-89138AA85E33}\TsuDll.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\InstallMate\{5FADE99C-A163-4CA1-AE4A-E941844ECB6A}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\InstallMate\{5FADE99C-A163-4CA1-AE4A-E941844ECB6A}\TsuDll.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\robin\Downloads\FreemakeVideoConverter_4.0.3.1.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\robin\Downloads\SoftonicDownloader_fuer_4gb-skyrim-mod.exe (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\robin\AppData\Roaming\Dir\Dated.dat (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\robin\AppData\Roaming\Dir\0c3f.jpg (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) GMER: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-01 21:33:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T1L0-b ST3360320AS rev.3.AAM 335,35GB
Running: gmer_2.1.19163 (1).exe; Driver: C:\Users\robin\AppData\Local\Temp\aglorpod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800033ed000 8 bytes [00, 00, 1A, 02, 46, 46, 78, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff800033ed010 47 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Users\robin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe[2112] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077041465 2 bytes [04, 77]
.text C:\Users\robin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe[2112] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770414bb 2 bytes [04, 77]
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077041465 2 bytes [04, 77]
.text C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000770414bb 2 bytes [04, 77]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [300:3328] 000007fef1fc20c0
Thread C:\Windows\System32\svchost.exe [300:3348] 000007fef1fc26a8
Thread C:\Windows\System32\svchost.exe [300:3644] 000007fef55f44e0
Thread C:\Windows\System32\svchost.exe [300:3956] 000007fef58888f8
Thread C:\Windows\System32\svchost.exe [300:4648] 000007fef88c14a0
Thread C:\Windows\System32\svchost.exe [300:1448] 000007fef88aa2b0
Thread C:\Windows\System32\svchost.exe [300:5472] 000007fef1fc29dc
Thread C:\Windows\system32\svchost.exe [580:1320] 000007fefcd81a70
Thread C:\Windows\system32\svchost.exe [580:2676] 000007fefcd81a70
Thread C:\Windows\system32\svchost.exe [580:2952] 000007fef317506c
Thread C:\Windows\system32\svchost.exe [580:2948] 000007fef4301c20
Thread C:\Windows\system32\svchost.exe [580:2932] 000007fef4301c20
Thread C:\Windows\system32\svchost.exe [580:3244] 000007fef06a84d8
Thread C:\Windows\system32\svchost.exe [580:3412] 000007fef06623a8
Thread C:\Windows\system32\svchost.exe [580:2008] 000007fef06e0d00
Thread C:\Windows\system32\svchost.exe [580:1484] 000007fef02a9498
Thread C:\Windows\system32\svchost.exe [580:6000] 000007fefbec4164
Thread C:\Windows\system32\svchost.exe [580:6048] 000007fefae21ab0
Thread C:\Windows\system32\svchost.exe [580:5928] 000007fef4c817f8
Thread C:\Windows\system32\svchost.exe [580:2772] 000007fef4c817f8
Thread C:\Windows\system32\svchost.exe [1084:1348] 000007fefb408274
Thread C:\Windows\system32\svchost.exe [1084:2020] 000007fefb408274
Thread C:\Windows\System32\spoolsv.exe [1432:1372] 000007fef7d410c8
Thread C:\Windows\System32\spoolsv.exe [1432:1476] 000007fef7d06144
Thread C:\Windows\System32\spoolsv.exe [1432:1600] 000007fef7af5fd0
Thread C:\Windows\System32\spoolsv.exe [1432:1612] 000007fef7ae3438
Thread C:\Windows\System32\spoolsv.exe [1432:1616] 000007fef7af63ec
Thread C:\Windows\System32\spoolsv.exe [1432:640] 000007fef9405e5c
Thread C:\Windows\System32\WUDFHost.exe [856:3632] 000007fef30324a0
Thread C:\Windows\system32\svchost.exe [3692:5704] 000007fefdc4a808
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{3370D2FF-659A-45EB-8C95-E2B539C422F5}\Connection@Name 6TO4 Adapter
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{FD70ACD3-C101-431C-9948-5CE68B1C4E81}?\Device\{3370D2FF-659A-45EB-8C95-E2B539C422F5}?\Device\{EF11F35E-A0C6-4A3B-B2FB-80D7D5570FD8}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{FD70ACD3-C101-431C-9948-5CE68B1C4E81}"?"{3370D2FF-659A-45EB-8C95-E2B539C422F5}"?"{EF11F35E-A0C6-4A3B-B2FB-80D7D5570FD8}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{FD70ACD3-C101-431C-9948-5CE68B1C4E81}?\Device\TCPIP6TUNNEL_{3370D2FF-659A-45EB-8C95-E2B539C422F5}?\Device\TCPIP6TUNNEL_{EF11F35E-A0C6-4A3B-B2FB-80D7D5570FD8}?
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\6To4\{3370D2FF-659A-45EB-8C95-E2B539C422F5}@InterfaceName Reusable Microsoft 6To4 Adapter
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\6To4\{3370D2FF-659A-45EB-8C95-E2B539C422F5}@ReusableType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{6D3A519C-6293-43E9-A2A0-16249A28E6EB}@InterfaceName Reusable ISATAP Interface {6D3A519C-6293-43E9-A2A0-16249A28E6EB}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{6D3A519C-6293-43E9-A2A0-16249A28E6EB}@ReusableType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 3352
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 2444
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{B31DEBB0-610E-458B-A1F8-89B230C701C6}@DhcpIPAddress 79.223.39.54
---- EOF - GMER 2.1 ----
Grüße |
|
02.09.2013, 05:16
| #2 | |
| /// the machine /// TB-Ausbilder    | Der Bundestrojaner hat mich erwischt was soll ich tun? hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
02.09.2013, 23:20
| #3 |
| | Der Bundestrojaner hat mich erwischt was soll ich tun? Hallo
__________________ich kann mein Antivir programm nicht deaktivieren, da kommt immer die Fehlermeldung: ''Auf das angegebene Gerät, bzw. den Pfad oder die Datei kann nicht zugegriffen werden. Sie verfügen eventuell nicht über ausrechende Berechtigungen, um auf das Element zugreifen zu können.'' Combofix hat dann eine Meldung gebracht das mein Pc geschädigt wird wenn der Scanner nicht deaktiviert ist, wie bekomme ich den scanner deaktiviert? soll ich anti vir deinstallieren kurze zeit? |
|
03.09.2013, 08:13
| #4 |
| /// the machine /// TB-Ausbilder | Der Bundestrojaner hat mich erwischt was soll ich tun? Deinstallier es 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2013, 15:31
| #5 |
| | Der Bundestrojaner hat mich erwischt was soll ich tun? hi der scan hat geklappt: Code:
ATTFilter ComboFix 13-09-02.02 - robin 03.09.2013 16:15:24.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8191.6692 [GMT 2:00]
ausgeführt von:: c:\users\robin\Downloads\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
c:\users\robin\AppData\Roaming\Microsoft\Windows\Recent\Point2Click.url
c:\windows\Dir
c:\windows\Dir\Dated.dat
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-03 bis 2013-09-03 ))))))))))))))))))))))))))))))
.
.
