fbDownloader Search

Nightmare199 · 10.09.2013, 11:22

Code:

ATTFilter

SystemLook 30.07.11 by jpshortstuff
Log created at 12:21 on 10/09/2013 by Nightmare
Administrator - Elevation successful

========== filefind ==========

Searching for "*protector*"
No files found.

========== folderfind ==========

Searching for "*protector*"
No folders found.

========== reg ==========

[HKEY_CURRENT_USER\Software\Protector]
"IgnoreFirefox"="0"
"IgnoreChrome"="0"
"IgnoreIE"="0"
"InstallTimestamp"="1370805722"
"CheckCounter"="55"
"UserHomepage Firefox"="about:home"
"UserSearch Firefox"="www.google.com"
"UserHomepage Internet Explorer"="g.live.com"
"UserSearch Internet Explorer"="search.fbdownloader.com"

[HKEY_CURRENT_USER\Software\Protector\Revert]
"FirefoxPrefsFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\prefs.js"
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
"FirefoxChangedPrefs"="browser.startup.homepage,browser.search.selectedEngine,browser.search.defaultenginename,browser.search.defaulturl,keyword.URL,keyword.enabled,"
"FirefoxSearchDBFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\search.sqlite"
"ChromeWebDataFile"="C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Web Data"
"ChromeSearchID"="10"
"ChromePrefsFile"="C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Preferences"
"ChromeOldPrefs"=",
"homepage": "about:home",
"homepage_is_newtabpage": true,
"homepage": "http:\/\/search.fbdownloader.com\/?channel=sfde206",
"homepage_is_newtabpage": false,
"default_search_provider": {"search_url":"http:\/\/search.fbdownloader.com\/search.php?channel=sfde206&q={searchTerms}","encodings":"UTF-8","id":"10","keyword":"Search","suggest_url":null,"name":"Search","icon_url":"http:\/\/search.fbdownloader.com\/search.ico","enabled":true,"prepopulate_id":0,"instant_url":null},
"session": {"urls_to_restore_on_startup":["http:\/\/search.fbdownloader.com\/?channel=sfde206"],"restore_on_startup_migrated":true,"restore_on_startup":4},
"_null": null"
"IEDefaultScope"="{95B7759C-8C7F-4BF1-B163-73684A933233}"
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"


[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector]
"IgnoreFirefox"="0"
"IgnoreChrome"="0"
"IgnoreIE"="0"
"InstallTimestamp"="1370805722"
"CheckCounter"="55"
"UserHomepage Firefox"="about:home"
"UserSearch Firefox"="www.google.com"
"UserHomepage Internet Explorer"="g.live.com"
"UserSearch Internet Explorer"="search.fbdownloader.com"

[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"FirefoxPrefsFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\prefs.js"
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
"FirefoxChangedPrefs"="browser.startup.homepage,browser.search.selectedEngine,browser.search.defaultenginename,browser.search.defaulturl,keyword.URL,keyword.enabled,"
"FirefoxSearchDBFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\search.sqlite"
"ChromeWebDataFile"="C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Web Data"
"ChromeSearchID"="10"
"ChromePrefsFile"="C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Preferences"
"ChromeOldPrefs"=",
"homepage": "about:home",
"homepage_is_newtabpage": true,
"homepage": "http:\/\/search.fbdownloader.com\/?channel=sfde206",
"homepage_is_newtabpage": false,
"default_search_provider": {"search_url":"http:\/\/search.fbdownloader.com\/search.php?channel=sfde206&q={searchTerms}","encodings":"UTF-8","id":"10","keyword":"Search","suggest_url":null,"name":"Search","icon_url":"http:\/\/search.fbdownloader.com\/search.ico","enabled":true,"prepopulate_id":0,"instant_url":null},
"session": {"urls_to_restore_on_startup":["http:\/\/search.fbdownloader.com\/?channel=sfde206"],"restore_on_startup_migrated":true,"restore_on_startup":4},
"_null": null"
"IEDefaultScope"="{95B7759C-8C7F-4BF1-B163-73684A933233}"
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"


========== regfind ==========

Searching for "protector"
[HKEY_CURRENT_USER\Software\Protector]
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector]

-= EOF =-

aharonov · 10.09.2013, 11:30

So, mach bitte diesen Fix, starte den Rechner neu auf und teile mir mit, ob dieses Mistding wieder zurückgekommen ist oder nicht.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

REG: reg delete "HKCU\Software\Protector" /f
REG: reg delete "HKU\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector" /f
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde206
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
FF DefaultSearchEngine: Search
FF SearchPlugin: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml
FF SelectedSearchEngine: Search
FF Homepage: hxxp://search.fbdownloader.com/?channel=sfde206
FF Keyword.URL: hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Nightmare199 · 10.09.2013, 11:44

Hi,

also für den Moment siehts gut aus

hier der Log:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-09-2013 01
Ran by Nightmare at 2013-09-10 12:40:54 Run:1
Running from E:\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
REG: reg delete "HKCU\Software\Protector" /f
REG: reg delete "HKU\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector" /f
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde206
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
FF DefaultSearchEngine: Search
FF SearchPlugin: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml
FF SelectedSearchEngine: Search
FF Homepage: hxxp://search.fbdownloader.com/?channel=sfde206
FF Keyword.URL: hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=
         
*****************


========= reg delete "HKCU\Software\Protector" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKU\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector" /f =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========

HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
Firefox DefaultSearchEngine deleted successfully.
C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml => Moved successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
Firefox Keyword.URL deleted successfully.

==== End of Fixlog ====

Gruß
David

aharonov · 10.09.2013, 11:47

Ok, und sonst melde dich einfach wieder. Das kriegen wir schon klein.

Downloade dir bitte delfix auf deinen Desktop.

Schliesse alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.
DelFix entfernt u.a. alle von uns verwendeten Programme und löscht sich anschliessend selbst.
Sollte denoch etwas übrig bleiben, kannst du es manuell löschen.

Nightmare199 · 10.09.2013, 11:52

Hi Leo,

also sieht immer noch gut aus, Cleanup is durch

Nochmals Danke für die schnelle und fundierte Hilfe!

Hier noch das Log:

Code:

ATTFilter

# DelFix v10.4 - Datei am 10/09/2013 um 12:49:21 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Benutzer : Nightmare - NIGHTMARE-NB
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Aktiviere die Benutzerkontensteuerung ... OK

~ Entferne die Bereinigungsprogramme ...

Gelöscht : C:\FRST
Gelöscht : C:\Users\Nightmare\Desktop\Fixlog.txt

~ Erstelle ein Backup der Registrierungsdatenbank ... OK

~ Lösche die Wiederherstellungspunkte ...

Gelöscht : RP #92 [Ende der Bereinigung | 09/09/2013 19:47:36]

Ein neuer Wiederherstellungspunkt wurde erstellt !

~ Stelle die Systemeinstellungen wieder her ... OK

########## - EOF - ##########

Falls er wieder auftaucht meld ich mich per PN!

Gruß David

aharonov · 10.09.2013, 11:55

Genau, PM wenn wieder etwas ist.

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.

Nightmare199 · 10.09.2013, 12:17

und schon wieder da....

