Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net

Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net


Log-Analyse und Auswertung: Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 17.09.2013, 21:09   #1
CyrusOne
 
Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net - Standard

Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net


Guten Abend allerseits.

Ich habe ein leider nicht unerhebliches Problem.
Wie in anderen Threads schon durchgekaut, habe ich Probleme mit aggressiven Werbeeinblendungen und POPUPs.
Da es aber heisst, dass man nicht blind alle Schritte in anderen Threads befolgen soll, erstelle ich hiermit einen neuen.

Mein System:
Ich nutze FireFox in der aktuellsten Version
Windows 7 Home Premium 64bit
Avira Free Antivirus
Malwarebytes AntiMalware
Die letzten beiden jedoch "klassischerweise" erst NACH dem Befall installiert. (Sorry!)
Alle Programme, OS, ... immer Up-to-date!

Die Symptome:
In FireFox werden sehr aggressive Werbungen eingeblendet und zwar in jeder freien und sogar benutzten Flächen. Diese sind oben rechts mit dem kleinen "Schliessen-X" und unten mit dem Vermerk "Ad not by this site" versehen.
Zudem klappen immer wieder PopUps auf in denen die Klassiker stehen wie "Ihr System ist verseucht", "Sie sind der 1000000 Besucher", usw.
Zudem klappen oft PopUps auf die Werbung von der Site "gqs.donedrive.net..." schalten.
Und zu guter Letzt werden in sämtlichen Texten von Websites Wörter oder Wortgruppen unterstrichen und beim darüberfahren öffnet sich ein vermeintliches Kontext-Menü mit einer vermeintlichen "Begriffserklärung" und weiteren Links die was weiss ich nicht wohin führen (nicht ausprobiert! *g*)

Ich habe Malwarebytes Anti Malware durchlaufen lassen (Quick und Vollständiger Scan), welche auch einige Fieslinge entdeckt und beseitigt hat (Log folgt weiter unten).
Nachfolgender, vollständiger Scan mit Avira hat nichts ergeben (keine Infektion festgestellt).

So, genug der langen Worte, ich hoffe die Infos waren kurz und präzise genug.
Hier noch die erstellten Logfiles:

Malwarebytes Anti Malware:
Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.13.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
CyrusMaster :: CYWARE [Administrator]