2013-09-03 14:10 . 2013-09-03 14:10 9310 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2013-08-31 22:40 . 2013-08-31 22:40 -------- d-----w- C:\dumps
2013-08-31 22:40 . 2013-09-03 14:10 -------- d-----w- C:\desktop
2013-08-31 19:10 . 2013-08-31 19:10 -------- d-----w- c:\programdata\Steam
2013-08-31 16:50 . 2013-08-31 16:50 -------- d-----w- C:\FRST
2013-08-30 16:06 . 2013-08-30 17:11 -------- d-----w- C:\AdwCleaner
2013-08-30 07:27 . 2013-08-30 07:27 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-08-30 07:27 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-30 07:20 . 2009-07-14 01:14 8704 ----a-w- c:\windows\SysWow64\ctfmon.exe.backup
2013-08-26 19:42 . 2013-08-26 21:26 -------- d-----w- c:\users\robin\AppData\Local\Black_Tree_Gaming
2013-08-26 11:39 . 2013-08-26 19:44 -------- d-----w- c:\users\robin\AppData\Local\Skyrim
2013-08-19 20:59 . 2013-08-19 20:59 -------- d-----w- c:\program files (x86)\Common Files\BattlEye
2013-08-19 20:08 . 2013-08-27 13:05 -------- d-----w- c:\windows\ERUNT
2013-08-19 04:53 . 2013-08-19 04:53 -------- d-----w- c:\windows\SysWow64\RTCOM
2013-08-19 04:53 . 2013-08-19 04:53 -------- d-----w- c:\program files\Realtek
2013-08-15 01:04 . 2013-07-26 05:12 526336 ----a-w- c:\windows\system32\ieui.dll
2013-08-14 15:11 . 2013-08-19 04:53 -------- d--h--w- c:\program files (x86)\Temp
2013-08-14 13:36 . 2013-08-24 11:46 -------- d-----w- c:\users\robin\AppData\Roaming\Media Player Classic
2013-08-14 08:03 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-14 08:03 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-14 08:03 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-08-14 08:03 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-14 08:03 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-08-14 08:03 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-08-14 08:03 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-08-14 08:03 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-08-14 07:09 . 2012-06-09 17:21 178688 ----a-w- c:\windows\SysWow64\unrar.dll
2013-08-14 06:52 . 2013-08-14 06:53 -------- d-----w- c:\programdata\Freemake
2013-08-14 06:52 . 2013-08-14 06:52 -------- d-----w- c:\program files (x86)\Freemake
2013-08-14 06:35 . 2013-08-14 06:35 -------- d-----w- c:\users\robin\AppData\Local\Apps
2013-08-14 06:35 . 2013-08-14 06:36 -------- d-----w- c:\users\robin\AppData\Local\Deployment
2013-08-10 12:01 . 2013-08-10 12:01 -------- d-----w- c:\programdata\Logs
2013-08-04 21:06 . 2013-08-04 21:06 -------- d-----w- c:\programdata\Caphyon
2013-08-04 21:02 . 2013-08-04 21:02 -------- d-----w- c:\users\robin\AppData\Roaming\TJMM Assemblys
2013-08-04 21:01 . 2013-08-04 21:01 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-30 07:20 . 2009-07-13 23:26 24064 ----a-w- c:\windows\SysWow64\ctfmon.exe
2013-08-21 22:07 . 2012-11-04 19:29 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-21 22:07 . 2012-11-04 19:29 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-15 01:00 . 2012-10-24 15:14 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-07-17 00:17 . 2013-07-17 00:17 53248 ----a-w- c:\users\robin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-07-13 19:22 . 2013-07-13 19:22 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-13 19:22 . 2012-10-24 20:55 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-07-13 19:22 . 2012-10-24 20:55 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-07-09 04:45 . 2013-08-14 08:02 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-02 08:34 . 2013-07-16 06:45 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3307429B-2BA5-42DD-B683-50329045FF9F}\mpengine.dll
2013-06-21 12:06 . 2013-08-01 05:11 925648 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2013-06-21 12:06 . 2013-08-01 05:11 9239344 ----a-w- c:\windows\system32\nvcuda.dll
2013-06-21 12:06 . 2013-08-01 05:11 7687592 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-06-21 12:06 . 2013-08-01 05:11 7641832 ----a-w- c:\windows\system32\nvopencl.dll
2013-06-21 12:06 . 2013-08-01 05:11 6324360 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-06-21 12:06 . 2013-08-01 05:11 572704 ----a-w- c:\windows\system32\NvFBC64.dll
2013-06-21 12:06 . 2013-08-01 05:11 570656 ----a-w- c:\windows\system32\NvIFR64.dll
2013-06-21 12:06 . 2013-08-01 05:11 467232 ----a-w- c:\windows\SysWow64\NvIFR.dll
2013-06-21 12:06 . 2013-08-01 05:11 465184 ----a-w- c:\windows\SysWow64\NvFBC.dll
2013-06-21 12:06 . 2013-08-01 05:11 2953504 ----a-w- c:\windows\system32\nvcuvid.dll
2013-06-21 12:06 . 2013-08-01 05:11 27781920 ----a-w- c:\windows\system32\nvoglv64.dll
2013-06-21 12:06 . 2013-08-01 05:11 2777888 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-06-21 12:06 . 2013-08-01 05:11 266448 ----a-w- c:\windows\system32\nvinitx.dll
2013-06-21 12:06 . 2013-08-01 05:11 2363680 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-06-21 12:06 . 2013-08-01 05:11 218592 ----a-w- c:\windows\system32\nvoglshim64.dll
2013-06-21 12:06 . 2013-08-01 05:11 214448 ----a-w- c:\windows\SysWow64\nvinit.dll
2013-06-21 12:06 . 2013-08-01 05:11 21102368 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-06-21 12:06 . 2013-08-01 05:11 2002720 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-06-21 12:06 . 2013-08-01 05:11 1832224 ----a-w- c:\windows\system32\nvdispco6432049.dll
2013-06-21 12:06 . 2013-08-01 05:11 181488 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2013-06-21 12:06 . 2013-08-01 05:11 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-06-21 12:06 . 2013-08-01 05:11 15920536 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-06-21 12:06 . 2013-08-01 05:11 15144928 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-06-21 12:06 . 2013-08-01 05:11 1511712 ----a-w- c:\windows\system32\nvdispgenco6432049.dll
2013-06-21 12:06 . 2013-08-01 05:11 13411896 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-06-21 12:06 . 2013-08-01 05:11 12427240 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-06-21 12:06 . 2013-08-01 05:11 11235104 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-06-21 12:06 . 2013-08-01 05:11 1059560 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-06-21 12:06 . 2013-08-01 05:11 2936208 ----a-w- c:\windows\system32\nvapi64.dll
2013-06-21 12:06 . 2013-08-01 05:11 2597856 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-06-21 12:06 . 2013-08-01 05:11 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-06-21 12:06 . 2012-10-24 00:46 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-21 12:06 . 2012-10-24 00:46 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-06-21 10:23 . 2013-08-01 05:13 6496544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 10:23 . 2013-08-01 05:13 3514656 ----a-w- c:\windows\system32\nvsvc64.dll
2013-06-21 10:23 . 2013-08-01 05:13 884512 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 10:23 . 2013-08-01 05:13 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 10:23 . 2013-08-01 05:13 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 10:23 . 2013-08-01 05:13 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 03:16 . 2013-06-21 03:16 566048 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-06-20 04:17 . 2013-08-01 05:13 3253909 ----a-w- c:\windows\system32\nvcoproc.bin
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2013-08-30 07:20 . C3A2915C71AE6F225EB906C25CCD29B5 . 24064 . . [1.0.0.5] .. c:\windows\SysWOW64\ctfmon.exe
[7] 2009-07-14 . 4A3CDCEF8ED41B221F3DBEF5792FB52D . 8704 . . [6.1.7600.16385] .. c:\windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\desktop\Steam.exe" [2013-08-28 1811880]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
.
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ALSysIO;ALSysIO;c:\users\robin\AppData\Local\Temp\ALSysIO64.sys;c:\users\robin\AppData\Local\Temp\ALSysIO64.sys [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 CompFilter64;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbflt64.sys;c:\windows\SYSNATIVE\DRIVERS\lvbflt64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech HD Webcam C510(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTLE8023x64;Realtek 10/100/1000 PCI-E NIC Family NDIS XP(x64) Driver;c:\windows\system32\DRIVERS\Rtenic64.sys;c:\windows\SYSNATIVE\DRIVERS\Rtenic64.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys;c:\windows\SYSNATIVE\Drivers\FSPFltd.sys [x]
S1 asdrm;asdrm;c:\windows\system32\DRIVERS\asdrm.sys;c:\windows\SYSNATIVE\DRIVERS\asdrm.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AdblockerSrv;Adblocker Monitor Service;c:\program files (x86)\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe;c:\program files (x86)\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe [x]
S2 asdnet;Adblocker Monitor Driver;c:\windows\system32\DRIVERS\asdnet.sys;c:\windows\SYSNATIVE\DRIVERS\asdnet.sys [x]
S2 asdrs;AntiMalware Host-based Intrusion Prevention System;c:\windows\system32\DRIVERS\asdrs.sys;c:\windows\SYSNATIVE\DRIVERS\asdrs.sys [x]
S2 asdsrv;Anvi Smart Defender Realtime Guard Service;c:\program files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe;c:\program files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe [x]
S2 asdws;AnviSmartDefender Web Guard;c:\windows\system32\DRIVERS\asdws.sys;c:\windows\SYSNATIVE\DRIVERS\asdws.sys [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-04 22:07]
.