Siehe Screenshot im Anhang.

bzw. Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-09-2013 01
Ran by Nightmare (administrator) on NIGHTMARE-NB on 10-09-2013 13:13:58
Running from E:\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Valve Corporation) E:\Progamme\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
MountPoints2: {ccc2de30-abfb-11e2-8d12-f46d04ed66de} - I:\LaunchU3.exe -a
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444304 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] - C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [472016 2013-02-25] (G Data Software AG)
HKLM-x32\...\Run: [BingDesktop] - C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde206
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {5C54CC0F-5F8D-475F-855B-11CDCDF6B2DC} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {2B296690-1DB5-4923-A71A-09AE504D4D20} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default
FF Homepage: hxxp://search.fbdownloader.com/?channel=sfde206
FF SelectedSearchEngine: Search
FF DefaultSearchEngine: Search
FF Keyword.URL: hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - E:\Progamme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - E:\Progamme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Docs) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1957840 2013-03-22] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635344 2013-02-25] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2249944 2013-02-25] (G Data Software AG)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2926672 2013-03-22] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [696808 2013-02-25] (G Data Software AG)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-05-09] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)

==================== Drivers (Whitelisted) ====================

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2013-05-26] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [133976 2013-05-26] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [62808 2013-05-26] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2013-05-26] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-05-27] (G Data Software)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-05-27] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [64856 2013-05-26] (G Data Software AG)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
S3 XENfiltv; C:\Windows\System32\drivers\XENfiltv.sys [25600 2009-07-31] (Creative Technology Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-10 12:40 - 2013-09-10 12:40 - 00000874 _____ C:\Users\Nightmare\Desktop\Fixlist.txt
2013-09-10 10:59 - 2013-09-10 11:01 - 06256902 _____ C:\Users\Nightmare\Desktop\Neue Bitmap.bmp
2013-09-09 21:47 - 2013-09-10 12:49 - 00000685 _____ C:\DelFix.txt
2013-09-09 21:47 - 2013-09-09 21:47 - 00000000 ____D C:\Windows\ERUNT
2013-09-09 17:46 - 2013-09-09 20:38 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-09 17:18 - 2013-09-09 17:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-09 17:12 - 2013-09-09 17:13 - 06293046 _____ C:\Users\Nightmare\Desktop\Screenshot alte Firefox Daten.bmp
2013-09-09 16:04 - 2013-09-09 16:04 - 00000655 _____ C:\Users\Nightmare\Desktop\EVEREST Home Edition.lnk
2013-09-09 15:56 - 2013-09-09 15:56 - 00002131 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-09-09 15:55 - 2013-09-09 15:56 - 06259734 _____ C:\Users\Nightmare\Desktop\screenshot.bmp
2013-08-23 21:03 - 2013-08-23 21:03 - 00000000 ____D C:\Users\Nightmare\Desktop\Riot Games
2013-08-22 17:47 - 2013-08-22 17:47 - 00259782 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-22 17:36 - 2013-08-22 17:36 - 00000614 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-22 17:27 - 2013-08-23 18:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-22 17:27 - 2013-08-23 18:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-22 17:27 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-08-22 17:27 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-08-22 17:27 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-08-22 17:27 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-08-22 17:27 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-08-22 17:27 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-08-22 17:26 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-08-22 17:26 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-08-22 17:26 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-08-22 17:26 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-08-22 17:26 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-22 17:26 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-08-22 17:26 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-08-22 17:26 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-22 17:26 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-08-22 17:26 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-22 17:26 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-08-22 17:26 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-08-22 17:26 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-22 17:26 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-08-22 17:26 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-08-22 17:26 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-08-22 17:26 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-08-22 17:26 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-22 17:26 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-22 17:24 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-08-22 17:24 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-08-22 17:24 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-08-22 17:24 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-08-22 17:24 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-22 17:24 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-08-22 17:24 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-08-22 17:24 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-08-22 17:24 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Secunia PSI
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-22 17:13 - 2013-08-22 17:13 - 03272136 _____ (Secunia) C:\Users\Nightmare\Desktop\PSISetup711.exe
2013-08-22 17:07 - 2013-08-22 17:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-22 17:02 - 2013-09-09 17:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-22 17:02 - 2013-08-22 17:02 - 00001186 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-22 17:02 - 2013-08-22 17:02 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Mozilla
2013-08-22 16:52 - 2013-08-22 16:52 - 00014086 _____ C:\Users\Nightmare\Desktop\bookmarks-2013-08-22.json
2013-08-22 16:47 - 2013-08-22 16:47 - 00000000 ____D C:\Users\Nightmare\AppData\Local\G DATA
2013-08-22 16:36 - 2013-08-22 16:36 - 00001160 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-22 16:36 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-22 16:35 - 2013-08-22 16:36 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Nightmare\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-21 21:52 - 2013-08-23 21:08 - 00000000 ____D C:\AdwCleaner
2013-08-19 14:56 - 2013-08-19 16:05 - 00017125 _____ C:\Users\Nightmare\Desktop\box layout.xlsx
2013-08-14 16:29 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 16:29 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 16:29 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 16:29 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 16:29 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 16:29 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 16:29 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 16:29 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 16:29 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 16:29 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 16:29 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 16:29 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 15:46 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 15:46 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 15:46 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 15:46 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 15:46 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 15:46 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 15:46 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 15:46 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 15:46 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 15:46 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 15:46 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 15:46 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 15:46 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 15:46 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 15:46 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 15:46 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 15:46 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 15:46 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 15:46 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 15:46 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 15:46 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 15:46 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 15:46 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 15:46 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 15:46 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 15:46 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 15:46 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-10 13:13 - 2013-09-10 13:13 - 00000000 ____D C:\FRST
2013-09-10 13:10 - 2013-03-25 15:43 - 01509375 _____ C:\Windows\WindowsUpdate.log
2013-09-10 13:09 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-10 13:09 - 2009-07-14 06:51 - 00085456 _____ C:\Windows\setupact.log
2013-09-10 13:08 - 2013-03-25 16:39 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-10 12:49 - 2013-09-09 21:47 - 00000685 _____ C:\DelFix.txt
2013-09-10 12:49 - 2009-07-14 06:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-10 12:49 - 2009-07-14 06:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-10 12:48 - 2010-11-21 08:50 - 00698688 _____ C:\Windows\system32\perfh007.dat
2013-09-10 12:48 - 2010-11-21 08:50 - 00148828 _____ C:\Windows\system32\perfc007.dat
2013-09-10 12:48 - 2009-07-14 07:13 - 01618320 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-10 12:40 - 2013-09-10 12:40 - 00000874 _____ C:\Users\Nightmare\Desktop\Fixlist.txt
2013-09-10 11:01 - 2013-09-10 10:59 - 06256902 _____ C:\Users\Nightmare\Desktop\Neue Bitmap.bmp
2013-09-09 21:47 - 2013-09-09 21:47 - 00000000 ____D C:\Windows\ERUNT
2013-09-09 20:38 - 2013-09-09 17:46 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-09 20:38 - 2013-05-07 17:47 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-09 20:37 - 2013-05-02 23:06 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-09 17:18 - 2013-09-09 17:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-09 17:13 - 2013-09-09 17:12 - 06293046 _____ C:\Users\Nightmare\Desktop\Screenshot alte Firefox Daten.bmp
2013-09-09 17:05 - 2013-08-22 17:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-09 16:04 - 2013-09-09 16:04 - 00000655 _____ C:\Users\Nightmare\Desktop\EVEREST Home Edition.lnk
2013-09-09 15:56 - 2013-09-09 15:56 - 00002131 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-09-09 15:56 - 2013-09-09 15:55 - 06259734 _____ C:\Users\Nightmare\Desktop\screenshot.bmp
2013-08-23 21:08 - 2013-08-21 21:52 - 00000000 ____D C:\AdwCleaner
2013-08-23 21:03 - 2013-08-23 21:03 - 00000000 ____D C:\Users\Nightmare\Desktop\Riot Games
2013-08-23 18:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-23 18:01 - 2013-08-22 17:27 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-23 18:01 - 2013-08-22 17:27 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-22 17:47 - 2013-08-22 17:47 - 00259782 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-22 17:38 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-22 17:36 - 2013-08-22 17:36 - 00000614 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-08-22 17:17 - 2013-04-01 03:00 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Secunia PSI
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-22 17:13 - 2013-08-22 17:13 - 03272136 _____ (Secunia) C:\Users\Nightmare\Desktop\PSISetup711.exe
2013-08-22 17:07 - 2013-08-22 17:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-22 17:02 - 2013-08-22 17:02 - 00001186 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-22 17:02 - 2013-08-22 17:02 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Mozilla
2013-08-22 16:54 - 2010-11-21 05:47 - 00335666 _____ C:\Windows\PFRO.log
2013-08-22 16:52 - 2013-08-22 16:52 - 00014086 _____ C:\Users\Nightmare\Desktop\bookmarks-2013-08-22.json
2013-08-22 16:47 - 2013-08-22 16:47 - 00000000 ____D C:\Users\Nightmare\AppData\Local\G DATA
2013-08-22 16:36 - 2013-08-22 16:36 - 00001160 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-22 16:36 - 2013-08-22 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Nightmare\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-20 23:09 - 2013-03-25 16:39 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 23:08 - 2013-03-25 16:39 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-20 23:08 - 2013-03-25 16:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-19 16:05 - 2013-08-19 14:56 - 00017125 _____ C:\Users\Nightmare\Desktop\box layout.xlsx
2013-08-18 21:14 - 2013-03-25 15:46 - 00000000 ____D C:\Users\Nightmare\AppData\Local\VirtualStore
2013-08-16 18:46 - 2013-06-18 02:18 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Windows Live
2013-08-15 19:28 - 2013-06-19 17:17 - 00000000 ____D C:\Users\Nightmare\Desktop\Spiele Verknüfungen
2013-08-15 19:27 - 2013-03-25 16:34 - 00000000 ____D C:\Users\Nightmare\Desktop\Programme
2013-08-15 19:26 - 2013-07-22 16:56 - 00000000 ____D C:\Users\Nightmare\Desktop\Artur Film & Trailer
2013-08-14 16:28 - 2013-08-06 01:30 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 16:28 - 2013-04-10 19:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 16:27 - 2013-03-29 11:27 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\Nightmare\AppData\Local\Temp\bi_cleaner.exe
C:\Users\Nightmare\AppData\Local\Temp\ose00000.exe
C:\Users\Nightmare\AppData\Local\Temp\Quarantine.exe
C:\Users\Nightmare\AppData\Local\Temp\sonarinst.exe
C:\Users\Nightmare\AppData\Local\Temp\uninst1.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-23 18:32