14.09.2013 01:09:18
mbam-log-2013-09-14 (01-09-18).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 247272
Laufzeit: 1 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 10
HKCR\CLSID\{11111111-1111-1111-1111-110411151154} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{44444444-4444-4444-4444-440444154454} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{55555555-5555-5555-5555-550455155554} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CrossriderApp0041554.BHO.1 (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411151154} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411151154} (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CrossriderApp0041554.BHO (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CrossriderApp0041554.Sandbox (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CrossriderApp0041554.Sandbox.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\InstalledBrowserExtensions\Lyrics (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 13
C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-bho.dll (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-bho64.dll (PUP.Optional.Lyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\AppData\Local\Temp\a2zLyrics_1060-8102_v122.exe (PUP.Optional.Adtool) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\AppData\Local\Temp\LLcVm3Vz.exe.part (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\AppData\Local\Temp\nsg9875.tmp (PUP.Optional.Somoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\AppData\Local\Temp\nslB892.tmp (PUP.Optional.Somoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\AppData\Local\Temp\p161s5eq.exe.part (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\Downloads\DTLite4471-0333.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\Downloads\FreeYouTubeDownload.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\Downloads\FreeYouTubeDownload_3.2.11.812.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\Downloads\FreeYouTubeToMP3Converter31212.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\Downloads\SoftonicDownloader_fuer_winrar.exe (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\CyrusMaster\Downloads\winamp564_full_emusic-7plus_all.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
FRST64:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by CyrusMaster (administrator) on CYWARE on 17-09-2013 20:57:40
Running from C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) c:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Windows\sysWow64\CtHdaSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2.exe
(Intel(R) Corporation) c:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe
(Tobias Erichsen) C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe
(SoftThinks SAS) C:\Program Files (x86)\AlienRespawn\sftservice.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\TOASTER.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
() C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
() C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Creative Technology Ltd) C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
(TeamSpeak Systems GmbH) C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2890000 2012-03-16] (Synaptics Incorporated)
HKLM\...\Run: [IntelPROSet] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4756240 2012-02-26] (Intel(R) Corporation)
HKLM\...\Run: [BLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [] - [x]
HKLM\...\Run: [Command Center Controllers] - C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12656 2012-06-15] (Alienware)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [7468784 2013-02-28] (Logitech Inc.)
HKCU\...\Run: [Google Update] - C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-19] (Google Inc.)
HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3551576 2013-09-17] (Electronic Arts)
MountPoints2: {32acd219-bae5-11e2-885c-606c6623e582} - G:\HTC_Sync_Manager_PC.exe
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-11-19] (Intel Corporation)
HKLM-x32\...\Run: [AlienwareOn-ScreenDisplay] - C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1636208 2011-12-02] ()
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3Di Control Panel] - c:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [880640 2011-12-22] (Creative Technology Ltd)
HKLM-x32\...\Run: [RemoteControl9] - C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [76872 2012-06-26] (cyberlink)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Integrated Webcam Live! Central] - C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe [577536 2013-01-08] (Creative Technology Ltd)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-15] (Avira Operations GmbH & Co. KG)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.alienwarearena.com/welcome-ch-g
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.alienwarearena.com/welcome-ch-g
BHO: a2zLyrics-1 - {11111111-1111-1111-1111-110411151154} - C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-bho64.dll No File
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\CyrusMaster\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\536c2ac1-a17c-4de1-a3f2-1b869a3be96c@2f6608a0-8c65-4bfe-8e2f-c65b5cc757cb.com
FF Extension: Bitdefender QuickScan - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\CyrusMaster\AppData\Roaming\Mozilla\Firefox\Profiles\acqrr591.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-15] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-15] (Avira Operations GmbH & Co. KG)
S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [242448 2012-06-26] (CyberLink)
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [122880 2012-03-28] (Creative Technology Ltd)
R2 Hamachi2Svc; C:\Program Files (x86)\Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-02] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-08-25] ()
R2 rtpMIDIService; C:\Program Files (x86)\Tobias Erichsen\rtpMIDI\rtpMIDISvc.exe [1142272 2012-08-24] (Tobias Erichsen)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-15] (Avira Operations GmbH & Co. KG)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1052760 2012-03-28] (Creative Technology Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-09-11] (DT Soft Ltd)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28216 2012-11-20] (Intel Corporation)
S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)
R3 teVirtualMIDI64; C:\Windows\System32\DRIVERS\teVirtualMIDI64.sys [30208 2012-08-15] (Tobias Erichsen)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-17 20:56 - 2013-09-17 20:56 - 00000168 _____ C:\Users\CyrusMaster\defogger_reenable
2013-09-17 20:32 - 2013-09-17 20:32 - 98008335 _____ C:\Windows\SysWOW64\偠␃蹬—
2013-09-16 20:19 - 2013-09-16 21:49 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:57 - 2013-09-15 19:56 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:57 - 2013-09-15 19:56 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-17 20:54 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 01:04 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 17:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 17:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-13 17:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-13 17:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 17:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 17:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-13 17:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 17:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-13 17:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-13 16:50 - 2013-09-13 17:17 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:44 - 2013-09-13 16:46 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-13 16:35 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-13 16:35 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-13 16:35 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-13 16:35 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-13 16:35 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-13 16:35 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-13 16:35 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-13 16:35 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-13 16:35 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-13 16:35 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-13 16:35 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-13 16:35 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-13 16:35 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-13 16:35 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-13 16:35 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 18:53 - 2009-10-11 21:58 - 01177600 _____ (AD) C:\Windows\SysWOW64\SYNSOEMU.DLL
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:09 - 2013-09-11 19:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:09 - 2013-09-11 18:52 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:09 - 2013-09-11 18:10 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:05 - 2013-09-17 20:31 - 00001838 _____ C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job
2013-09-11 18:05 - 2013-09-17 20:31 - 00001302 _____ C:\Windows\Tasks\a2zLyrics-1-updater.job
2013-09-11 18:05 - 2013-09-17 20:31 - 00001206 _____ C:\Windows\Tasks\a2zLyrics-1-codedownloader.job
2013-09-11 18:05 - 2013-09-17 20:31 - 00001106 _____ C:\Windows\Tasks\a2zLyrics-1-enabler.job
2013-09-11 18:05 - 2013-09-14 02:14 - 00000000 ____D C:\Program Files (x86)\a2zLyrics-1
2013-09-11 18:05 - 2013-09-11 18:05 - 00004332 _____ C:\Windows\System32\Tasks\a2zLyrics-1-updater
2013-09-11 18:05 - 2013-09-11 18:05 - 00004236 _____ C:\Windows\System32\Tasks\a2zLyrics-1-codedownloader
2013-09-11 18:05 - 2013-09-11 18:05 - 00004136 _____ C:\Windows\System32\Tasks\a2zLyrics-1-enabler
2013-09-11 18:03 - 2013-09-11 18:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 18:02 - 2013-09-11 18:05 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-10 22:43 - 2013-09-12 23:36 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-10 22:43 - 2013-09-12 22:27 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:42 - 2013-09-10 22:43 - 05739736 _____ (Tangysoft Ltd.                                              ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:24 - 2013-09-08 15:31 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoftIEHelpers
2013-09-01 00:28 - 2013-09-01 02:05 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-09-15 23:20 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:07 - 2013-08-28 23:08 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:00 - 2013-08-28 23:01 - 01319328 _____ (File Repair                                                 ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