2013-07-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3443449256-1721398043-4219927925-1000Core.job
- c:\users\robin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-29 16:34]
.
2013-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3443449256-1721398043-4219927925-1000UA.job
- c:\users\robin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-29 16:34]
.
.
--------- X64 Entries -----------
.
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
FF - ProfilePath - c:\users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\
FF - prefs.js: network.proxy.gopher -
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-08-14 08:52; fmconverter@gmail.com; c:\program files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox
FF - ExtSQL: 2013-08-14 10:41; {51d8c82e-1773-4c4b-b23e-f5723ca44642}; c:\users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\extensions\{51d8c82e-1773-4c4b-b23e-f5723ca44642}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (S-1-5-21-3443449256-1721398043-4219927925-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.OJ3PF7ML22R2UBNT2XOWIE4CIU"
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (S-1-5-21-3443449256-1721398043-4219927925-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.OJ3PF7ML22R2UBNT2XOWIE4CIU"
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (S-1-5-21-3443449256-1721398043-4219927925-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.OJ3PF7ML22R2UBNT2XOWIE4CIU"
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (S-1-5-21-3443449256-1721398043-4219927925-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.OJ3PF7ML22R2UBNT2XOWIE4CIU"
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (S-1-5-21-3443449256-1721398043-4219927925-1000)
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML.OJ3PF7ML22R2UBNT2XOWIE4CIU"
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-3443449256-1721398043-4219927925-1000\Software\SecuROM\License information*]
"datasecu"=hex:31,9c,6e,44,a9,4d,e5,29,73,f2,1e,0b,76,22,ee,1d,83,23,d1,be,26,
c0,13,d1,89,e3,83,04,81,08,6d,bf,7e,e6,8d,28,f3,e1,58,57,67,7c,a7,f1,32,df,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-03 16:26:06
ComboFix-quarantined-files.txt 2013-09-03 14:26
.
Vor Suchlauf: 11 Verzeichnis(se), 33.350.590.464 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 33.107.816.448 Bytes frei
.
- - End Of File - - EC0310B7045D8DA84D7072AA7E3A65EB
A36C5E4F47E84449FF07ED3517B43A31
|
|
03.09.2013, 20:28
| #6 |
| /// the machine /// TB-Ausbilder | Der Bundestrojaner hat mich erwischt was soll ich tun? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Der Bundestrojaner hat mich erwischt was soll ich tun? |
|
04.09.2013, 06:54
| #7 |
| | Der Bundestrojaner hat mich erwischt was soll ich tun? Ich habe mein Pc neugestartet nach dem Adwcleaner scan und dann aufeinmal bekam ich kein Bild mehr rein, habe dann alles mögliche probiert. Meine Grafikkarte rausgebaut und mein monitor Kabel direkt ans mainboard geschlossen und dann ging es mit der Onboard grafik wieder. Ich denke nun das mein Stecker von der Grafikkarte hinüber ist, kann man sowas austauschen, oder ist meine grafikkarte hinüber? das komische war das der Pc ganz normal gestartet ist, nur das ich kein Bild hatte. Wie kriege ich raus das meine Grafikkarte komplett kaputt ist? die ist noch recht neu kann es mir nicht vorstellen das sie einfach nach einem Neustart hinüber geht. hoffe auf eine lösung ich probiere gleich nochmal aus ob es wieder geht, ich melde mich dann nochmal. So habe die Grafikkarte wieder zum laufen gebracht, musste alles auseinander nehmen und habe das monitor Kabel an den mainboard anschluss angeschlossen, so konnte ich prüfen das der monitor noch funktioniert. Dann hab ich, die grafikkarte ausgebaut und sie auf meinem 2 . PCI Express Steckplatz gesteckt, und nun geht es wieder. Ich denke der PCI Express steckplatz is durchgebrannt weiß aber auch nicht wie das gehen soll, ich habe das mainboard - M4A785TD-V EVO. Jedenfalls ist mein Pc danach oft eingefroren, und richtig langsam vllt sind noch viren drauf ich weiss es nicht. Hier mal die nächsten Logs ( versuche es schon zum 4. mal da es immer eingefroren ist ) lol malewarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.03.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 robin :: ROBIN-PC [Administrator] 03.09.2013 22:26:25 mbam-log-2013-09-03 (22-26-25).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 430563 Laufzeit: 54 Minute(n), 49 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\robin\Downloads\Skyrim Universal 4GB Memory Patch-3211-1-0.rar (PUP.Hacktool.Patcher) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) dann adwcleaner Code:
ATTFilter # AdwCleaner v3.002 - Bericht erstellt am 04/09/2013 um 04:43:49
# Updated 01/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : robin - ROBIN-PC
# Gestartet von : C:\Users\robin\Downloads\adwcleaner (1).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16660
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [1670 octets] - [30/08/2013 18:06:16]
AdwCleaner[R1].txt - [1129 octets] - [04/09/2013 04:41:53]
AdwCleaner[S0].txt - [1671 octets] - [30/08/2013 19:10:56]
AdwCleaner[S1].txt - [1051 octets] - [04/09/2013 04:43:49]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1111 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.7 (09.01.2013:1)
OS: Windows 7 Home Premium x64
Ran by robin on 04.09.2013 at 7:34:10,83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
~~~ FireFox
Successfully deleted: [File] C:\Users\robin\AppData\Roaming\mozilla\firefox\profiles\z18ywpp4.default\extensions\toolbar_avira-v7@apn.ask.com.xpi
Emptied folder: C:\Users\robin\AppData\Roaming\mozilla\firefox\profiles\z18ywpp4.default\minidumps [1 files]
~~~ Chrome
Successfully deleted: [Folder] C:\Users\robin\appdata\local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.09.2013 at 7:42:06,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dann FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 03
Ran by robin (administrator) on ROBIN-PC on 04-09-2013 07:48:41
Running from C:\Users\robin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
() C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Anvisoft) C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\robin\AppData\Local\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\robin\Downloads\FRST64 (3).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-09-04] (Avira Operations GmbH & Co. KG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\..\Interfaces\{B31DEBB0-610E-458B-A1F8-89B230C701C6}: [NameServer]217.0.43.129 217.0.43.145
FireFox:
========
FF ProfilePath: C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default
FF NetworkProxy: "gopher", ""
FF NetworkProxy: "gopher_port", 0
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\robin\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\robin\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\searchplugins\icq.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\Extensions\{51d8c82e-1773-4c4b-b23e-f5723ca44642}
FF Extension: support - C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\Extensions\support@free-hideip.com.xpi
FF Extension: No Name - C:\Users\robin\AppData\Roaming\Mozilla\Firefox\Profiles\z18ywpp4.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\robin\AppData\Local\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\robin\AppData\Local\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\robin\AppData\Local\Google\Chrome\Application\29.0.1547.57\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll No File
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File
CHR Plugin: (Uplay PC) - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
CHR Plugin: (Google Update) - C:\Users\robin\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Google Talk Plugin) - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\robin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.6_0
CHR Extension: (Freemake Video Converter) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Late Night) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgbdhkpacgdhfabeceekiafonfkipohm\1.0_0