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-09-2013 01
Ran by Nightmare at 2013-09-10 13:14:15
Running from E:\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219)
AMD APP SDK Runtime (Version: 10.0.1084.4)
AMD Catalyst Install Manager (Version: 8.0.903.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.71219.1540)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Avidemux 2.6 (32-bit) (x32 Version: 2.6.4.8696)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlelog Web Plugins (x32 Version: 2.1.7)
Bing-Desktop (x32 Version: 1.3.171.0)
Bonjour (Version: 3.0.0.10)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485)
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485)
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485)
CCC Help Czech (x32 Version: 2012.1219.1520.27485)
CCC Help Danish (x32 Version: 2012.1219.1520.27485)
CCC Help Dutch (x32 Version: 2012.1219.1520.27485)
CCC Help English (x32 Version: 2012.1219.1520.27485)
CCC Help Finnish (x32 Version: 2012.1219.1520.27485)
CCC Help French (x32 Version: 2012.1219.1520.27485)
CCC Help German (x32 Version: 2012.1219.1520.27485)
CCC Help Greek (x32 Version: 2012.1219.1520.27485)
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485)
CCC Help Italian (x32 Version: 2012.1219.1520.27485)
CCC Help Japanese (x32 Version: 2012.1219.1520.27485)
CCC Help Korean (x32 Version: 2012.1219.1520.27485)
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485)
CCC Help Polish (x32 Version: 2012.1219.1520.27485)
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485)
CCC Help Russian (x32 Version: 2012.1219.1520.27485)
CCC Help Spanish (x32 Version: 2012.1219.1520.27485)
CCC Help Swedish (x32 Version: 2012.1219.1520.27485)
CCC Help Thai (x32 Version: 2012.1219.1520.27485)
CCC Help Turkish (x32 Version: 2012.1219.1520.27485)
ccc-utility64 (Version: 2012.1219.1521.27485)
Counter-Strike: Global Offensive (x32)
D3DX10 (x32 Version: 15.4.2368.0902)
ESET Online Scanner v3 (x32)
ESN Sonar (x32 Version: 0.70.4)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
Fotogalerie (x32 Version: 16.4.3508.0205)
Free Video Flip and Rotate version 2.1.8.717 (x32 Version: 2.1.8.717)
Free YouTube Download version 3.2.8.717 (x32 Version: 3.2.8.717)
Free YouTube to MP3 Converter version 3.12.8.717 (x32 Version: 3.12.8.717)
G Data InternetSecurity 2014 (x32 Version: 24.0.2.1)
iTunes (Version: 11.0.2.26)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Metro: Last Light (x32)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3508.0205)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 17.0.8)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Music Editor Free (x32)
neroxml (x32 Version: 1.0.0)
NVIDIA PhysX (x32 Version: 9.12.1031)
Origin (x32 Version: 9.1.13.85)
Photo Common (x32 Version: 16.4.3508.0205)
Photo Gallery (x32 Version: 16.4.3508.0205)
PunkBuster Services (x32 Version: 0.991)
RAR 4.20 (64-Bit) (Version: 4.20.0)
Realtek Ethernet Controller Driver For Windows Vista and Later (x32 Version: 1.00.0009)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6251)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
Secunia PSI (3.0.0.7011) (x32 Version: 3.0.0.7011)
Steam (x32 Version: 1.0.0.0)
Tomb Raider (x32)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VLC media player 2.0.8 (x32 Version: 2.0.8)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205)
Windows Live Essentials (x32 Version: 16.4.3508.0205)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3508.0205)
Windows Live Photo Common (x32 Version: 16.4.3508.0205)
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205)
Windows Live SOXE (x32 Version: 16.4.3508.0205)
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205)
Windows Live UX Platform (x32 Version: 16.4.3508.0205)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205)