2013-08-18 01:04 - 2013-08-18 01:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2013-09-17 20:57 - 2013-09-17 20:57 - 00000000 ____D C:\FRST
2013-09-17 20:56 - 2013-09-17 20:56 - 00000168 _____ C:\Users\CyrusMaster\defogger_reenable
2013-09-17 20:56 - 2013-03-19 15:10 - 00000000 ____D C:\Users\CyrusMaster
2013-09-17 20:54 - 2013-09-14 01:04 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Security
2013-09-17 20:54 - 2013-03-19 16:14 - 00000394 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-09-17 20:53 - 2013-03-23 14:00 - 00003460 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-09-17 20:53 - 2013-03-19 16:14 - 00003428 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-09-17 20:39 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-17 20:39 - 2009-07-14 06:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-17 20:38 - 2013-03-19 16:16 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA.job
2013-09-17 20:36 - 2013-03-13 09:13 - 01634892 _____ C:\Windows\WindowsUpdate.log
2013-09-17 20:34 - 2013-03-19 17:26 - 00000000 ____D C:\Program Files (x86)\Origin
2013-09-17 20:34 - 2013-03-19 16:37 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\TS3Client
2013-09-17 20:33 - 2013-05-19 01:19 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\LogMeIn Hamachi
2013-09-17 20:32 - 2013-09-17 20:32 - 98008335 _____ C:\Windows\SysWOW64\偠␃蹬—
2013-09-17 20:32 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-09-17 20:32 - 2013-03-13 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-09-17 20:32 - 2013-03-13 15:48 - 00000000 ____D C:\Program Files (x86)\AlienRespawn
2013-09-17 20:31 - 2013-09-11 18:05 - 00001838 _____ C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job
2013-09-17 20:31 - 2013-09-11 18:05 - 00001302 _____ C:\Windows\Tasks\a2zLyrics-1-updater.job
2013-09-17 20:31 - 2013-09-11 18:05 - 00001206 _____ C:\Windows\Tasks\a2zLyrics-1-codedownloader.job
2013-09-17 20:31 - 2013-09-11 18:05 - 00001106 _____ C:\Windows\Tasks\a2zLyrics-1-enabler.job
2013-09-17 20:31 - 2013-03-19 16:14 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-09-17 20:31 - 2013-03-13 15:44 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-17 20:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 20:31 - 2009-07-14 06:51 - 00060218 _____ C:\Windows\setupact.log
2013-09-16 23:05 - 2013-06-19 19:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-16 21:49 - 2013-09-16 20:19 - 00000536 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
2013-09-16 20:19 - 2013-09-16 20:19 - 00003378 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask-Delay
2013-09-16 20:19 - 2013-03-19 16:14 - 00004248 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-09-16 19:56 - 2010-11-21 05:47 - 00036772 _____ C:\Windows\PFRO.log
2013-09-15 23:20 - 2013-08-28 23:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\vlc
2013-09-15 20:02 - 2013-09-15 20:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-15 20:02 - 2013-09-15 20:02 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Avira
2013-09-15 19:58 - 2013-09-15 19:58 - 00002064 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\ProgramData\Avira
2013-09-15 19:57 - 2013-09-15 19:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-15 19:56 - 2013-09-15 19:57 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-15 19:56 - 2013-09-15 19:57 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-15 12:51 - 2013-09-15 12:51 - 00000000 ____D C:\Users\CyrusMaster\Documents\Meine empfangenen Dateien
2013-09-15 11:27 - 2013-09-15 11:27 - 00002035 _____ C:\Users\Public\Desktop\rtpMIDI.lnk
2013-09-15 11:27 - 2013-09-15 11:27 - 00000000 ____D C:\Program Files (x86)\Tobias Erichsen
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\ProgramData\Apple
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-09-15 11:26 - 2013-09-15 11:26 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-09-15 11:23 - 2013-05-19 01:47 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Tools
2013-09-14 09:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-14 08:51 - 2010-11-21 08:50 - 00723330 _____ C:\Windows\system32\perfh007.dat
2013-09-14 08:51 - 2010-11-21 08:50 - 00158332 _____ C:\Windows\system32\perfc007.dat
2013-09-14 08:51 - 2009-07-14 07:13 - 01674486 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-14 02:14 - 2013-09-11 18:05 - 00000000 ____D C:\Program Files (x86)\a2zLyrics-1
2013-09-14 01:05 - 2013-09-14 01:05 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00001107 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-14 01:04 - 2013-09-14 01:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-14 00:56 - 2013-05-19 01:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\QuickScan
2013-09-13 23:05 - 2013-06-19 19:18 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 23:05 - 2013-03-13 15:19 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 23:05 - 2013-03-13 15:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 20:02 - 2013-03-13 15:51 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-13 20:01 - 2013-03-30 11:58 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-09-13 19:45 - 2013-09-13 19:45 - 00003138 _____ C:\Windows\System32\Tasks\{EA9E473C-7A36-491D-88C7-8E479C24D828}
2013-09-13 19:40 - 2013-03-19 22:21 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 17:46 - 2013-03-19 16:14 - 00000000 ___RD C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 17:45 - 2009-07-14 06:45 - 00353112 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 17:41 - 2013-08-15 23:40 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 17:39 - 2013-04-06 12:49 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-13 17:17 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\Documents\Steuerfälle
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Information Factory
2013-09-13 16:50 - 2013-09-13 16:50 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Information Factory
2013-09-13 16:47 - 2013-09-13 16:47 - 00000000 ____D C:\Program Files (x86)\Steuer SGnP2012
2013-09-13 16:46 - 2013-09-13 16:44 - 31052352 _____ (Information Factory AG) C:\Users\CyrusMaster\Downloads\SGnP2012_installieren_windows.exe
2013-09-12 23:36 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\Documents\UseNeXT
2013-09-12 22:27 - 2013-09-10 22:43 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\UseNeXT
2013-09-11 20:22 - 2013-03-19 16:35 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2013-09-11 19:37 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Steinberg
2013-09-11 18:52 - 2013-09-11 18:09 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg Cubase 5
2013-09-11 18:51 - 2013-09-11 18:51 - 00000000 ____D C:\ProgramData\VST3 Presets
2013-09-11 18:10 - 2013-09-11 18:10 - 00002140 _____ C:\Users\CyrusMaster\Desktop\Cubase 5.lnk
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steinberg HALionOne
2013-09-11 18:10 - 2013-09-11 18:10 - 00000000 ____D C:\ProgramData\Steinberg
2013-09-11 18:10 - 2013-09-11 18:09 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-09-11 18:05 - 2013-09-11 18:05 - 00004332 _____ C:\Windows\System32\Tasks\a2zLyrics-1-updater
2013-09-11 18:05 - 2013-09-11 18:05 - 00004236 _____ C:\Windows\System32\Tasks\a2zLyrics-1-codedownloader
2013-09-11 18:05 - 2013-09-11 18:05 - 00004136 _____ C:\Windows\System32\Tasks\a2zLyrics-1-enabler
2013-09-11 18:05 - 2013-09-11 18:03 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DAEMON Tools Lite
2013-09-11 18:05 - 2013-09-11 18:02 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-09-11 18:03 - 2013-09-11 18:03 - 00283200 _____ (DT Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-09-11 18:03 - 2013-09-11 18:03 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2013-09-11 17:49 - 2013-03-19 16:16 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core.job
2013-09-10 22:43 - 2013-09-10 22:43 - 00000000 ____D C:\Program Files (x86)\UseNeXT
2013-09-10 22:43 - 2013-09-10 22:42 - 05739736 _____ (Tangysoft Ltd.                                              ) C:\Users\CyrusMaster\Downloads\UseNeXTSetup_5.53.exe
2013-09-08 15:31 - 2013-09-08 15:24 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-09-02 22:48 - 2013-05-19 01:17 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\.minecraft
2013-09-01 21:47 - 2013-05-19 01:49 - 00000000 ____D C:\Users\CyrusMaster\Downloads\Games
2013-09-01 21:27 - 2013-05-19 01:52 - 00000000 ____D C:\Games
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoft
2013-09-01 11:20 - 2013-09-01 11:12 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-01 11:12 - 2013-09-01 11:12 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\DVDVideoSoftIEHelpers
2013-09-01 02:05 - 2013-09-01 00:28 - 1479655542 _____ C:\Users\CyrusMaster\Downloads\The.Conjuring.WEBRip.MD.German.XviD-PsO.avi
2013-08-28 23:12 - 2013-08-28 23:12 - 23003252 _____ C:\Users\CyrusMaster\Downloads\vlc-2.0.8-win32.exe
2013-08-28 23:12 - 2013-08-28 23:12 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-08-28 23:08 - 2013-08-28 23:07 - 40064601 _____ C:\Users\CyrusMaster\Downloads\videorepair.zip
2013-08-28 23:01 - 2013-08-28 23:00 - 01319328 _____ (File Repair                                                 ) C:\Users\CyrusMaster\Downloads\file-repair-setup.exe
2013-08-28 22:35 - 2013-05-12 21:56 - 00005120 _____ C:\Users\CyrusMaster\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-25 23:23 - 2013-06-24 20:11 - 00000000 ____D C:\Users\CyrusMaster\AppData\Roaming\Skype
2013-08-25 16:12 - 2013-03-19 22:23 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-25 16:12 - 2013-03-19 20:01 - 00290184 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-25 16:12 - 2013-03-19 20:01 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-25 16:08 - 2013-03-19 20:01 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-25 16:00 - 2013-08-25 16:00 - 03820480 _____ C:\Users\CyrusMaster\Downloads\battlelog-web-plugins_2.1.7_115.exe
2013-08-23 21:26 - 2013-08-23 21:26 - 00000080 _____ C:\Users\CyrusMaster\Downloads\KeiNett_Launch.properties
2013-08-23 21:25 - 2013-08-23 21:25 - 00000000 ____D C:\Users\CyrusMaster\minecraft
2013-08-23 16:36 - 2013-08-23 16:36 - 02855296 _____ (MAGIX AG) C:\Users\CyrusMaster\Downloads\vita_solo_instruments_2_dlm.exe
2013-08-20 12:43 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-19 19:15 - 2013-03-30 14:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 01:04 - 2013-08-18 01:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-18 00:36 - 2013-03-20 21:54 - 00000000 ____D C:\Users\CyrusMaster\AppData\Local\Adobe