CHR Extension: (Gmail) - C:\Users\robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2012-07-11] (SUPERAntiSpyware.com)
R2 AdblockerSrv; C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\toolbox\adblocker\ADBlockerSrv.exe [315600 2013-06-07] ()
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 asdsrv; C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe [739400 2013-06-08] (Anvisoft)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-08-19] ()
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393080 2012-10-25] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384888 2012-10-25] (BlueStack Systems, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R2 asdnet; C:\Windows\system32\DRIVERS\asdnet.sys [19280 2012-09-07] ()
R2 asdnet; C:\Windows\system32\DRIVERS\asdnet.sys [19280 2012-09-07] ()
R1 asdrm; C:\Windows\System32\DRIVERS\asdrm.sys [18768 2012-11-07] (Anvisoft)
R2 asdrs; C:\Windows\system32\DRIVERS\asdrs.sys [23376 2012-11-07] (Anvisoft)
R2 asdrs; C:\Windows\system32\DRIVERS\asdrs.sys [23376 2012-11-07] (Anvisoft)
R2 asdws; C:\Windows\system32\DRIVERS\asdws.sys [17232 2012-11-07] ()
R2 asdws; C:\Windows\system32\DRIVERS\asdws.sys [17232 2012-11-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [71032 2012-10-25] (BlueStack Systems)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [71032 2012-10-25] (BlueStack Systems)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-11-25] (DT Soft Ltd)
R0 FSProFilter; C:\Windows\System32\Drivers\FSPFltd.sys [54848 2010-07-22] (FSPro Labs)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 RTLE8023x64; C:\Windows\System32\DRIVERS\Rtenic64.sys [280344 2010-07-06] (Realtek Semiconductor Corporation )
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 ALSysIO; \??\C:\Users\robin\AppData\Local\Temp\ALSysIO64.sys [x]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-04 07:42 - 2013-09-04 07:42 - 00001459 _____ C:\Users\robin\Desktop\JRT.txt
2013-09-04 07:33 - 2013-09-04 07:33 - 01028757 _____ (Thisisu) C:\Users\robin\Downloads\JRT.exe
2013-09-04 07:31 - 2013-09-04 07:31 - 00000000 ____D C:\Users\robin\AppData\Roaming\Avira
2013-09-04 07:15 - 2013-09-04 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-04 07:15 - 2013-09-04 07:15 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-04 07:14 - 2013-09-04 07:14 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-04 07:14 - 2013-09-04 07:14 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-04 07:14 - 2013-09-04 07:14 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-04 07:14 - 2013-09-04 07:14 - 00002070 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-04 07:14 - 2013-09-04 07:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-04 07:14 - 2013-09-04 07:14 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-04 07:06 - 2013-09-04 07:06 - 02092792 _____ C:\Users\robin\Downloads\avira_free_4052_antivirus.exe
2013-09-04 07:06 - 2013-09-04 07:06 - 00001106 _____ C:\Users\UpdatusUser\Desktop\EVEREST Home Edition.lnk
2013-09-04 07:06 - 2013-09-04 07:06 - 00001106 _____ C:\Users\robin\Desktop\EVEREST Home Edition.lnk
2013-09-04 07:06 - 2013-09-04 07:06 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-09-04 07:05 - 2013-09-04 07:05 - 04179293 _____ (Lavalys, Inc. ) C:\Users\robin\Downloads\everesthome220.exe
2013-09-04 04:40 - 2013-09-04 04:40 - 01037222 _____ C:\Users\robin\Downloads\adwcleaner (1).exe
2013-09-04 04:17 - 2013-09-04 04:17 - 00015775 _____ C:\Users\robin\AppData\Local\recently-used.xbel
2013-09-03 22:24 - 2013-09-03 23:12 - 149895249 _____ C:\Users\robin\Downloads\AIS.rar
2013-09-03 18:42 - 2013-06-22 23:43 - 00001733 _____ C:\Users\robin\Desktop\license.avastlic
2013-09-03 18:40 - 2013-09-03 18:40 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-09-03 18:40 - 2013-09-03 18:40 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-03 18:40 - 2013-09-03 18:40 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-03 18:37 - 2013-09-04 06:59 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-03 18:37 - 2013-09-04 06:33 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-09-03 18:37 - 2013-09-03 18:37 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-03 18:37 - 2013-05-09 10:58 - 00287840 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-09-03 16:35 - 2013-09-03 17:23 - 147537634 _____ C:\Users\robin\Downloads\AIS801489INCLKFL.rar
2013-09-03 16:26 - 2013-09-03 16:26 - 00023726 _____ C:\ComboFix.txt
2013-09-03 16:12 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-03 16:12 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-03 16:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-03 16:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-03 16:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-03 16:12 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-03 16:12 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-03 16:12 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-03 16:10 - 2013-09-04 07:24 - 00205864 _____ C:\Windows\PFRO.log
2013-09-03 03:28 - 2013-09-03 03:28 - 00064832 _____ C:\Users\robin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-03 00:16 - 2013-09-03 00:16 - 04479832 _____ (Microsoft Corporation) C:\Users\robin\Downloads\vcredist_x86.exe
2013-09-03 00:08 - 2013-09-03 16:26 - 00000000 ____D C:\Qoobox
2013-09-03 00:08 - 2013-09-03 16:22 - 00000000 ____D C:\Windows\erdnt
2013-09-03 00:07 - 2013-09-03 16:07 - 00000000 ____D C:\Users\robin\Desktop\Neuer Ordner (3)
2013-09-02 19:58 - 2013-09-02 19:59 - 05119472 ____R (Swearware) C:\Users\robin\Downloads\ComboFix.exe
2013-09-01 21:27 - 2013-09-01 21:27 - 00377856 _____ C:\Users\robin\Downloads\gmer_2.1.19163 (1).exe
2013-09-01 21:21 - 2013-09-01 21:21 - 01590206 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (2).exe
2013-09-01 21:21 - 2013-09-01 21:21 - 00000552 _____ C:\Users\robin\Downloads\defogger_disable.log
2013-09-01 21:21 - 2013-09-01 21:21 - 00000178 _____ C:\Users\robin\defogger_reenable
2013-09-01 21:20 - 2013-09-01 21:20 - 00050477 _____ C:\Users\robin\Downloads\Defogger.exe
2013-09-01 01:25 - 2013-09-01 01:30 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607 (1).7z
2013-09-01 01:17 - 2013-09-01 01:20 - 55441069 _____ C:\Users\robin\Downloads\WATER_1-75b-13268-1-75b.7z
2013-09-01 01:15 - 2013-09-01 01:15 - 00129168 _____ C:\Users\robin\Downloads\Horse_Whistle_DV.7z
2013-09-01 01:12 - 2013-09-01 01:12 - 00002913 _____ C:\Users\robin\Downloads\LMBetuchtereHaendlerDV.7z
2013-09-01 00:54 - 2013-09-01 00:54 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5 (1).zip
2013-09-01 00:45 - 2013-09-01 00:45 - 01725584 _____ C:\Users\robin\Downloads\Enhanced Night Skyrim v04 Color Galaxy-85-0-4.zip
2013-09-01 00:40 - 2013-09-01 01:27 - 00000000 ____D C:\Users\robin\Desktop\The Elder Scrolls V- Skyrim
2013-09-01 00:40 - 2013-09-01 00:40 - 00000000 ____D C:\dumps
2013-09-01 00:31 - 2013-09-01 00:31 - 00001501 _____ C:\Users\robin\Downloads\No NPC Greetings-746-1-1.7z
2013-08-31 23:19 - 2013-09-01 00:06 - 141941828 _____ C:\Users\robin\Downloads\TESVSUP9E.rar
2013-08-31 21:10 - 2013-08-31 21:10 - 00000000 ____D C:\ProgramData\Steam
2013-08-31 20:11 - 2013-08-12 13:57 - 00000000 ____D C:\Users\robin\Downloads\Tor Browser
2013-08-31 20:06 - 2013-08-31 20:07 - 28117938 _____ (Igor Pavlov) C:\Users\robin\Downloads\tor-browser-2.3.25-12_de.exe
2013-08-31 19:48 - 2013-08-31 20:44 - 170764161 _____ C:\Users\robin\Downloads\Th.Eld3r.Scr0lls.V.Skyr1m.Update.13.rar
2013-08-31 18:53 - 2013-08-31 18:53 - 00024837 _____ C:\Users\robin\Downloads\Addition.txt
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64.exe
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (1).exe
2013-08-31 18:50 - 2013-08-31 18:50 - 00000000 ____D C:\FRST
2013-08-30 18:06 - 2013-09-04 04:43 - 00000000 ____D C:\AdwCleaner
2013-08-30 09:52 - 2013-08-30 09:52 - 00586952 _____ C:\Users\robin\Downloads\AntiBundestrojaner_Globell_V_1_3_3.zip
2013-08-30 09:42 - 2013-08-30 09:43 - 00007662 _____ C:\Users\robin\AppData\Local\Resmon.ResmonCfg