==================== Restore Points  =========================

10-09-2013 10:49:23 Ende der Bereinigung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {2CCF47AD-EF12-45C8-B37C-F66843F595B6} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {A0C52115-95CD-404B-A750-4B0D702CAD90} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {A8EB5811-A1C3-4990-9580-77C332ECB59A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-20] (Adobe Systems Incorporated)
Task: {DD794993-B0B2-48B9-A6A6-05766AF86FA8} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-03-29 17:05 - 2012-06-09 20:20 - 00196096 _____ (Alexander Roshal) E:\Progamme\WinRar\rarext.dll
2013-02-25 05:15 - 2013-02-25 05:15 - 00536016 ____N (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\ShellExt64.dll
2013-02-25 04:57 - 2013-02-25 04:57 - 00305104 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeLDR64.dll
2012-12-19 17:16 - 2012-12-19 17:16 - 00327680 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.dll
2012-12-19 17:16 - 2012-12-19 17:16 - 00208896 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Shared.dll
2012-12-19 17:19 - 2012-12-19 17:19 - 00028672 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.AMDHome.Graphics.Dashboard.dll
2013-02-25 04:12 - 2013-02-25 04:12 - 01019344 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\ObjBrwse.dll
2013-02-25 14:59 - 2013-02-25 14:59 - 01633768 _____ (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Common\AVKRes.dll
2010-11-17 03:52 - 2010-11-17 03:52 - 00096904 _____ (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll
2013-02-25 04:57 - 2013-02-25 04:57 - 00264144 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeLDR.dll
2013-08-22 17:07 - 2013-08-22 17:07 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-02-25 04:57 - 2013-02-25 04:57 - 00266192 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\Banksafe.dll
2013-05-06 18:29 - 2013-09-06 22:55 - 00288680 _____ (Valve Corporation) E:\Progamme\Steam\crashhandler.dll
2013-03-28 14:26 - 2013-07-16 00:32 - 02895272 _____ (Valve Corporation) E:\Progamme\Steam\steam.dll
2013-04-19 13:10 - 2013-09-06 22:55 - 10659752 _____ (Valve Corporation) E:\Progamme\Steam\steamui.dll
2013-03-25 14:23 - 2013-08-22 00:18 - 00687104 _____ () E:\Progamme\Steam\SDL2.dll
2013-04-19 13:10 - 2013-09-06 22:55 - 00263080 _____ (Valve Corporation) E:\Progamme\Steam\tier0_s.dll
2013-04-19 13:10 - 2013-09-06 22:56 - 00236456 _____ (Valve Corporation) E:\Progamme\Steam\vstdlib_s.dll
2010-03-10 09:08 - 2013-06-15 01:49 - 01039192 _____ (Microsoft Corporation) E:\Progamme\Steam\DbgHelp.dll
2010-03-10 09:08 - 2013-06-15 01:49 - 00122864 _____ (Valve) E:\Progamme\Steam\CSERHelper.dll
2013-05-07 16:19 - 2013-09-06 22:55 - 00169384 _____ (Valve Corporation) E:\Progamme\Steam\bin\filesystem_stdio.DLL
2013-04-19 13:10 - 2013-09-06 22:55 - 00694696 _____ (Valve Corporation) E:\Progamme\Steam\bin\vgui2_s.DLL
2013-04-19 13:10 - 2013-09-06 22:55 - 01120680 _____ () E:\Progamme\Steam\bin\chromehtml.DLL
2013-03-26 16:16 - 2013-08-07 21:31 - 20625832 _____ () E:\Progamme\Steam\bin\libcef.dll
2012-09-07 15:37 - 2013-06-15 01:49 - 09955112 _____ (The ICU Project) E:\Progamme\Steam\bin\icudt.dll
2012-12-11 09:51 - 2013-06-15 01:49 - 01100800 _____ () E:\Progamme\Steam\bin\avcodec-53.dll
2012-12-11 09:51 - 2013-06-15 01:49 - 00124416 _____ () E:\Progamme\Steam\bin\avutil-51.dll
2012-12-11 09:51 - 2013-06-15 01:49 - 00192000 _____ () E:\Progamme\Steam\bin\avformat-53.dll
2013-04-19 13:10 - 2013-09-06 22:55 - 07751080 _____ (Valve Corporation) E:\Progamme\Steam\steamclient.dll
2013-04-19 13:10 - 2013-09-06 22:55 - 02449832 _____ (Valve Corporation) e:\progamme\steam\bin\friendsui.DLL
2013-04-19 13:10 - 2013-09-06 22:55 - 01804712 _____ (Valve Corporation) e:\progamme\steam\bin\serverbrowser.DLL

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/10/2013 01:13:08 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/10/2013 01:11:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/10/2013 00:45:32 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/10/2013 00:44:09 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/10/2013 00:40:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/10/2013 10:57:29 AM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/10/2013 10:57:03 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/09/2013 10:52:21 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/09/2013 08:31:08 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/09/2013 07:23:44 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005


System errors:
=============
Error: (09/10/2013 11:01:30 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/10/2013 11:01:30 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (09/09/2013 04:04:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Lavalys EVEREST Kernel Driver" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (09/09/2013 04:04:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Lavalys EVEREST Kernel Driver" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (08/23/2013 06:17:46 PM) (Source: BROWSER) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{6F9372A6-4D9B-41DC-B488-09D8D64B6803}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.

Error: (08/17/2013 01:26:07 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-09-09 16:04:27.849
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Nightmare\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-09 16:04:27.833
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Nightmare\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-09 16:04:27.755
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Progamme\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-09 16:04:27.740
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Progamme\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 31%
Total physical RAM: 8173.21 MB
Available physical RAM: 5559.2 MB
Total Pagefile: 16344.61 MB
Available Pagefile: 13270.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (Samsung SSD BOOT Device) (Fixed) (Total:111.79 GB) (Free:21.28 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (DATA 2 TB) (Fixed) (Total:1862.92 GB) (Free:1701.25 GB) NTFS
Drive g: (INTENSO 32) (Removable) (Total:29.28 GB) (Free:24.72 GB) FAT32
Drive h: (DATA BASE) (Fixed) (Total:931.28 GB) (Free:360.87 GB) FAT32
Drive k: (Elements) (Fixed) (Total:1397.26 GB) (Free:304.94 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 7BE1F435)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 11BB29FA)
Partition 1: (Not Active) - (Size=-198731276288) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 932 GB) (Disk ID: F2E0AD49)
Partition 1: (Active) - (Size=932 GB) - (Type=0C)

========================================================
Disk: 3 (Size: 29 GB) (Disk ID: BB8D4FEE)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0C)

========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 1397 GB) (Disk ID: 000CF721)
Partition 1: (Not Active) - (Size=-698724909056) - (Type=07 NTFS)

==================== End Of Log ============================

Gruß
David

aharonov · 10.09.2013, 13:51

Das ist doch zum

Ich bin dem offenbar noch nicht auf die Schliche gekommen, der das immer wiederherstellt.

Lade SystemLook (von jpshortstuff) herunter und speichere das Tool auf dem Desktop.

Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
Vista und Win7 User: Rechtsklick und "als Administrator starten".

Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

ATTFilter

:filefind
*protector*
*fbdownloader*

:folderfind
*protector*
*fbdownloader*

:reg
HKEY_CURRENT_USER\Software\Protector /sub
HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector /sub

:regfind
protector
fbdownloader

Klicke nun auf den Button Look, um den Scan zu starten.
Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen. Poste diese in deinen Thread.
Das Log-File wird auch auf dem Desktop als SystemLook.txt gespeichert.

Nightmare199 · 10.09.2013, 13:59

Code:

ATTFilter

SystemLook 30.07.11 by jpshortstuff
Log created at 14:54 on 10/09/2013 by Nightmare
Administrator - Elevation successful

========== filefind ==========

Searching for "*protector*"
No files found.

Searching for "*fbdownloader*"
No files found.

========== folderfind ==========

Searching for "*protector*"
No folders found.

Searching for "*fbdownloader*"
C:\AdwCleaner\Quarantine\C\Users\Nightmare\AppData\Roaming\fbDownloader	d------	[19:53 21/08/2013]

========== reg ==========

[HKEY_CURRENT_USER\Software\Protector]
"InstallTimestamp"="1378809886"

[HKEY_CURRENT_USER\Software\Protector\Revert]
"FirefoxPrefsFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\prefs.js"
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
"FirefoxChangedPrefs"="browser.startup.homepage,browser.search.selectedEngine,browser.search.defaultenginename,browser.search.defaulturl,keyword.URL,keyword.enabled,"
"FirefoxSearchDBFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\search.sqlite"
"IEDefaultScope"="{95B7759C-8C7F-4BF1-B163-73684A933233}"
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"


[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector]
"InstallTimestamp"="1378809886"

[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"FirefoxPrefsFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\prefs.js"
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
"FirefoxChangedPrefs"="browser.startup.homepage,browser.search.selectedEngine,browser.search.defaultenginename,browser.search.defaulturl,keyword.URL,keyword.enabled,"
"FirefoxSearchDBFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\search.sqlite"
"IEDefaultScope"="{95B7759C-8C7F-4BF1-B163-73684A933233}"
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"


========== regfind ==========

Searching for "protector"
[HKEY_CURRENT_USER\Software\Protector]
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector]

Searching for "fbdownloader"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.fbdownloader.com/?channel=sfde206"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"URL"="hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURL"="hxxp://search.fbdownloader.com/search.ico"
[HKEY_CURRENT_USER\Software\Protector\Revert]
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
[HKEY_CURRENT_USER\Software\Protector\Revert]
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.fbdownloader.com/?channel=sfde206"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"URL"="hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURL"="hxxp://search.fbdownloader.com/search.ico"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"