Some content of TEMP:
====================
C:\Users\CyrusMaster\AppData\Local\Temp\bitool.dll
C:\Users\CyrusMaster\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\CyrusMaster\AppData\Local\Temp\i4jdel0.exe
C:\Users\CyrusMaster\AppData\Local\Temp\install_flashplayer11x32au_mssd_aih.exe
C:\Users\CyrusMaster\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\CyrusMaster\AppData\Local\Temp\rdp2wm0h.dll
C:\Users\CyrusMaster\AppData\Local\Temp\SkypeSetup.exe
C:\Users\CyrusMaster\AppData\Local\Temp\sonarinst.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-13 20:21

==================== End Of Log ============================
FRST Additional:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-09-2013 03
Ran by CyrusMaster at 2013-09-17 20:58:16
Running from C:\Users\CyrusMaster\Downloads\Security\trojaner-board.de
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

a2zLyrics-1 (x32 Version: 1.28.153.2)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.174)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)
Advanced Audio FX Engine (x32 Version: 1.12.05)
AlienAutopsy (Version: 3.1.5907.16)
AlienRespawn - Support Software (x32 Version: 9.4.67)
AlienRespawn (x32 Version: 9.4.67)
Alienware Command Center (Version: 2.8.8.0)
Alienware Command Center (x32 Version: 2.8.8.0)
Alienware On-Screen Display (x32 Version: 0.32.0.2C)
Apple Software Update (x32 Version: 2.1.1.116)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
Battlefield 1942™ (x32 Version: 1.6.20.0)
Battlefield 3™ (x32 Version: 1.6.0.0)
Battlelog Web Plugins (x32 Version: 2.1.7)
Bonjour (Version: 2.0.2.0)
Bonjour-Druckdienste (Version: 2.0.2.0)
Command & Conquer™ 3 Tiberium Wars and Kane's Wrath (x32 Version: 1.0.0.0)
Crysis(R) (x32 Version: 1.00.0000)
Crysis® 2 (x32 Version: 1.9.0.0)
CyberLink PowerDVD 9.6 (x32 Version: 9.6.1.5425)
DAEMON Tools Lite (x32 Version: 4.47.1.0333)
Dead Island (x32)
Dota 2 Test (x32)
EMSC (x32 Version: 0.0.0.22C)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.31.0)
Free YouTube Download version 3.2.11.812 (x32 Version: 3.2.11.812)
Free YouTube to MP3 Converter version 3.12.12.827 (x32 Version: 3.12.12.827)
GameSpy Comrade (x32 Version: 1.5.0.156)
Google Chrome Canary (HKCU Version: 31.0.1632.1)
Integrated Webcam Live! Central (x32 Version: 2.01.18)
Intel PROSet Wireless
Intel(R) Management Engine Components (x32 Version: 8.0.1.1399)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.1.0.0096)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 2.1.0.0140)
Intel(R) Rapid Storage Technology (x32 Version: 11.7.0.1013)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.3.214)
Intel® PROSet/Wireless WiFi-Software (Version: 15.01.0000.0830)
Intel® Trusted Connect Service Client (Version: 1.23.219.2)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Left 4 Dead 2 (x32)
Logitech Gaming Software (Version: 8.45.88)
Logitech Gaming Software 8.45 (Version: 8.45.88)
LogMeIn Hamachi (x32 Version: 2.1.0.374)
MAGIX Burn routines (Version: 11.0.0.233)
MAGIX Content und Soundpools (x32 Version: 1.0.0.0)
MAGIX Goya burnR (MSI) (Version: 4.3.2.0)
MAGIX Goya burnR (MSI) (x32 Version: 4.3.2.0)
MAGIX Music Maker 2013 (Version: 19.0.0.29)
MAGIX Music Maker 2013 (x32 Version: 19.0.0.29)
MAGIX Music Maker 2013 Soundpools (Version: 1.0.0.0)
MAGIX Music Maker 2013 Update (Version: 19.0.6.58)
MAGIX Screenshare (Version: 4.3.6.1987)
MAGIX Screenshare (x32 Version: 4.3.6.1987)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MinecraftAlpha (x32)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
NVIDIA 3D Vision Controller-Treiber 311.06 (Version: 311.06)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Origin (x32 Version: 9.1.13.85)
PhoenixRC (x32 Version: 4.0.10)
PunkBuster Services (x32 Version: 0.986)
rtpMIDI (x32 Version: 1.0.9.225)
Skype™ 5.8 (x32 Version: 5.8.158)
Sound Blaster Recon3Di (x32 Version: 1.00.08)
Sound Blaster Recon3Di Extras (x32 Version: 1.0)
ST Microelectronics 3 Axis Digital Accelerometer Solution (x32 Version: 4.12.0018)
Steam (x32 Version: 1.0.0.0)
Steinberg Cubase 5 (x32 Version: 5.1.0)
Steinberg Drum Loop Expansion 01 (x32 Version: 1.0.0.1)
Steinberg Groove Agent ONE Content (x32 Version: 1.0.0.003)
Steinberg HALionOne (x32 Version: 1.1.0.457)
Steinberg HALionOne Additional Content Set 01 (x32 Version: 1.0.0.001)
Steinberg HALionOne Expression Set (x32 Version: 1.0.1.0)
Steinberg HALionOne GM Drum Set (x32 Version: 1.0.1.457)
Steinberg HALionOne GM Set (x32 Version: 1.0.1.457)
Steinberg HALionOne Pro Set (x32 Version: 1.0.1.457)
Steinberg HALionOne Studio Drum Set (x32 Version: 1.0.1.457)
Steinberg HALionOne Studio Set (x32 Version: 1.0.1.457)
Steinberg LoopMash Content (x32 Version: 1.0.0.005)
Steinberg REVerence Content 01 (x32 Version: 1.0.0.006)
Steuer 2012 13.0.3 (x32 Version: 13.0.3)
Streamripper (Remove only) (x32)
Synaptics Pointing Device Driver (Version: 16.0.4.0)
TeamSpeak 3 Client (x32 Version: 3.0.12)
TeamViewer 8 (x32 Version: 8.0.20935)
Text-To-Speech-Runtime (x32 Version: 1.0.0.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
UseNeXT by Tangysoft (x32)
Vita 2 (Version: 1.0.0.0)
Vita Rock Drums (Version: 1.0.0.0)
Vita String Ensemble (Version: 1.0.0.0)
VLC media player 2.0.8 (x32 Version: 2.0.8)
Winamp (x32 Version: 5.64 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