2013-08-30 09:27 - 2013-08-30 09:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-30 09:27 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-30 09:26 - 2013-08-30 09:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\robin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-30 09:26 - 2013-08-30 09:26 - 00994642 _____ C:\Users\robin\Downloads\adwcleaner.exe
2013-08-30 09:24 - 2013-08-30 09:24 - 01072975 _____ (Farbar) C:\Users\robin\Downloads\FRST.exe
2013-08-30 09:20 - 2013-08-30 09:20 - 00112154 _____ C:\Users\robin\Downloads\CtfmonRemoverDE-v2.3.zip
2013-08-30 09:20 - 2009-07-14 03:14 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ctfmon.exe.backup
2013-08-29 21:09 - 2013-08-29 21:09 - 00630687 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (2).7z
2013-08-29 13:53 - 2013-08-29 13:55 - 41601136 _____ C:\Users\robin\Downloads\Enhanced Blood Textures 3_5b-60-3-5b.rar
2013-08-28 02:14 - 2013-08-28 03:03 - 708661259 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Towns-607.7z
2013-08-28 02:13 - 2013-08-28 02:15 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (2).7z
2013-08-28 02:13 - 2013-08-28 02:13 - 00001037 _____ C:\Users\robin\Downloads\WATER Falskaar V2-13268-1-75.7z
2013-08-27 15:05 - 2013-08-27 15:06 - 00001335 _____ C:\DelFix.txt
2013-08-27 12:45 - 2013-08-27 12:47 - 53785544 _____ C:\Users\robin\Downloads\Enhanced Lights and FX-27043-0-3-2.7z
2013-08-27 12:41 - 2013-08-27 12:41 - 00125208 _____ C:\Users\robin\Downloads\WATER_1_6_Compatibility_Patch-30936-1-0.zip
2013-08-27 12:39 - 2013-08-27 12:39 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (1).7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630850 _____ C:\Users\robin\Downloads\Option A - Performance - V2_1e - CoT - RLO-30936-2-1e.7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630766 _____ C:\Users\robin\Downloads\Option B - FULL - V2_2i - CoT - ELFX-30936-2-2i.7z
2013-08-27 12:36 - 2013-08-27 12:36 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f.7z
2013-08-27 12:00 - 2013-08-27 12:01 - 15201702 _____ C:\Users\robin\Downloads\Realistic Nude Female-7841.zip
2013-08-27 11:58 - 2013-08-27 11:58 - 01345792 _____ C:\Users\robin\Downloads\Mods-fr-Skyrim--Top-10-Downloads-Setup.exe
2013-08-27 11:52 - 2013-08-27 11:55 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female (1).rar
2013-08-27 11:48 - 2013-08-27 11:48 - 00002330 _____ C:\Users\robin\Desktop\Google Chrome.lnk
2013-08-27 11:48 - 2013-08-27 11:48 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-08-27 11:46 - 2013-08-27 11:47 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757(1).exe
2013-08-27 11:34 - 2013-08-27 11:39 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female.rar
2013-08-26 23:46 - 2013-08-26 23:47 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757.exe
2013-08-26 22:09 - 2013-08-26 22:14 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607.7z
2013-08-26 21:51 - 2013-08-26 21:53 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (1).7z
2013-08-26 21:49 - 2013-08-26 21:51 - 47688161 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75.7z
2013-08-26 21:42 - 2013-08-26 23:26 - 00000000 ____D C:\Users\robin\AppData\Local\Black_Tree_Gaming
2013-08-26 21:42 - 2013-08-26 21:42 - 00000000 ____D C:\Users\robin\Documents\Nexus Mod Manager
2013-08-26 21:41 - 2013-08-26 21:42 - 04123248 _____ (Black Tree Gaming ) C:\Users\robin\Downloads\Nexus Mod Manager-0.45.6.exe
2013-08-26 21:31 - 2013-08-26 21:36 - 126014880 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Landscape-607.7z
2013-08-26 20:24 - 2013-08-26 20:25 - 05216840 _____ C:\Users\robin\Downloads\EDT 1-6-1598-1-6.7z
2013-08-26 13:41 - 2013-08-26 13:41 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5.zip
2013-08-26 13:39 - 2013-08-26 21:44 - 00000000 ____D C:\Users\robin\AppData\Local\Skyrim
2013-08-24 11:35 - 2013-08-24 11:35 - 12569271 _____ C:\Users\robin\Downloads\Silua - By Metens.Sims3Pack
2013-08-24 11:34 - 2013-08-24 11:35 - 03409749 _____ C:\Users\robin\Downloads\The Granture.Sims3Pack
2013-08-23 16:37 - 2013-08-23 16:37 - 00083363 _____ C:\Users\robin\Downloads\remus.zip
2013-08-21 21:05 - 2013-08-21 21:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-21 16:47 - 2013-08-21 16:47 - 00394347 _____ (Ray Siegl ) C:\Users\robin\Downloads\ram_clean_tool_setup.exe
2013-08-19 22:08 - 2013-08-27 15:05 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 09:31 - 2013-08-19 09:31 - 00377856 _____ C:\Users\robin\Downloads\gmer_2.1.19163.exe
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Program Files\Realtek
2013-08-19 06:52 - 2013-03-29 21:42 - 03379272 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2013-08-19 06:52 - 2013-03-29 18:04 - 21170176 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2013-08-19 06:52 - 2013-03-29 17:52 - 00914992 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2013-08-19 06:52 - 2013-03-29 17:10 - 00449481 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2013-08-19 06:52 - 2013-03-27 16:57 - 00135240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2013-08-19 06:52 - 2013-03-26 17:06 - 02797128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2013-08-19 06:52 - 2013-03-26 17:04 - 02734624 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2013-08-19 06:52 - 2013-03-26 15:40 - 03693128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2013-08-19 06:52 - 2013-03-26 14:38 - 01659464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2013-08-19 06:52 - 2013-03-25 17:32 - 03180264 _____ C:\Windows\system32\Drivers\rtvienna.dat
2013-08-19 06:52 - 2013-03-23 03:43 - 00208072 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2013-08-19 06:52 - 2013-03-20 13:17 - 09123608 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioVnA64.dll
2013-08-19 06:52 - 2013-03-20 13:16 - 02102040 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll
2013-08-19 06:52 - 2013-03-20 13:16 - 01900312 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek264.dll
2013-08-19 06:52 - 2013-03-20 13:16 - 00910104 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2013-08-19 06:52 - 2013-03-15 19:34 - 04957976 _____ (A-volute) C:\Windows\system32\RTKSMlfx.dll
2013-08-19 06:52 - 2013-03-15 19:33 - 00887640 _____ (A-Volute) C:\Windows\system32\RTKSMSettingsIPC.dll
2013-08-19 06:52 - 2013-03-12 18:16 - 00613448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2013-08-19 06:52 - 2013-03-08 12:51 - 00904752 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll
2013-08-19 06:52 - 2013-02-28 13:10 - 14021912 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll
2013-08-19 06:52 - 2013-02-28 13:10 - 02032408 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00823072 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00633632 _____ (SRS Labs, Inc.) C:\Windows\system32\sltech64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00517408 _____ (SRS Labs, Inc.) C:\Windows\system32\sl3apo64.dll
2013-08-19 06:52 - 2013-02-27 05:37 - 00213792 _____ (TODO: <Company name>) C:\Windows\system32\slprp64.dll
2013-08-19 06:52 - 2013-02-21 17:26 - 00858032 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll
2013-08-19 06:52 - 2013-02-21 17:26 - 00148912 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll
2013-08-19 06:52 - 2013-02-21 17:25 - 00569256 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll
2013-08-19 06:52 - 2013-02-20 18:55 - 01284680 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2013-08-19 06:52 - 2013-02-19 18:52 - 00991816 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2013-08-19 06:52 - 2013-01-17 19:32 - 00719640 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2013-08-19 06:52 - 2013-01-16 16:02 - 02079816 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2013-08-19 06:52 - 2012-12-12 11:17 - 00395208 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2013-08-19 06:52 - 2012-10-02 14:41 - 00501192 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2013-08-19 06:52 - 2012-10-02 14:41 - 00487368 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2013-08-19 06:52 - 2012-10-02 14:41 - 00415688 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2013-08-19 06:52 - 2012-09-10 20:06 - 00612728 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll
2013-08-19 06:52 - 2012-08-31 19:18 - 07164176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00434960 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00141584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00124176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2013-08-19 06:52 - 2012-08-31 19:17 - 00075024 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2013-08-19 06:52 - 2012-07-15 21:13 - 00394616 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2013-08-19 06:52 - 2012-06-20 17:26 - 00110592 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2013-08-19 06:52 - 2012-03-08 11:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2013-08-19 06:52 - 2012-01-30 11:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2013-08-19 06:52 - 2012-01-10 10:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2013-08-19 06:52 - 2011-12-20 15:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2013-08-19 06:52 - 2011-11-22 16:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2013-08-19 06:52 - 2011-09-02 14:21 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2013-08-19 06:52 - 2011-09-02 14:21 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2013-08-19 06:52 - 2011-09-02 14:21 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2013-08-19 06:52 - 2011-08-23 17:00 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2013-08-19 06:52 - 2011-05-31 09:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2013-08-19 06:52 - 2011-03-17 12:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2013-08-19 06:52 - 2011-03-07 17:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2013-08-19 06:52 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2013-08-19 06:52 - 2010-11-03 18:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2013-08-19 06:52 - 2010-09-27 09:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2013-08-19 06:52 - 2010-07-22 16:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2013-08-19 06:52 - 2009-11-24 09:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2013-08-18 07:14 - 2013-08-18 07:14 - 04251202 _____ C:\Users\robin\Downloads\Linna Modern.Sims3Pack
2013-08-18 06:23 - 2013-08-18 06:24 - 25435192 _____ C:\Users\robin\Downloads\Дом на утёсе by Laura13.rar
2013-08-17 23:45 - 2013-08-17 23:45 - 00538775 _____ C:\Users\robin\Downloads\Koposov_Set_No.8_Electronics_TV_1.sims3pack
2013-08-17 23:43 - 2013-08-17 23:43 - 00164221 _____ C:\Users\robin\Downloads\DT456 HD Television.sims3pack
2013-08-17 08:11 - 2013-08-17 08:11 - 03279645 _____ C:\Users\robin\Downloads\Tattoos.rar
2013-08-17 07:57 - 2013-08-17 08:33 - 215000000 _____ C:\Users\robin\Downloads\SiStObPrem_decrap.part1.rar
2013-08-16 23:53 - 2013-08-16 23:53 - 06931546 _____ C:\Users\robin\Downloads\KT_StoreFix_Fixes.zip
2013-08-16 23:53 - 2013-08-16 23:53 - 00237452 _____ C:\Users\robin\Downloads\KT_StoreFix_DecrapFixes.zip
2013-08-15 03:04 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 03:04 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 03:04 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 03:04 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 03:04 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 03:04 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 03:04 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 03:04 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 03:04 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 03:04 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 03:04 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 03:04 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 03:04 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 03:04 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 17:10 - 2013-08-14 17:11 - 32462994 _____ (Realtek Semiconductor Corp.) C:\Users\robin\Downloads\WDM_R271.exe
2013-08-14 15:36 - 2013-08-24 13:46 - 00000000 ____D C:\Users\robin\AppData\Roaming\Media Player Classic
2013-08-14 10:03 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 10:03 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 10:03 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 10:03 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 10:03 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 10:03 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 10:03 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 10:03 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 10:02 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 10:02 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 10:02 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 10:02 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 10:02 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 10:02 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 10:02 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 10:02 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 10:02 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 10:02 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 10:02 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 10:02 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 10:02 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 10:02 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 10:02 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 10:02 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 10:02 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 10:02 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 10:02 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 09:09 - 2013-08-14 09:09 - 17960298 _____ ( ) C:\Users\robin\Downloads\K-Lite_Codec_Pack_995_Full.exe
2013-08-14 09:09 - 2012-06-09 19:21 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-08-14 09:03 - 2013-08-14 09:06 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup (1).exe
2013-08-14 08:52 - 2013-08-14 08:53 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup.exe
2013-08-14 08:52 - 2013-08-14 08:53 - 00000000 ____D C:\Users\robin\Documents\Freemake
2013-08-14 08:52 - 2013-08-14 08:53 - 00000000 ____D C:\ProgramData\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-08-14 08:36 - 2013-08-14 08:36 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\nodewave
2013-08-14 08:35 - 2013-09-04 07:27 - 00000000 ____D C:\Users\robin\AppData\Local\Apps\2.0
2013-08-14 08:35 - 2013-08-14 08:36 - 00000000 ____D C:\Users\robin\AppData\Local\Deployment
==================== One Month Modified Files and Folders =======
2013-09-04 07:48 - 2013-09-04 07:48 - 01950416 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (3).exe
2013-09-04 07:42 - 2013-09-04 07:42 - 00001459 _____ C:\Users\robin\Desktop\JRT.txt
2013-09-04 07:35 - 2009-07-14 06:45 - 00014928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-04 07:35 - 2009-07-14 06:45 - 00014928 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-04 07:33 - 2013-09-04 07:33 - 01028757 _____ (Thisisu) C:\Users\robin\Downloads\JRT.exe
2013-09-04 07:32 - 2009-07-14 19:58 - 00711222 _____ C:\Windows\system32\perfh007.dat
2013-09-04 07:32 - 2009-07-14 19:58 - 00152494 _____ C:\Windows\system32\perfc007.dat
2013-09-04 07:32 - 2009-07-14 07:13 - 01640784 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-04 07:31 - 2013-09-04 07:31 - 00000000 ____D C:\Users\robin\AppData\Roaming\Avira
2013-09-04 07:27 - 2013-08-14 08:35 - 00000000 ____D C:\Users\robin\AppData\Local\Apps\2.0
2013-09-04 07:27 - 2012-10-26 21:09 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-04 07:25 - 2002-01-01 00:02 - 00001467 _____ C:\Windows\setupact.log
2013-09-04 07:24 - 2013-09-03 16:10 - 00205864 _____ C:\Windows\PFRO.log