Searching for "         "
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"E:\Downloads\SoftonicDownloader_fuer_iringer.exe"="Softonic Downloader                             "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{21C35C68-A6C5-4A75-8FFD-DB503CE6F67B}]
"RatingsInfo"="<Ratings xmlns="urn:schemas-microsoft-com:GameDescription.v1">
            <Rating ratingSystemID="{768BD93D-63BE-46A9-8994-0B53C4B5248F}" ratingID="{18CD34B7-7AA3-42b9-A303-5A729B2FF228}">
                <Descriptor descriptorID="{ABE23B46-7F9F-495b-B4A9-87F41743727F}"/>
                <Descriptor descriptorID="{B54162A2-F67F-46dc-9ED5-F6067520EC94}"/>
                <Descriptor descriptorID="{7E0BC004-F80B-402d-A1FC-5FCDFF04DAB1}"/>
                <Descriptor descriptorID="{BE562A5F-2A80-4c28-9752-74C696E2ABAF}"/>
            </Rating>
        </Ratings>"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"="             <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" >                 <InitializationParameters>                     <Param Name="PSVersion" Value="2.0"/>                 </InitializationParameters>                 <Resources>                     <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true">                         <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                         <Capability Type="Shell"/>                     </Resource>                 </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" >                         <InitializationParameters>                             <Param Name="PSVersion" Value="2.0"/>                         </InitializationParameters>                         <Resources>                             <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true">                                 <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                                
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#11062655000822&0#]
"DeviceDesc"="                "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_QIMONDA&REV_PMAP#07831BA00332&0#]
"DeviceDesc"="QIMONDA         "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_USB&REV_1100#AA04012700007567&0#]
"DeviceDesc"="USB             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MEMORY&PROD_USB2.0&REV_1.00#3551&0#]
"DeviceDesc"="USB2.0          "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#11062655000822&0#]
"DeviceDesc"="                "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_QIMONDA&REV_PMAP#07831BA00332&0#]
"DeviceDesc"="QIMONDA         "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_USB&REV_1100#AA04012700007567&0#]
"DeviceDesc"="USB             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MEMORY&PROD_USB2.0&REV_1.00#3551&0#]
"DeviceDesc"="USB2.0          "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#11062655000822&0#]
"DeviceDesc"="                "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_QIMONDA&REV_PMAP#07831BA00332&0#]
"DeviceDesc"="QIMONDA         "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_USB&REV_1100#AA04012700007567&0#]
"DeviceDesc"="USB             "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MEMORY&PROD_USB2.0&REV_1.00#3551&0#]
"DeviceDesc"="USB2.0          "
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"E:\Downloads\SoftonicDownloader_fuer_iringer.exe"="Softonic Downloader                             "
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"E:\Downloads\SoftonicDownloader_fuer_iringer.exe"="Softonic Downloader                             "

-= EOF =-

Da liegt noch ein exemplar im quarantäne Ordner von adwcleaner, soll/kann man das manuell rauslöschen?

Sláinte
David

aharonov · 10.09.2013, 14:20

Ok. Dann bitte nochmals folgenden Fix durchführen. Danach unbedingt den Rechner neustarten und den vorherigen Scan mit SystemLook genau so nochmals wiederholen

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

REG: reg delete "HKCU\Software\Protector" /f
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde206
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
FF Homepage: hxxp://search.fbdownloader.com/?channel=sfde206
FF SelectedSearchEngine: Search
FF DefaultSearchEngine: Search
FF Keyword.URL: hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=
FF SearchPlugin: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml
REG: reg query "HKCU\Software\Protector" /s

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Nightmare199 · 10.09.2013, 14:44

Ok habe den Fix laufen lassen

Ergebnis:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-09-2013 01
Ran by Nightmare at 2013-09-10 15:38:55 Run:1
Running from C:\Users\Nightmare\Desktop\trojaner-board
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
REG: reg delete "HKCU\Software\Protector" /f
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde206
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
FF Homepage: hxxp://search.fbdownloader.com/?channel=sfde206
FF SelectedSearchEngine: Search
FF DefaultSearchEngine: Search
FF Keyword.URL: hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=
FF SearchPlugin: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml
REG: reg query "HKCU\Software\Protector" /s
         
*****************


========= reg delete "HKCU\Software\Protector" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========

HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
Firefox homepage deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox DefaultSearchEngine deleted successfully.
Firefox Keyword.URL deleted successfully.
C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml => Moved successfully.

========= reg query "HKCU\Software\Protector" /s =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


==== End of Fixlog ====

Jetzt starte ich den PC neu und lasse Systemlook laufen!

Gruß

David

Ergebnis des SystemLook:

Code:

ATTFilter

SystemLook 30.07.11 by jpshortstuff
Log created at 15:42 on 10/09/2013 by Nightmare
Administrator - Elevation successful

========== filefind ==========

Searching for "*protector*"
No files found.

Searching for "*fbdownloader*"
No files found.

========== folderfind ==========

Searching for "*protector*"
No folders found.

Searching for "*fbdownloader*"
C:\AdwCleaner\Quarantine\C\Users\Nightmare\AppData\Roaming\fbDownloader	d------	[19:53 21/08/2013]

========== reg ==========

[HKEY_CURRENT_USER\Software\Protector]
(Unable to open key - key not found)

[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector]
(Unable to open key - key not found)

========== regfind ==========

Searching for "protector"
No data found.

Searching for "fbdownloader"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.fbdownloader.com/?channel=sfde206"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"URL"="hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURL"="hxxp://search.fbdownloader.com/search.ico"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"

-= EOF =-

aharonov · 10.09.2013, 14:50

Behalt es mal im Auge, ob es wieder kommt.

Nightmare199 · 10.09.2013, 14:58

Sieht auf den ersten Blick clean aus:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-09-2013 01
Ran by Nightmare (administrator) on NIGHTMARE-NB on 10-09-2013 15:55:34
Running from C:\Users\Nightmare\Desktop\trojaner-board
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
MountPoints2: {ccc2de30-abfb-11e2-8d12-f46d04ed66de} - I:\LaunchU3.exe -a
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444304 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] - C:\Program Files (x86)\G Data\InternetSecurity\DelayLoader\AutorunDelayLoader.exe [472016 2013-02-25] (G Data Software AG)
HKLM-x32\...\Run: [BingDesktop] - C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-20] (Microsoft Corp.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.fbdownloader.com/?channel=sfde206
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {5C54CC0F-5F8D-475F-855B-11CDCDF6B2DC} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {2B296690-1DB5-4923-A71A-09AE504D4D20} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - E:\Progamme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - E:\Progamme\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\searchplugins\search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Docs) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Nightmare\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1957840 2013-03-22] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635344 2013-02-25] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2249944 2013-02-25] (G Data Software AG)
R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-20] (Microsoft Corp.)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2926672 2013-03-22] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [696808 2013-02-25] (G Data Software AG)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-05-09] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)