13-09-2013 15:38:47 Windows Update
13-09-2013 17:40:21 Removed MAGIX Burn routines
15-09-2013 09:26:13 Installed Bonjour Print Services
15-09-2013 09:26:52 Installed rtpMIDI

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {0515056F-8DAD-49A6-8E77-BC82FF59822D} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\AlienAutopsy\pcdrcui.exe [2011-12-14] (PC-Doctor, Inc.)
Task: {05B9C2B3-B156-43BD-A8A1-FC1EED0932D0} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\AlienAutopsy\uaclauncher.exe [2011-12-14] (PC-Doctor, Inc.)
Task: {0F107A7E-6A9F-4CD7-94EB-B9BE740D96BE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-19] (Google Inc.)
Task: {219C135A-DBB9-4401-B13B-BD3B6AFD795C} - System32\Tasks\a2zLyrics-1-enabler => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-enabler.exe
Task: {325077C2-97C3-4C30-86DD-C355D3217308} - System32\Tasks\a2zLyrics-1-updater => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-updater.exe
Task: {365653E2-0A99-41DC-BE2F-8E5C794BC415} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.)
Task: {3C8B4F65-AB3D-4D7A-8192-EFD8EC31CE8F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {4493BB8B-FD74-4F44-90D8-55FB3DF419A3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-13] (Adobe Systems Incorporated)
Task: {59BE6C7F-0487-45E1-8BB3-9423E0D5D9FD} - System32\Tasks\PCDEventLauncher => C:\Program Files\AlienAutopsy\sessionchecker.exe [2011-12-14] (PC-Doctor, Inc.)
Task: {6F19E76F-5CAC-442D-AB5D-F9C9E4E44016} - System32\Tasks\a2zLyrics-1-firefoxinstaller => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-firefoxinstaller.exe
Task: {76B9DF51-C718-40FB-8C01-F00CADAB5408} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\AlienAutopsy\uaclauncher.exe [2011-12-14] (PC-Doctor, Inc.)
Task: {B7E526F5-2373-49BC-899D-86293CEB864F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-19] (Google Inc.)
Task: {C0CA5056-549A-4EDF-915F-A50083EE9863} - System32\Tasks\a2zLyrics-1-codedownloader => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-codedownloader.exe
Task: C:\Windows\Tasks\a2zLyrics-1-codedownloader.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-codedownloader.exe
Task: C:\Windows\Tasks\a2zLyrics-1-enabler.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-enabler.exe
Task: C:\Windows\Tasks\a2zLyrics-1-firefoxinstaller.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-firefoxinstaller.exe
Task: C:\Windows\Tasks\a2zLyrics-1-updater.job => C:\Program Files (x86)\a2zLyrics-1\a2zLyrics-1-updater.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001Core.job => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2435997937-42646002-211249630-1001UA.job => C:\Users\CyrusMaster\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\AlienAutopsy\uaclauncher.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\AlienAutopsy\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\AlienAutopsy\pcdrcui.exe