2013-09-04 07:15 - 2013-09-04 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-04 07:15 - 2013-09-04 07:15 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-04 07:14 - 2013-09-04 07:14 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-04 07:14 - 2013-09-04 07:14 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-04 07:14 - 2013-09-04 07:14 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-04 07:14 - 2013-09-04 07:14 - 00002070 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-04 07:14 - 2013-09-04 07:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-04 07:14 - 2013-09-04 07:14 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-04 07:06 - 2013-09-04 07:06 - 02092792 _____ C:\Users\robin\Downloads\avira_free_4052_antivirus.exe
2013-09-04 07:06 - 2013-09-04 07:06 - 00001106 _____ C:\Users\UpdatusUser\Desktop\EVEREST Home Edition.lnk
2013-09-04 07:06 - 2013-09-04 07:06 - 00001106 _____ C:\Users\robin\Desktop\EVEREST Home Edition.lnk
2013-09-04 07:06 - 2013-09-04 07:06 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-09-04 07:05 - 2013-09-04 07:05 - 04179293 _____ (Lavalys, Inc. ) C:\Users\robin\Downloads\everesthome220.exe
2013-09-04 07:04 - 2013-07-24 22:03 - 01303601 _____ C:\Windows\WindowsUpdate.log
2013-09-04 07:02 - 2012-11-02 19:45 - 00000000 ____D C:\Users\robin\AppData\Local\CrashDumps
2013-09-04 07:00 - 2013-08-01 07:14 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-04 06:59 - 2013-09-03 18:37 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-04 06:55 - 2012-10-24 02:46 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-09-04 06:33 - 2013-09-03 18:37 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-09-04 04:43 - 2013-08-30 18:06 - 00000000 ____D C:\AdwCleaner
2013-09-04 04:40 - 2013-09-04 04:40 - 01037222 _____ C:\Users\robin\Downloads\adwcleaner (1).exe
2013-09-04 04:33 - 2012-11-15 18:01 - 00000000 ____D C:\Users\robin\.gimp-2.8
2013-09-04 04:17 - 2013-09-04 04:17 - 00015775 _____ C:\Users\robin\AppData\Local\recently-used.xbel
2013-09-03 23:12 - 2013-09-03 22:24 - 149895249 _____ C:\Users\robin\Downloads\AIS.rar
2013-09-03 22:13 - 2012-11-02 05:05 - 00000000 ____D C:\Users\robin\Documents\Camtasia Studio
2013-09-03 21:26 - 2012-11-07 00:07 - 00007168 _____ C:\Users\robin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-03 18:40 - 2013-09-03 18:40 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-09-03 18:40 - 2013-09-03 18:40 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-03 18:40 - 2013-09-03 18:40 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-03 18:40 - 2012-10-31 21:57 - 00000000 ____D C:\Users\robin\AppData\Roaming\Skype
2013-09-03 18:37 - 2013-09-03 18:37 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-03 16:26 - 2013-09-03 16:26 - 00023726 _____ C:\ComboFix.txt
2013-09-03 16:26 - 2013-09-03 00:08 - 00000000 ____D C:\Qoobox
2013-09-03 16:26 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-03 16:22 - 2013-09-03 00:08 - 00000000 ____D C:\Windows\erdnt
2013-09-03 16:22 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-03 16:07 - 2013-09-03 00:07 - 00000000 ____D C:\Users\robin\Desktop\Neuer Ordner (3)
2013-09-03 08:37 - 2012-12-05 22:21 - 00000000 ____D C:\Users\robin\AppData\Roaming\SlimBrowser
2013-09-03 06:37 - 2013-07-20 02:26 - 00000000 ____D C:\Users\robin\AppData\Local\gtk-2.0
2013-09-03 03:28 - 2013-09-03 03:28 - 00064832 _____ C:\Users\robin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-03 00:16 - 2013-09-03 00:16 - 04479832 _____ (Microsoft Corporation) C:\Users\robin\Downloads\vcredist_x86.exe
2013-09-02 22:04 - 2013-05-24 21:21 - 00000000 ____D C:\Windows\Minidump
2013-09-02 19:59 - 2013-09-02 19:58 - 05119472 ____R (Swearware) C:\Users\robin\Downloads\ComboFix.exe
2013-09-01 21:27 - 2013-09-01 21:27 - 00377856 _____ C:\Users\robin\Downloads\gmer_2.1.19163 (1).exe
2013-09-01 21:21 - 2013-09-01 21:21 - 01590206 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (2).exe
2013-09-01 21:21 - 2013-09-01 21:21 - 00000552 _____ C:\Users\robin\Downloads\defogger_disable.log
2013-09-01 21:21 - 2013-09-01 21:21 - 00000178 _____ C:\Users\robin\defogger_reenable
2013-09-01 21:21 - 2012-10-24 02:38 - 00000000 ____D C:\Users\robin
2013-09-01 21:20 - 2013-09-01 21:20 - 00050477 _____ C:\Users\robin\Downloads\Defogger.exe
2013-09-01 21:15 - 2012-11-25 02:53 - 00000000 ____D C:\Users\robin\AppData\Roaming\DAEMON Tools Pro
2013-09-01 01:30 - 2013-09-01 01:25 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607 (1).7z
2013-09-01 01:27 - 2013-09-01 00:40 - 00000000 ____D C:\Users\robin\Desktop\The Elder Scrolls V- Skyrim
2013-09-01 01:20 - 2013-09-01 01:17 - 55441069 _____ C:\Users\robin\Downloads\WATER_1-75b-13268-1-75b.7z
2013-09-01 01:15 - 2013-09-01 01:15 - 00129168 _____ C:\Users\robin\Downloads\Horse_Whistle_DV.7z
2013-09-01 01:12 - 2013-09-01 01:12 - 00002913 _____ C:\Users\robin\Downloads\LMBetuchtereHaendlerDV.7z
2013-09-01 00:58 - 2012-11-25 04:50 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-01 00:54 - 2013-09-01 00:54 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5 (1).zip
2013-09-01 00:45 - 2013-09-01 00:45 - 01725584 _____ C:\Users\robin\Downloads\Enhanced Night Skyrim v04 Color Galaxy-85-0-4.zip
2013-09-01 00:40 - 2013-09-01 00:40 - 00000000 ____D C:\dumps
2013-09-01 00:31 - 2013-09-01 00:31 - 00001501 _____ C:\Users\robin\Downloads\No NPC Greetings-746-1-1.7z
2013-09-01 00:06 - 2013-08-31 23:19 - 141941828 _____ C:\Users\robin\Downloads\TESVSUP9E.rar
2013-08-31 21:10 - 2013-08-31 21:10 - 00000000 ____D C:\ProgramData\Steam
2013-08-31 20:44 - 2013-08-31 19:48 - 170764161 _____ C:\Users\robin\Downloads\Th.Eld3r.Scr0lls.V.Skyr1m.Update.13.rar
2013-08-31 20:07 - 2013-08-31 20:06 - 28117938 _____ (Igor Pavlov) C:\Users\robin\Downloads\tor-browser-2.3.25-12_de.exe
2013-08-31 18:53 - 2013-08-31 18:53 - 00024837 _____ C:\Users\robin\Downloads\Addition.txt
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64.exe
2013-08-31 18:50 - 2013-08-31 18:50 - 01589860 _____ (Farbar) C:\Users\robin\Downloads\FRST64 (1).exe
2013-08-31 18:50 - 2013-08-31 18:50 - 00000000 ____D C:\FRST
2013-08-30 09:52 - 2013-08-30 09:52 - 00586952 _____ C:\Users\robin\Downloads\AntiBundestrojaner_Globell_V_1_3_3.zip
2013-08-30 09:43 - 2013-08-30 09:42 - 00007662 _____ C:\Users\robin\AppData\Local\Resmon.ResmonCfg
2013-08-30 09:27 - 2013-08-30 09:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-30 09:26 - 2013-08-30 09:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\robin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-30 09:26 - 2013-08-30 09:26 - 00994642 _____ C:\Users\robin\Downloads\adwcleaner.exe
2013-08-30 09:24 - 2013-08-30 09:24 - 01072975 _____ (Farbar) C:\Users\robin\Downloads\FRST.exe
2013-08-30 09:20 - 2013-08-30 09:20 - 00112154 _____ C:\Users\robin\Downloads\CtfmonRemoverDE-v2.3.zip
2013-08-30 09:20 - 2009-07-14 01:26 - 00024064 _____ (Gerhard Schlager) C:\Windows\SysWOW64\ctfmon.exe
2013-08-30 08:59 - 2013-08-01 06:58 - 00000000 ____D C:\Program Files (x86)\Driver Cleaner Pro
2013-08-29 21:09 - 2013-08-29 21:09 - 00630687 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (2).7z
2013-08-29 13:55 - 2013-08-29 13:53 - 41601136 _____ C:\Users\robin\Downloads\Enhanced Blood Textures 3_5b-60-3-5b.rar
2013-08-28 03:03 - 2013-08-28 02:14 - 708661259 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Towns-607.7z
2013-08-28 02:15 - 2013-08-28 02:13 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (2).7z
2013-08-28 02:13 - 2013-08-28 02:13 - 00001037 _____ C:\Users\robin\Downloads\WATER Falskaar V2-13268-1-75.7z
2013-08-27 23:28 - 2012-10-24 17:39 - 00000000 ____D C:\Users\robin\AppData\Local\ArmA 2 OA
2013-08-27 15:06 - 2013-08-27 15:05 - 00001335 _____ C:\DelFix.txt
2013-08-27 15:05 - 2013-08-19 22:08 - 00000000 ____D C:\Windows\ERUNT
2013-08-27 12:47 - 2013-08-27 12:45 - 53785544 _____ C:\Users\robin\Downloads\Enhanced Lights and FX-27043-0-3-2.7z
2013-08-27 12:41 - 2013-08-27 12:41 - 00125208 _____ C:\Users\robin\Downloads\WATER_1_6_Compatibility_Patch-30936-1-0.zip
2013-08-27 12:39 - 2013-08-27 12:39 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f (1).7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630850 _____ C:\Users\robin\Downloads\Option A - Performance - V2_1e - CoT - RLO-30936-2-1e.7z