==================== Drivers (Whitelisted) ====================

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2013-05-26] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [133976 2013-05-26] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [62808 2013-05-26] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2013-05-26] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-05-27] (G Data Software)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-05-27] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [64856 2013-05-26] (G Data Software AG)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
S3 XENfiltv; C:\Windows\System32\drivers\XENfiltv.sys [25600 2009-07-31] (Creative Technology Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-10 13:28 - 2013-09-10 15:55 - 00000000 ____D C:\Users\Nightmare\Desktop\trojaner-board
2013-09-10 13:13 - 2013-09-10 13:13 - 00000000 ____D C:\FRST
2013-09-09 21:47 - 2013-09-10 12:49 - 00000685 _____ C:\DelFix.txt
2013-09-09 21:47 - 2013-09-09 21:47 - 00000000 ____D C:\Windows\ERUNT
2013-09-09 17:46 - 2013-09-10 15:04 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-09 17:18 - 2013-09-09 17:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-23 21:03 - 2013-08-23 21:03 - 00000000 ____D C:\Users\Nightmare\Desktop\Riot Games
2013-08-22 17:47 - 2013-08-22 17:47 - 00259782 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-22 17:27 - 2013-08-23 18:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-22 17:27 - 2013-08-23 18:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-22 17:27 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-08-22 17:27 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-08-22 17:27 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-08-22 17:27 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-08-22 17:27 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-08-22 17:27 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-08-22 17:26 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-08-22 17:26 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-08-22 17:26 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-08-22 17:26 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-08-22 17:26 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-08-22 17:26 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-08-22 17:26 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-08-22 17:26 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-08-22 17:26 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-08-22 17:26 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-08-22 17:26 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-08-22 17:26 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-08-22 17:26 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-08-22 17:26 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-08-22 17:26 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-08-22 17:26 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-08-22 17:26 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-08-22 17:26 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-08-22 17:26 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-08-22 17:24 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-08-22 17:24 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-08-22 17:24 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-08-22 17:24 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-08-22 17:24 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-22 17:24 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-08-22 17:24 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-08-22 17:24 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-08-22 17:24 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Secunia PSI
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-22 17:07 - 2013-08-22 17:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-22 17:02 - 2013-09-09 17:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-22 17:02 - 2013-08-22 17:02 - 00001186 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-22 17:02 - 2013-08-22 17:02 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Mozilla
2013-08-22 16:52 - 2013-08-22 16:52 - 00014086 _____ C:\Users\Nightmare\Desktop\bookmarks-2013-08-22.json
2013-08-22 16:47 - 2013-08-22 16:47 - 00000000 ____D C:\Users\Nightmare\AppData\Local\G DATA
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-22 16:36 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-22 16:35 - 2013-08-22 16:36 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Nightmare\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-21 21:52 - 2013-08-23 21:08 - 00000000 ____D C:\AdwCleaner
2013-08-19 14:56 - 2013-08-19 16:05 - 00017125 _____ C:\Users\Nightmare\Desktop\box layout.xlsx
2013-08-14 16:29 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 16:29 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 16:29 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 16:29 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 16:29 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 16:29 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 16:29 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 16:29 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 16:29 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 16:29 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 16:29 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 16:29 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 16:29 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 16:29 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 15:46 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 15:46 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 15:46 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 15:46 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 15:46 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 15:46 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 15:46 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 15:46 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 15:46 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 15:46 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 15:46 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 15:46 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 15:46 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 15:46 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 15:46 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 15:46 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 15:46 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 15:46 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 15:46 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 15:46 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 15:46 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 15:46 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 15:46 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 15:46 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 15:46 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 15:46 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 15:46 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-10 15:54 - 2013-03-25 15:43 - 01535953 _____ C:\Windows\WindowsUpdate.log
2013-09-10 15:53 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-10 15:53 - 2009-07-14 06:51 - 00085736 _____ C:\Windows\setupact.log
2013-09-10 15:48 - 2010-11-21 08:50 - 00698688 _____ C:\Windows\system32\perfh007.dat
2013-09-10 15:48 - 2010-11-21 08:50 - 00148828 _____ C:\Windows\system32\perfc007.dat
2013-09-10 15:48 - 2009-07-14 07:13 - 01618320 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-10 15:48 - 2009-07-14 06:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-10 15:48 - 2009-07-14 06:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-10 15:08 - 2013-03-25 16:39 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-10 15:04 - 2013-09-09 17:46 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-10 15:04 - 2013-05-07 17:47 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-10 15:04 - 2013-05-02 23:06 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-10 14:48 - 2013-03-25 16:34 - 00000000 ____D C:\Users\Nightmare\Desktop\Programme
2013-09-10 13:13 - 2013-09-10 13:13 - 00000000 ____D C:\FRST
2013-09-10 12:49 - 2013-09-09 21:47 - 00000685 _____ C:\DelFix.txt
2013-09-09 21:47 - 2013-09-09 21:47 - 00000000 ____D C:\Windows\ERUNT
2013-09-09 17:18 - 2013-09-09 17:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-09 17:05 - 2013-08-22 17:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Thunderbird
2013-09-09 15:56 - 2013-09-09 15:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-23 21:08 - 2013-08-21 21:52 - 00000000 ____D C:\AdwCleaner
2013-08-23 21:03 - 2013-08-23 21:03 - 00000000 ____D C:\Users\Nightmare\Desktop\Riot Games
2013-08-23 18:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-23 18:01 - 2013-08-22 17:27 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-23 18:01 - 2013-08-22 17:27 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-22 17:47 - 2013-08-22 17:47 - 00259782 _____ C:\Windows\msxml4-KB2758694-enu.LOG
2013-08-22 17:38 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-08-22 17:17 - 2013-04-01 03:00 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Secunia PSI
2013-08-22 17:14 - 2013-08-22 17:14 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-08-22 17:07 - 2013-08-22 17:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-22 17:02 - 2013-08-22 17:02 - 00001186 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-22 17:02 - 2013-08-22 17:02 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Mozilla
2013-08-22 16:54 - 2010-11-21 05:47 - 00335666 _____ C:\Windows\PFRO.log
2013-08-22 16:52 - 2013-08-22 16:52 - 00014086 _____ C:\Users\Nightmare\Desktop\bookmarks-2013-08-22.json
2013-08-22 16:47 - 2013-08-22 16:47 - 00000000 ____D C:\Users\Nightmare\AppData\Local\G DATA
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Users\Nightmare\AppData\Roaming\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-22 16:36 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-22 16:36 - 2013-08-22 16:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Nightmare\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-20 23:09 - 2013-03-25 16:39 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-20 23:08 - 2013-03-25 16:39 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-20 23:08 - 2013-03-25 16:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-19 16:05 - 2013-08-19 14:56 - 00017125 _____ C:\Users\Nightmare\Desktop\box layout.xlsx
2013-08-18 21:14 - 2013-03-25 15:46 - 00000000 ____D C:\Users\Nightmare\AppData\Local\VirtualStore
2013-08-16 18:46 - 2013-06-18 02:18 - 00000000 ____D C:\Users\Nightmare\AppData\Local\Windows Live
2013-08-15 19:28 - 2013-06-19 17:17 - 00000000 ____D C:\Users\Nightmare\Desktop\Spiele Verknüfungen
2013-08-15 19:26 - 2013-07-22 16:56 - 00000000 ____D C:\Users\Nightmare\Desktop\Artur Film & Trailer
2013-08-14 16:28 - 2013-08-06 01:30 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 16:28 - 2013-04-10 19:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 16:27 - 2013-03-29 11:27 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\Nightmare\AppData\Local\Temp\bi_cleaner.exe
C:\Users\Nightmare\AppData\Local\Temp\ose00000.exe
C:\Users\Nightmare\AppData\Local\Temp\Quarantine.exe
C:\Users\Nightmare\AppData\Local\Temp\sonarinst.exe
C:\Users\Nightmare\AppData\Local\Temp\uninst1.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-23 18:32