==================== Loaded Modules (whitelisted) =============

2013-03-13 15:43 - 2013-01-19 09:03 - 15053264 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-03-13 15:44 - 2013-01-18 17:00 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2013-03-13 17:59 - 2012-03-16 06:12 - 00727312 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2013-03-13 17:59 - 2012-03-16 06:12 - 00229648 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2013-03-13 17:59 - 2012-03-16 06:12 - 00060688 _____ (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
2012-02-26 11:19 - 2012-02-26 11:19 - 00168448 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\PsRegApi.dll
2012-02-26 11:52 - 2012-02-26 11:52 - 00190464 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\LangResources\DEU\FrWrkDEU.dll
2012-02-26 11:33 - 2012-02-26 11:33 - 05613056 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\FrameworkPlugins\ConnMgr.dll
2012-02-26 11:54 - 2012-02-26 11:54 - 00676352 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\LangResources\DEU\IntWADEU.dll
2012-02-26 11:20 - 2012-02-26 11:20 - 00284160 _____ (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\TraceAPI.DLL
2012-02-26 11:26 - 2012-02-26 11:26 - 00545792 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\MurocApi.dll
2012-02-26 11:22 - 2012-02-26 11:22 - 00104448 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\IntStngs.dll
2012-02-26 11:18 - 2012-02-26 11:18 - 00020992 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\S24MUDLL.dll
2012-02-26 11:24 - 2012-02-26 11:24 - 01051136 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\PfMgrApi.dll
2012-02-26 11:18 - 2012-02-26 11:18 - 00102400 _____ (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\DbEngine.dll
2013-03-13 15:40 - 2013-03-13 15:40 - 00099184 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\AlienLabsTools\v4.0_2.8.8.0__bebb3c8816410241\AlienLabsTools.dll
2013-03-13 15:40 - 2013-03-13 15:40 - 00013168 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\AlienLabs.CommandCenter.RemotingService\v4.0_2.8.8.0__bebb3c8816410241\AlienLabs.CommandCenter.RemotingService.dll
2013-03-13 15:40 - 2013-03-13 15:40 - 00019824 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\AlienLabs.CommandCenter.RemotingService.Domain\v4.0_2.8.8.0__bebb3c8816410241\AlienLabs.CommandCenter.RemotingService.Domain.dll
2013-03-13 15:40 - 2013-03-13 15:40 - 00076144 _____ (Alienware) C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Alienlabs.CommandCenter.Tools\v4.0_2.8.8.0__bebb3c8816410241\Alienlabs.CommandCenter.Tools.dll
2013-03-13 15:43 - 2013-01-19 09:03 - 26929440 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.DLL
2013-08-09 18:42 - 2013-09-12 10:31 - 00362336 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Resource_de.dll
2013-05-19 01:43 - 2013-09-12 10:31 - 03031904 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_StaticRes.dll
2013-05-19 01:43 - 2013-09-12 10:22 - 00095584 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.dll
2009-12-18 18:07 - 2009-12-18 18:07 - 00577536 _____ () C:\Program Files (x86)\Alienware On-Screen Display\EMSC.dll
2010-04-02 21:12 - 2010-04-02 21:12 - 00217088 _____ (TODO: <Company name>) C:\Program Files (x86)\Alienware On-Screen Display\VistaLaterAPI.dll
2009-12-18 18:07 - 2009-12-18 18:07 - 00200704 _____ (Dell) C:\Program Files (x86)\Alienware On-Screen Display\CCBiosSupportAPI.dll
2011-09-17 04:04 - 2011-09-17 04:04 - 00238080 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTLoadRs.dll
2011-12-23 02:31 - 2011-12-23 02:31 - 00593920 _____ () C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\de-DE\SBRcni.resources.dll
2011-11-10 04:49 - 2011-11-10 04:49 - 00036864 _____ ( ) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\Interop.CTSndCr.dll
2011-10-21 02:54 - 2011-10-21 02:54 - 00249344 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\HKDetect.dll
2011-12-01 18:57 - 2011-12-01 18:57 - 00526848 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTAudEp.dll
2013-03-21 19:03 - 2011-10-18 20:08 - 00238080 ____N (Creative Technology Ltd) C:\Program Files (x86)\Integrated Webcam\Live! Central\CTLoadRs.dll
2013-03-21 19:03 - 2013-01-08 13:19 - 00055808 ____N (Creative Technology Ltd.) C:\Program Files (x86)\Integrated Webcam\Live! Central\CtPinMgr.dll
2012-01-10 06:27 - 2012-01-10 06:27 - 00064000 _____ (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTGetPdt.dll
2013-03-13 15:47 - 2012-03-28 04:52 - 00470016 _____ (Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaCtl.dll
2013-02-27 17:15 - 2013-09-11 20:22 - 00230376 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\directsound_win32.dll
2013-02-27 17:15 - 2013-09-11 20:22 - 00237032 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win32.dll
2013-02-27 17:15 - 2013-09-11 20:22 - 00159208 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\appscanner_plugin.dll
2013-02-27 17:15 - 2013-09-11 20:22 - 00431080 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\clientquery_plugin.dll
2013-09-11 20:22 - 2013-09-11 20:22 - 00555496 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 01435648 _____ (Microsoft Corporation) C:\Windows\System32\Speech\Common\sapi.dll
2013-08-18 10:13 - 2013-08-18 10:13 - 00361472 _____ (Intel Corporation) C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorUtil\f8ad6e2c79b5b7efa9117bf8bbc915c5\IAStorUtil.ni.dll
2013-07-12 09:04 - 2013-07-12 09:04 - 00026112 _____ (Intel Corp.) C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorCommon\45793e8a32d2bc1d655c276ec387212c\IAStorCommon.ni.dll
2013-08-18 01:04 - 2013-08-18 01:04 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-11 18:05 - 2013-09-11 18:05 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/17/2013 08:53:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x, Version: 6.0.5907.16, Zeitstempel: 0x4ee78569
Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.4940, Zeitstempel: 0x4ca2e32e
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000004267f
ID des fehlerhaften Prozesses: 0x167c
Startzeit der fehlerhaften Anwendung: 0xpcdrsysinfocsmi.p5x0
Pfad der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x1
Pfad des fehlerhaften Moduls: pcdrsysinfocsmi.p5x2
Berichtskennung: pcdrsysinfocsmi.p5x3

Error: (09/17/2013 08:32:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/16/2013 08:21:11 PM) (Source: Application Hang) (User: )
Description: Programm Cubase5.exe, Version 5.1.0.105 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 18cc

Startzeit: 01ceb30692d46e21

Endzeit: 15

Anwendungspfad: C:\Program Files (x86)\Steinberg\Cubase 5\Cubase5.exe

Berichts-ID: 82bb5665-1efc-11e3-baf2-606c6623e582

Error: (09/16/2013 08:14:13 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x, Version: 6.0.5907.16, Zeitstempel: 0x4ee78569
Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.4940, Zeitstempel: 0x4ca2e32e
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000004267f
ID des fehlerhaften Prozesses: 0x1754
Startzeit der fehlerhaften Anwendung: 0xpcdrsysinfocsmi.p5x0
Pfad der fehlerhaften Anwendung: pcdrsysinfocsmi.p5x1
Pfad des fehlerhaften Moduls: pcdrsysinfocsmi.p5x2
Berichtskennung: pcdrsysinfocsmi.p5x3

Error: (09/16/2013 07:57:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 07:36:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4009

Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4009

Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/15/2013 03:06:35 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2995


System errors:
=============
Error: (09/15/2013 03:06:31 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AudioEndpointBuilder erreicht.