2013-08-27 12:37 - 2013-08-27 12:37 - 00630766 _____ C:\Users\robin\Downloads\Option B - FULL - V2_2i - CoT - ELFX-30936-2-2i.7z
2013-08-27 12:36 - 2013-08-27 12:36 - 00630754 _____ C:\Users\robin\Downloads\Option A - FULL - V2_0f - CoT - RLO-30936-2-0f.7z
2013-08-27 12:01 - 2013-08-27 12:00 - 15201702 _____ C:\Users\robin\Downloads\Realistic Nude Female-7841.zip
2013-08-27 11:58 - 2013-08-27 11:58 - 01345792 _____ C:\Users\robin\Downloads\Mods-fr-Skyrim--Top-10-Downloads-Setup.exe
2013-08-27 11:55 - 2013-08-27 11:52 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female (1).rar
2013-08-27 11:48 - 2013-08-27 11:48 - 00002330 _____ C:\Users\robin\Desktop\Google Chrome.lnk
2013-08-27 11:48 - 2013-08-27 11:48 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-08-27 11:48 - 2012-10-24 02:51 - 00000000 ____D C:\Users\robin\AppData\Local\Google
2013-08-27 11:47 - 2013-08-27 11:46 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757(1).exe
2013-08-27 11:39 - 2013-08-27 11:34 - 51016399 _____ C:\Users\robin\Downloads\Skyrim-Nudepatch-female.rar
2013-08-26 23:47 - 2013-08-26 23:46 - 35763832 _____ (Google Inc.) C:\Users\robin\Downloads\ChromeStandaloneSetup290154757.exe
2013-08-26 23:26 - 2013-08-26 21:42 - 00000000 ____D C:\Users\robin\AppData\Local\Black_Tree_Gaming
2013-08-26 22:14 - 2013-08-26 22:09 - 138734031 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Dungeons-607.7z
2013-08-26 21:53 - 2013-08-26 21:51 - 50343832 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75 (1).7z
2013-08-26 21:51 - 2013-08-26 21:49 - 47688161 _____ C:\Users\robin\Downloads\WATER v1_75-13268-1-75.7z
2013-08-26 21:44 - 2013-08-26 13:39 - 00000000 ____D C:\Users\robin\AppData\Local\Skyrim
2013-08-26 21:42 - 2013-08-26 21:42 - 00000000 ____D C:\Users\robin\Documents\Nexus Mod Manager
2013-08-26 21:42 - 2013-08-26 21:41 - 04123248 _____ (Black Tree Gaming ) C:\Users\robin\Downloads\Nexus Mod Manager-0.45.6.exe
2013-08-26 21:36 - 2013-08-26 21:31 - 126014880 _____ C:\Users\robin\Downloads\Skyrim HD v1_5 FULL - Landscape-607.7z
2013-08-26 20:36 - 2012-10-28 02:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-26 20:25 - 2013-08-26 20:24 - 05216840 _____ C:\Users\robin\Downloads\EDT 1-6-1598-1-6.7z
2013-08-26 17:23 - 2012-10-25 20:25 - 00000000 ____D C:\Users\robin\AppData\Local\Microsoft Games
2013-08-26 13:41 - 2013-08-26 13:41 - 00090834 _____ C:\Users\robin\Downloads\Skyrim4GB-v1.5.zip
2013-08-26 13:39 - 2012-12-01 22:35 - 00000000 ____D C:\Users\robin\Documents\My Games
2013-08-26 13:13 - 2013-02-08 17:38 - 00000000 ____D C:\Users\robin\Documents\Telltale Games
2013-08-24 13:46 - 2013-08-14 15:36 - 00000000 ____D C:\Users\robin\AppData\Roaming\Media Player Classic
2013-08-24 11:35 - 2013-08-24 11:35 - 12569271 _____ C:\Users\robin\Downloads\Silua - By Metens.Sims3Pack
2013-08-24 11:35 - 2013-08-24 11:34 - 03409749 _____ C:\Users\robin\Downloads\The Granture.Sims3Pack
2013-08-23 16:37 - 2013-08-23 16:37 - 00083363 _____ C:\Users\robin\Downloads\remus.zip
2013-08-22 00:07 - 2012-11-15 21:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-22 00:07 - 2012-11-04 21:29 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-22 00:07 - 2012-11-04 21:29 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-22 00:07 - 2012-10-31 22:33 - 00000000 ____D C:\Users\robin\AppData\Local\Adobe
2013-08-22 00:05 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-21 21:05 - 2013-08-21 21:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-21 16:47 - 2013-08-21 16:47 - 00394347 _____ (Ray Siegl ) C:\Users\robin\Downloads\ram_clean_tool_setup.exe
2013-08-21 16:47 - 2013-07-20 13:59 - 00000000 ____D C:\Program Files (x86)\RAM Clean Tool
2013-08-21 04:32 - 2013-01-29 21:33 - 00000000 ____D C:\output
2013-08-21 04:23 - 2012-10-31 22:33 - 00000000 ____D C:\Users\robin\AppData\Roaming\Adobe
2013-08-19 09:31 - 2013-08-19 09:31 - 00377856 _____ C:\Users\robin\Downloads\gmer_2.1.19163.exe
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-08-19 06:53 - 2013-08-19 06:53 - 00000000 ____D C:\Program Files\Realtek
2013-08-19 06:52 - 2012-10-25 20:28 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-08-19 06:52 - 2012-10-25 20:12 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-18 07:14 - 2013-08-18 07:14 - 04251202 _____ C:\Users\robin\Downloads\Linna Modern.Sims3Pack
2013-08-18 06:24 - 2013-08-18 06:23 - 25435192 _____ C:\Users\robin\Downloads\Дом на утёсе by Laura13.rar
2013-08-17 23:45 - 2013-08-17 23:45 - 00538775 _____ C:\Users\robin\Downloads\Koposov_Set_No.8_Electronics_TV_1.sims3pack
2013-08-17 23:43 - 2013-08-17 23:43 - 00164221 _____ C:\Users\robin\Downloads\DT456 HD Television.sims3pack
2013-08-17 08:33 - 2013-08-17 07:57 - 215000000 _____ C:\Users\robin\Downloads\SiStObPrem_decrap.part1.rar
2013-08-17 08:11 - 2013-08-17 08:11 - 03279645 _____ C:\Users\robin\Downloads\Tattoos.rar
2013-08-17 04:12 - 2013-07-26 15:01 - 00000000 ____D C:\Users\robin\AppData\Local\Play withSIX
2013-08-17 04:12 - 2012-10-24 16:29 - 00000000 ____D C:\Users\robin\Documents\ArmA 2
2013-08-16 23:53 - 2013-08-16 23:53 - 06931546 _____ C:\Users\robin\Downloads\KT_StoreFix_Fixes.zip
2013-08-16 23:53 - 2013-08-16 23:53 - 00237452 _____ C:\Users\robin\Downloads\KT_StoreFix_DecrapFixes.zip
2013-08-16 04:10 - 2012-10-24 03:29 - 00000000 ____D C:\Windows\Panther
2013-08-15 19:45 - 2012-11-21 21:36 - 00000000 ____D C:\Program Files (x86)\SplitCam
2013-08-15 18:24 - 2013-08-01 11:53 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2013
2013-08-15 18:24 - 2013-01-23 22:13 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-08-15 03:01 - 2013-07-12 11:54 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 03:00 - 2012-10-24 17:14 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 17:11 - 2013-08-14 17:10 - 32462994 _____ (Realtek Semiconductor Corp.) C:\Users\robin\Downloads\WDM_R271.exe
2013-08-14 10:07 - 2012-12-07 01:36 - 00000000 ____D C:\Program Files (x86)\BlueStacks
2013-08-14 09:09 - 2013-08-14 09:09 - 17960298 _____ ( ) C:\Users\robin\Downloads\K-Lite_Codec_Pack_995_Full.exe
2013-08-14 09:09 - 2013-07-30 03:34 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack
2013-08-14 09:06 - 2013-08-14 09:03 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup (1).exe
2013-08-14 09:01 - 2012-12-07 01:33 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2013-08-14 08:53 - 2013-08-14 08:52 - 51827296 _____ (SplitCam Co.) C:\Users\robin\Downloads\SplitCamSetup.exe
2013-08-14 08:53 - 2013-08-14 08:52 - 00000000 ____D C:\Users\robin\Documents\Freemake
2013-08-14 08:53 - 2013-08-14 08:52 - 00000000 ____D C:\ProgramData\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-08-14 08:52 - 2013-08-14 08:52 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-08-14 08:36 - 2013-08-14 08:36 - 00000000 ____D C:\Users\robin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\nodewave
2013-08-14 08:36 - 2013-08-14 08:35 - 00000000 ____D C:\Users\robin\AppData\Local\Deployment
2013-08-13 00:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-12 13:57 - 2013-08-31 20:11 - 00000000 ____D C:\Users\robin\Downloads\Tor Browser
2013-08-07 04:22 - 2012-10-24 03:13 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\Users\robin\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\robin\AppData\Local\Temp\Quarantine.exe
C:\Users\robin\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 00:38
==================== End Of Log ============================
--- --- --- grüße |
|
04.09.2013, 09:21
| #8 |
| /// the machine /// TB-Ausbilder | Der Bundestrojaner hat mich erwischt was soll ich tun?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Der Bundestrojaner hat mich erwischt was soll ich tun? |
| 4d36e972-e325-11ce-bfc1-08002be10318, backdoor.agent, black, bluestacks, desktop, farbar, farbar recovery scan tool, flash player, focus, google, iexplore.exe, installation, nexus, performance, plug-in, pup.hacktool.patcher, pup.optional.mixidjtoolbar.a, pup.optional.opencandy, pup.optional.softonic, pup.optional.tarma.a, realtek, safer networking, software, svchost.exe, tunnel |
Linear-Darstellung