==================== End Of Log ============================

--- --- ---

addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-09-2013 01
Ran by Nightmare at 2013-09-10 15:55:47
Running from C:\Users\Nightmare\Desktop\trojaner-board
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219)
AMD APP SDK Runtime (Version: 10.0.1084.4)
AMD Catalyst Install Manager (Version: 8.0.903.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.71219.1540)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Avidemux 2.6 (32-bit) (x32 Version: 2.6.4.8696)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlelog Web Plugins (x32 Version: 2.1.7)
Bing-Desktop (x32 Version: 1.3.171.0)
Bonjour (Version: 3.0.0.10)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485)
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485)
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485)
CCC Help Czech (x32 Version: 2012.1219.1520.27485)
CCC Help Danish (x32 Version: 2012.1219.1520.27485)
CCC Help Dutch (x32 Version: 2012.1219.1520.27485)
CCC Help English (x32 Version: 2012.1219.1520.27485)
CCC Help Finnish (x32 Version: 2012.1219.1520.27485)
CCC Help French (x32 Version: 2012.1219.1520.27485)
CCC Help German (x32 Version: 2012.1219.1520.27485)
CCC Help Greek (x32 Version: 2012.1219.1520.27485)
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485)
CCC Help Italian (x32 Version: 2012.1219.1520.27485)
CCC Help Japanese (x32 Version: 2012.1219.1520.27485)
CCC Help Korean (x32 Version: 2012.1219.1520.27485)
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485)
CCC Help Polish (x32 Version: 2012.1219.1520.27485)
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485)
CCC Help Russian (x32 Version: 2012.1219.1520.27485)
CCC Help Spanish (x32 Version: 2012.1219.1520.27485)
CCC Help Swedish (x32 Version: 2012.1219.1520.27485)
CCC Help Thai (x32 Version: 2012.1219.1520.27485)
CCC Help Turkish (x32 Version: 2012.1219.1520.27485)
ccc-utility64 (Version: 2012.1219.1521.27485)
Counter-Strike: Global Offensive (x32)
D3DX10 (x32 Version: 15.4.2368.0902)
ESET Online Scanner v3 (x32)
ESN Sonar (x32 Version: 0.70.4)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
Fotogalerie (x32 Version: 16.4.3508.0205)
Free Video Flip and Rotate version 2.1.8.717 (x32 Version: 2.1.8.717)
Free YouTube Download version 3.2.8.717 (x32 Version: 3.2.8.717)
Free YouTube to MP3 Converter version 3.12.8.717 (x32 Version: 3.12.8.717)
G Data InternetSecurity 2014 (x32 Version: 24.0.2.1)
iTunes (Version: 11.0.2.26)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Metro: Last Light (x32)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3508.0205)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 17.0.8)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Music Editor Free (x32)
neroxml (x32 Version: 1.0.0)
NVIDIA PhysX (x32 Version: 9.12.1031)
Origin (x32 Version: 9.1.13.85)
Photo Common (x32 Version: 16.4.3508.0205)
Photo Gallery (x32 Version: 16.4.3508.0205)
PunkBuster Services (x32 Version: 0.991)
RAR 4.20 (64-Bit) (Version: 4.20.0)
Realtek Ethernet Controller Driver For Windows Vista and Later (x32 Version: 1.00.0009)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6251)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
Secunia PSI (3.0.0.7011) (x32 Version: 3.0.0.7011)
Steam (x32 Version: 1.0.0.0)
Tomb Raider (x32)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VLC media player 2.0.8 (x32 Version: 2.0.8)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205)
Windows Live Essentials (x32 Version: 16.4.3508.0205)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3508.0205)
Windows Live Photo Common (x32 Version: 16.4.3508.0205)
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205)
Windows Live SOXE (x32 Version: 16.4.3508.0205)
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205)
Windows Live UX Platform (x32 Version: 16.4.3508.0205)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205)

==================== Restore Points  =========================

10-09-2013 10:49:23 Ende der Bereinigung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {2CCF47AD-EF12-45C8-B37C-F66843F595B6} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {A8EB5811-A1C3-4990-9580-77C332ECB59A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-20] (Adobe Systems Incorporated)
Task: {DD794993-B0B2-48B9-A6A6-05766AF86FA8} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {E81B5D33-5669-4E61-AFC9-A0D929429AE5} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-02-25 04:57 - 2013-02-25 04:57 - 00305104 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeLDR64.dll
2012-12-19 17:16 - 2012-12-19 17:16 - 00327680 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.dll
2012-12-19 17:16 - 2012-12-19 17:16 - 00208896 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Shared.dll
2012-12-19 17:19 - 2012-12-19 17:19 - 00028672 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.AMDHome.Graphics.Dashboard.dll
2013-02-25 04:12 - 2013-02-25 04:12 - 01019344 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\ObjBrwse.dll
2013-02-25 14:59 - 2013-02-25 14:59 - 01633768 _____ (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Common\AVKRes.dll
2010-11-17 03:52 - 2010-11-17 03:52 - 00096904 _____ (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll
2013-02-25 04:57 - 2013-02-25 04:57 - 00264144 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeLDR.dll
2013-08-22 17:07 - 2013-08-22 17:07 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-02-25 04:57 - 2013-02-25 04:57 - 00266192 ____N (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\Banksafe.dll
2013-05-06 18:29 - 2013-09-06 22:55 - 00288680 _____ (Valve Corporation) E:\Progamme\Steam\crashhandler.dll
2013-03-28 14:26 - 2013-07-16 00:32 - 02895272 _____ (Valve Corporation) E:\Progamme\Steam\steam.dll
2013-04-19 13:10 - 2013-09-06 22:55 - 10659752 _____ (Valve Corporation) E:\Progamme\Steam\steamui.dll
2013-03-25 14:23 - 2013-08-22 00:18 - 00687104 _____ () E:\Progamme\Steam\SDL2.dll
2013-04-19 13:10 - 2013-09-06 22:55 - 00263080 _____ (Valve Corporation) E:\Progamme\Steam\tier0_s.dll
2013-04-19 13:10 - 2013-09-06 22:56 - 00236456 _____ (Valve Corporation) E:\Progamme\Steam\vstdlib_s.dll
2010-03-10 09:08 - 2013-06-15 01:49 - 01039192 _____ (Microsoft Corporation) E:\Progamme\Steam\DbgHelp.dll
2010-03-10 09:08 - 2013-06-15 01:49 - 00122864 _____ (Valve) E:\Progamme\Steam\CSERHelper.dll
2013-05-07 16:19 - 2013-09-06 22:55 - 00169384 _____ (Valve Corporation) E:\Progamme\Steam\bin\filesystem_stdio.DLL
2013-04-19 13:10 - 2013-09-06 22:55 - 00694696 _____ (Valve Corporation) E:\Progamme\Steam\bin\vgui2_s.DLL
2013-04-19 13:10 - 2013-09-06 22:55 - 01120680 _____ () E:\Progamme\Steam\bin\chromehtml.DLL
2013-03-26 16:16 - 2013-08-07 21:31 - 20625832 _____ () E:\Progamme\Steam\bin\libcef.dll
2012-09-07 15:37 - 2013-06-15 01:49 - 09955112 _____ (The ICU Project) E:\Progamme\Steam\bin\icudt.dll
2012-12-11 09:51 - 2013-06-15 01:49 - 01100800 _____ () E:\Progamme\Steam\bin\avcodec-53.dll
2012-12-11 09:51 - 2013-06-15 01:49 - 00124416 _____ () E:\Progamme\Steam\bin\avutil-51.dll
2012-12-11 09:51 - 2013-06-15 01:49 - 00192000 _____ () E:\Progamme\Steam\bin\avformat-53.dll
2013-04-19 13:10 - 2013-09-06 22:55 - 07751080 _____ (Valve Corporation) E:\Progamme\Steam\steamclient.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/10/2013 03:54:59 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/10/2013 03:43:49 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/10/2013 03:43:25 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/10/2013 02:52:33 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/10/2013 02:52:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/10/2013 01:29:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (09/10/2013 01:13:08 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/10/2013 01:11:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/10/2013 00:45:32 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT)
Description: Produkt: Adobe Reader X (10.1.0) - Deutsch -- Setup hat eine funktionsreichere Produktversion auf Ihrem System gefunden. Setup wird jetzt beendet.

Error: (09/10/2013 00:44:09 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (09/10/2013 11:01:30 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/10/2013 11:01:30 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (09/09/2013 04:04:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Lavalys EVEREST Kernel Driver" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (09/09/2013 04:04:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Lavalys EVEREST Kernel Driver" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%577

Error: (08/23/2013 06:17:46 PM) (Source: BROWSER) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{6F9372A6-4D9B-41DC-B488-09D8D64B6803}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.

Error: (08/17/2013 01:26:07 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.