Error: (09/15/2013 01:56:01 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (09/15/2013 10:51:50 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet: 
%%-2147196306

Error: (09/13/2013 09:13:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet: 
%%-2147196306

Error: (08/29/2013 08:47:44 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet: 
%%-2147196306

Error: (08/27/2013 08:56:53 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/25/2013 07:00:24 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "KÖNIG-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{36B6953D-B726-416E-9BF3-F3F383EA36F9}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (08/23/2013 09:19:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sound Core3D Service" ist vom Dienst "Sound Core3D(CtHda.sys)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (08/23/2013 09:19:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sound Core3D(CtHda.sys)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058

Error: (08/23/2013 09:02:38 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.


Microsoft Office Sessions:
=========================
Error: (09/17/2013 08:53:17 PM) (Source: Application Error)(User: )
Description: pcdrsysinfocsmi.p5x6.0.5907.164ee78569MSVCR90.dll9.0.30729.49404ca2e32e40000015000000000004267f167c01ceb3d729bd749bC:\Program Files\AlienAutopsy\pcdrsysinfocsmi.p5xC:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll694ba772-1fca-11e3-b571-606c6623e582

Error: (09/17/2013 08:32:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/16/2013 08:21:11 PM) (Source: Application Hang)(User: )
Description: Cubase5.exe5.1.0.10518cc01ceb30692d46e2115C:\Program Files (x86)\Steinberg\Cubase 5\Cubase5.exe82bb5665-1efc-11e3-baf2-606c6623e582

Error: (09/16/2013 08:14:13 PM) (Source: Application Error)(User: )
Description: pcdrsysinfocsmi.p5x6.0.5907.164ee78569MSVCR90.dll9.0.30729.49404ca2e32e40000015000000000004267f175401ceb3088a5cdccaC:\Program Files\AlienAutopsy\pcdrsysinfocsmi.p5xC:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllca3427a2-1efb-11e3-baf2-606c6623e582

Error: (09/16/2013 07:57:39 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 07:36:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4009

Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4009

Error: (09/15/2013 03:06:36 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/15/2013 03:06:35 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2995


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 12238.31 MB
Available physical RAM: 9461.76 MB
Total Pagefile: 24474.81 MB
Available Pagefile: 21178.91 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:456.98 GB) (Free:247.86 GB) NTFS
Drive d: (DATAPART1) (Fixed) (Total:29.81 GB) (Free:15.41 GB) NTFS
Drive e: (HOBBIT_PART1) (CDROM) (Total:38.71 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: D6A2CF77)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=457 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 30 GB) (Disk ID: D6A2C3F3)
Partition 1: (Not Active) - (Size=30 GB) - (Type=07 NTFS)

==================== End Of Log ============================
GMER:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-17 21:20:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000079 ATA_____ rev.DEM1 465.76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\CYRUSM~1\AppData\Local\Temp\uwldqpow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                                                                                           0000000071af1a22 2 bytes [AF, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                                                                                           0000000071af1ad0 2 bytes [AF, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                                                                                           0000000071af1b08 2 bytes [AF, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                                                                                           0000000071af1bba 2 bytes [AF, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                                                                                           0000000071af1bda 2 bytes [AF, 71]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                    00000000759b1465 2 bytes [9B, 75]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                   00000000759b14bb 2 bytes [9B, 75]
.text  ...                                                                                                                                                                                                                               * 2
.text  C:\Program Files (x86)\AlienRespawn\sftservice.EXE[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  00000000759b1465 2 bytes [9B, 75]
.text  C:\Program Files (x86)\AlienRespawn\sftservice.EXE[2964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                 00000000759b14bb 2 bytes [9B, 75]
.text  ...                                                                                                                                                                                                                               * 2
.text  C:\Program Files (x86)\AlienRespawn\TOASTER.EXE[2872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                     00000000759b1465 2 bytes [9B, 75]
.text  C:\Program Files (x86)\AlienRespawn\TOASTER.EXE[2872] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                    00000000759b14bb 2 bytes [9B, 75]
.text  ...                                                                                                                                                                                                                               * 2
.text  C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                 00000000759b1465 2 bytes [9B, 75]
.text  C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                00000000759b14bb 2 bytes [9B, 75]
.text  ...                                                                                                                                                                                                                               * 2
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                      00000000759b1465 2 bytes [9B, 75]
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                     00000000759b14bb 2 bytes [9B, 75]
.text  ...                                                                                                                                                                                                                               * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                            00000000759b1465 2 bytes [9B, 75]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                           00000000759b14bb 2 bytes [9B, 75]
.text  ...                                                                                                                                                                                                                               * 2

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{476981B4-465E-4BAD-88A6-45BFF31178C9}\Connection@Name                                                                                       isatap.{BABB2170-0770-4718-B3E0-96AF5DE5D263}
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}\Connection@Name                                                                                       isatap.{EBA8E956-5B75-4004-947A-7E0ED45A6888}
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind                                                                                          \Device\{F7921434-4A93-414E-B5A1-3D1AE25A7861}?\Device\{4DCBAB5A-7E96-45F1-A702-C4061B9902FF}?\Device\{90B264F9-62A3-4E32-9022-F40BC78F6F7A}?\Device\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}?\Device\{476981B4-465E-4BAD-88A6-45BFF31178C9}?\Device\{4F8AE80C-60DF-4A0E-A1B1-E1D7572D5552}?
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route                                                                                         "{F7921434-4A93-414E-B5A1-3D1AE25A7861}"?"{4DCBAB5A-7E96-45F1-A702-C4061B9902FF}"?"{90B264F9-62A3-4E32-9022-F40BC78F6F7A}"?"{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}"?"{476981B4-465E-4BAD-88A6-45BFF31178C9}"?"{4F8AE80C-60DF-4A0E-A1B1-E1D7572D5552}"?
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export                                                                                        \Device\TCPIP6TUNNEL_{F7921434-4A93-414E-B5A1-3D1AE25A7861}?\Device\TCPIP6TUNNEL_{4DCBAB5A-7E96-45F1-A702-C4061B9902FF}?\Device\TCPIP6TUNNEL_{90B264F9-62A3-4E32-9022-F40BC78F6F7A}?\Device\TCPIP6TUNNEL_{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}?\Device\TCPIP6TUNNEL_{476981B4-465E-4BAD-88A6-45BFF31178C9}?\Device\TCPIP6TUNNEL_{4F8AE80C-60DF-4A0E-A1B1-E1D7572D5552}?
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\606c6623e582                                                                                                                                                       
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\606c6623e582@8c77125caffd                                                                                                                                          0x42 0xF4 0x3F 0x35 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{476981B4-465E-4BAD-88A6-45BFF31178C9}@InterfaceName                                                                                                            isatap.{BABB2170-0770-4718-B3E0-96AF5DE5D263}
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{476981B4-465E-4BAD-88A6-45BFF31178C9}@ReusableType                                                                                                             0
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}@InterfaceName                                                                                                            isatap.{EBA8E956-5B75-4004-947A-7E0ED45A6888}
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{644AC0C5-A664-4543-9DDF-9C6DAF1EB6AE}@ReusableType                                                                                                             0
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\606c6623e582 (not active ControlSet)                                                                                                                                   
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\606c6623e582@8c77125caffd                                                                                                                                              0x42 0xF4 0x3F 0x35 ...
Reg    HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\CyrusMaster\Downloads\Games\Minecraft-crack-1.0.0\Minecraft Cracken\Deadly\xb4s Minecraft Alpha Custom Installer.exe  1

---- EOF - GMER 2.1 ----
So, ich hoffe ich habe alles wie gewünscht zusammengetragen.

Ich bedanke mich im Voraus herzlichst für die Hilfe und verbleibe indessen mit freundlichen Grüssen
Sandro

 

Themen zu Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net
4d36e972-e325-11ce-bfc1-08002be10318, adobe, alienware, bonjour, computer, converter, cubase, defender, desktop, device driver, dvdvideosoft ltd., farbar, farbar recovery scan tool, firefox, flash player, klassiker, launch, origin, plug-in, popups, präzise, pup.optional.adtool, pup.optional.crossrider.a, pup.optional.lyrics.a, pup.optional.opencandy, pup.optional.softonic, pup.optional.somoto.a, registry, security, services.exe, software, svchost.exe, system, teamspeak, tunnel, unterstrichen


« C:\Programm Files\HomeTab\TBUpdater.dll erscheint beim Win7 Start | Donedrive.net....unterstrichene Wörter und hässliche pop-up fenster »


Ähnliche Themen: Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net


  1. AD by Browser Extension; Viele Popups
    Plagegeister aller Art und deren Bekämpfung - 06.05.2014 (2)
  2. Im IE und firefox ist Startseite Nationzoom.com und nicht veränderbar, viele popups
    Log-Analyse und Auswertung - 22.03.2014 (17)
  3. Mozilla firefox: viele Popups (Werbung, updates), related search sites bei jeder neu geöffneten Internetseite
    Log-Analyse und Auswertung - 16.01.2014 (10)
  4. windows 7 (starter) - Werbeeinblendungen und popups im browser
    Plagegeister aller Art und deren Bekämpfung - 03.10.2013 (17)
  5. Ständig aggressive Werbung und Pop-Ups
    Plagegeister aller Art und deren Bekämpfung - 30.09.2013 (9)
  6. Ebenfalls (PopUps & ads im Browser von gqs.donedrive.net )
    Log-Analyse und Auswertung - 19.09.2013 (9)
  7. PopUps & ads im Browser von gqs.donedrive.net
    Log-Analyse und Auswertung - 16.09.2013 (17)
  8. Permanente Werbeeinblednungen und PopUps - gqs.donedrive.net und andere
    Log-Analyse und Auswertung - 13.09.2013 (16)
  9. https://gqs.donedrive.net popups öffnen ständig
    Log-Analyse und Auswertung - 07.09.2013 (13)
  10. gqs.donedrive.net popups öffnen ständig
    Log-Analyse und Auswertung - 05.09.2013 (11)
  11. https://gqs.donedrive.net popups öffnen ständig
    Plagegeister aller Art und deren Bekämpfung - 02.09.2013 (15)
  12. Google, FB startet nicht, Delta Search vor einer Woche bereits deinstalliert, ungewollte Werbeeinblendungen ebenfalls bereits deinstalliert
    Plagegeister aller Art und deren Bekämpfung - 27.02.2013 (7)
  13. Ebenfalls IE-Popups, Trojanermeldungen
    Log-Analyse und Auswertung - 05.08.2008 (13)
  14. Bitte um Hilfe! Ebenfalls WSNPOEM Trojaner wie viele!
    Plagegeister aller Art und deren Bekämpfung - 11.11.2007 (12)
  15. Viele Popups auf Geschäftsrechner!
    Log-Analyse und Auswertung - 09.08.2007 (11)
  16. problem: viele neue popups
    Log-Analyse und Auswertung - 27.10.2005 (2)
  17. Viele Popups und Firewall Meldungen
    Plagegeister aller Art und deren Bekämpfung - 03.06.2005 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net - Guten Abend allerseits. Ich habe ein leider nicht unerhebliches Problem. Wie in anderen Threads schon durchgekaut, habe ich Probleme mit aggressiven Werbeeinblendungen und POPUPs. Da es aber heisst, dass man - Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net...
Archiv
Du betrachtest: Aggressive Werbeeinblendungen und POPUPs, ebenfalls viele von gqs.donedrive.net auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131