Error: (08/15/2013 01:49:11 AM) (Source: cdrom) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-09-09 16:04:27.849
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Nightmare\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-09 16:04:27.833
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Users\Nightmare\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-09 16:04:27.755
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Progamme\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-09 16:04:27.740
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Progamme\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 32%
Total physical RAM: 8173.21 MB
Available physical RAM: 5554.21 MB
Total Pagefile: 16344.61 MB
Available Pagefile: 13351.08 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Samsung SSD BOOT Device) (Fixed) (Total:111.79 GB) (Free:21.14 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (DATA 2 TB) (Fixed) (Total:1862.92 GB) (Free:1701.26 GB) NTFS
Drive g: (INTENSO 32) (Removable) (Total:29.28 GB) (Free:24.72 GB) FAT32
Drive h: (DATA BASE) (Fixed) (Total:931.28 GB) (Free:360.87 GB) FAT32
Drive k: (Elements) (Fixed) (Total:1397.26 GB) (Free:304.94 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 7BE1F435)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 11BB29FA)
Partition 1: (Not Active) - (Size=-198731276288) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 932 GB) (Disk ID: F2E0AD49)
Partition 1: (Active) - (Size=932 GB) - (Type=0C)

========================================================
Disk: 3 (Size: 29 GB) (Disk ID: BB8D4FEE)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0C)

========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 1397 GB) (Disk ID: 000CF721)
Partition 1: (Not Active) - (Size=-698724909056) - (Type=07 NTFS)

==================== End Of Log ============================

allerdings wird "search" immer noch bei den Suchmaschinen angezeigt, ist zwar nicht die ausgewählte .. das ist google, aber es wird in der Liste angezeigt. Ich hab den Eintrag jetzt mal manuell über Firefox entfernt.

aharonov · 10.09.2013, 15:00

Es hat sich bereits wiederhergestellt.

Ich muss mal nachdenken, wie man das ganz loswird, und melde mich dann wieder.
(Es ist auf jeden Fall nicht "schädlich", sondern nur nervig. Also kein Problem, den Rechner so zu nutzen.)

Nightmare199 · 10.09.2013, 15:03

Ok Leo,

nochmal für deinen tollen Einsatz.

Hier nochmal ein SystemLook Logfile:

Code:

ATTFilter

SystemLook 30.07.11 by jpshortstuff
Log created at 15:58 on 10/09/2013 by Nightmare
Administrator - Elevation successful

========== filefind ==========

Searching for "*protector*"
No files found.

Searching for "*fbdownloader*"
No files found.

========== folderfind ==========

Searching for "*protector*"
No folders found.

Searching for "*fbdownloader*"
C:\AdwCleaner\Quarantine\C\Users\Nightmare\AppData\Roaming\fbDownloader	d------	[19:53 21/08/2013]

========== reg ==========

[HKEY_CURRENT_USER\Software\Protector]
"InstallTimestamp"="1378820635"

[HKEY_CURRENT_USER\Software\Protector\Revert]
"FirefoxPrefsFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\prefs.js"
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
"FirefoxChangedPrefs"="browser.startup.homepage,browser.search.selectedEngine,browser.search.defaultenginename,browser.search.defaulturl,keyword.URL,keyword.enabled,"
"FirefoxSearchDBFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\search.sqlite"
"IEDefaultScope"="{95B7759C-8C7F-4BF1-B163-73684A933233}"
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"


[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector]
"InstallTimestamp"="1378820635"

[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"FirefoxPrefsFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\prefs.js"
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
"FirefoxChangedPrefs"="browser.startup.homepage,browser.search.selectedEngine,browser.search.defaultenginename,browser.search.defaulturl,keyword.URL,keyword.enabled,"
"FirefoxSearchDBFile"="C:\Users\Nightmare\AppData\Roaming\Mozilla\Firefox\Profiles\b7k5xtih.default\search.sqlite"
"IEDefaultScope"="{95B7759C-8C7F-4BF1-B163-73684A933233}"
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"


========== regfind ==========

Searching for "protector"
[HKEY_CURRENT_USER\Software\Protector]
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector]

Searching for "fbdownloader"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.fbdownloader.com/?channel=sfde206"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"URL"="hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURL"="hxxp://search.fbdownloader.com/search.ico"
[HKEY_CURRENT_USER\Software\Protector\Revert]
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
[HKEY_CURRENT_USER\Software\Protector\Revert]
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://search.fbdownloader.com/?channel=sfde206"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"URL"="hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURL"="hxxp://search.fbdownloader.com/search.ico"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"FirefoxOldPrefs"="user_pref("browser.search.defaulturl", "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q=");
user_pref("browser.startup.homepage_override.buildID", "20130814063812");
user_pref("browser.startup.homepage_override.mstone", "23.0.1");
"
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Protector\Revert]
"IEStartPage"="hxxp://search.fbdownloader.com/?channel=sfde206"

Searching for "         "
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"E:\Downloads\SoftonicDownloader_fuer_iringer.exe"="Softonic Downloader                             "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{21C35C68-A6C5-4A75-8FFD-DB503CE6F67B}]
"RatingsInfo"="<Ratings xmlns="urn:schemas-microsoft-com:GameDescription.v1">
            <Rating ratingSystemID="{768BD93D-63BE-46A9-8994-0B53C4B5248F}" ratingID="{18CD34B7-7AA3-42b9-A303-5A729B2FF228}">
                <Descriptor descriptorID="{ABE23B46-7F9F-495b-B4A9-87F41743727F}"/>
                <Descriptor descriptorID="{B54162A2-F67F-46dc-9ED5-F6067520EC94}"/>
                <Descriptor descriptorID="{7E0BC004-F80B-402d-A1FC-5FCDFF04DAB1}"/>
                <Descriptor descriptorID="{BE562A5F-2A80-4c28-9752-74C696E2ABAF}"/>
            </Rating>
        </Ratings>"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"="             <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" >                 <InitializationParameters>                     <Param Name="PSVersion" Value="2.0"/>                 </InitializationParameters>                 <Resources>                     <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true">                         <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                         <Capability Type="Shell"/>                     </Resource>                 </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" >                         <InitializationParameters>                             <Param Name="PSVersion" Value="2.0"/>                         </InitializationParameters>                         <Resources>                             <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true">                                 <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                                
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#11062655000822&0#]
"DeviceDesc"="                "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_QIMONDA&REV_PMAP#07831BA00332&0#]
"DeviceDesc"="QIMONDA         "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_USB&REV_1100#AA04012700007567&0#]
"DeviceDesc"="USB             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MEMORY&PROD_USB2.0&REV_1.00#3551&0#]
"DeviceDesc"="USB2.0          "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#11062655000822&0#]
"DeviceDesc"="                "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_QIMONDA&REV_PMAP#07831BA00332&0#]
"DeviceDesc"="QIMONDA         "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_USB&REV_1100#AA04012700007567&0#]
"DeviceDesc"="USB             "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MEMORY&PROD_USB2.0&REV_1.00#3551&0#]
"DeviceDesc"="USB2.0          "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#11062655000822&0#]
"DeviceDesc"="                "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_QIMONDA&REV_PMAP#07831BA00332&0#]
"DeviceDesc"="QIMONDA         "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_INTENSO&PROD_USB&REV_1100#AA04012700007567&0#]
"DeviceDesc"="USB             "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_MEMORY&PROD_USB2.0&REV_1.00#3551&0#]
"DeviceDesc"="USB2.0          "
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"E:\Downloads\SoftonicDownloader_fuer_iringer.exe"="Softonic Downloader                             "
[HKEY_USERS\S-1-5-21-4084385078-297486338-322519695-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"E:\Downloads\SoftonicDownloader_fuer_iringer.exe"="Softonic Downloader                             "

-= EOF =-

ja ich würde den PC gern einfach platt machen und neu aufziehen aber ich hab die nächsten 2 Wochen Prüfungen und deshalb keine Zeit dafür

Ich warte dann mal auf weitere Instruktionen.

Danke!
David

10.09.2013, 14:50	#27
aharonov /// TB-Ausbilder	fbDownloader Search Behalt es mal im Auge, ob es wieder kommt. __________________ cheers, Leo

10.09.2013, 15:00	#29
aharonov /// TB-Ausbilder	fbDownloader Search Es hat sich bereits wiederhergestellt. Ich muss mal nachdenken, wie man das ganz loswird, und melde mich dann wieder. (Es ist auf jeden Fall nicht "schädlich", sondern nur nervig. Also kein Problem, den Rechner so zu nutzen.) __________________ cheers, Leo

fbDownloader Search

Plagegeister aller Art und deren Bekämpfung: fbDownloader Search