Trojaner MacroMedia.exe "Coin-Miner"

aharonov · 04.10.2013, 19:04

Zitat:

In den abgesicherten modus komm ich noch

Ok, dann hol dort bitte das MBAM-Log raus und poste es hier, um zu sehen, was gelöscht wurde. Das findest du so: http://www.trojaner-board.de/125889-...en-posten.html

Danach mach im abgesicherten Modus einen neuen FRST-Scan:

Starte noch einmal FRST.

Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

SyRoX · 04.10.2013, 19:04

In den abgesicherten modus komm ich rein

aharonov · 04.10.2013, 19:04

Siehe oben.

SyRoX · 04.10.2013, 19:05

Sag mir bitte wie ich dass mache kenns mich da nicht so aus

aharonov · 04.10.2013, 19:07

Gehe in den "abgesicherten Modus mit Netzwerktreibern", starte dort MBAM und finde das Log wie auf nachfolgendem Bild angezeigt. Dann poste den Inhalt des Logs hier in den Thread.

SyRoX · 04.10.2013, 19:11

Wenn ich im abgesicherten modus bin habe ich aber auch einen blackscreen

Task manager komm ich noch rein

Wenn ich im abgesicherten bin.habe ich aber nur ein blackscreen

aharonov · 04.10.2013, 19:11

Du hast doch geschrieben:

Zitat:

In den abgesicherten komm ich

In den abgesicherten modus komm ich noch

Nach dem abgesicherten modus komm ich noch rein

aharonov · 04.10.2013, 19:12

Dann anders:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

SyRoX · 04.10.2013, 19:36

Ich geh auf abgesicherten dann lädt er auch oben rechts unten links und oben steht überall abgesicherter modus aber ein blackscreen

Der Scan

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MININT-2CIK4HC on 04-10-2013 20:34:14
Running from G:\
Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Run: [svchost] - "C:\ProgramData\win0\bpvttlpxh.exe"
HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\Runonce: [ Malwarebytes Anti-Malware  (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
HKLM\...\Winlogon: [Shell] Explorer.exe [x ] ()
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\FLO\...\Run: [Steam] - "D:\Program Files\Steam\steam.exe" -silent
HKU\FLO\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)
HKU\FLO\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2013-03-28] (AMD)
HKU\FLO\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [ 2013-08-22] (Overwolf)
HKU\FLO\...\Run: [svchost] - C:\Users\FLO\AppData\Roaming\WINSX\winfvc.exe [ 2013-09-26] (IKARUS Security)

========================== Services (Whitelisted) =================

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)
S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)

==================== Drivers (Whitelisted) ====================

S2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)
S3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)
S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-04 07:35 - 2013-10-04 07:35 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-04 07:35 - 2013-10-04 07:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes
2013-10-04 07:34 - 2013-10-04 07:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe
2013-10-04 07:33 - 2013-10-04 07:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe
2013-10-04 07:33 - 2013-10-04 07:33 - 00000000 ____D C:\Program Files\ESET
2013-10-04 07:27 - 2013-10-04 07:27 - 01087213 _____ (Farbar) C:\Users\FLO\Desktop\FRST (1).exe
2013-10-03 15:32 - 2013-10-03 15:32 - 11935034 _____ C:\Users\FLO\Downloads\AC-MUV3.5.rar
2013-10-03 15:13 - 2013-10-03 15:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe
2013-10-03 09:37 - 2013-10-03 09:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-03 08:17 - 2013-10-03 08:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe
2013-10-03 08:10 - 2013-10-03 08:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe
2013-10-03 07:35 - 2013-10-03 07:35 - 00038025 _____ C:\Users\FLO\Downloads\FRST.txt
2013-10-02 18:25 - 2013-10-02 18:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 16:58 - 2013-10-02 16:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 16:11 - 2013-10-02 16:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 16:04 - 2013-10-04 07:31 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-02 16:04 - 2013-10-02 16:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 16:02 - 2013-10-02 16:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 15:27 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-02 15:27 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-02 15:27 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-02 15:27 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-02 15:27 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-02 15:27 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-02 15:27 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-02 15:27 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-02 15:16 - 2013-10-02 16:59 - 00000000 ____D C:\Qoobox
2013-10-02 15:15 - 2013-10-02 15:54 - 00000000 ____D C:\Windows\erdnt
2013-10-02 15:13 - 2013-10-02 15:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 15:10 - 2013-10-04 17:49 - 00003080 _____ C:\Windows\setupact.log
2013-10-02 15:10 - 2013-10-02 15:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 15:09 - 2013-10-04 07:51 - 00010908 _____ C:\Windows\PFRO.log
2013-10-02 14:58 - 2013-10-02 15:08 - 00000000 ____D C:\AdwCleaner
2013-10-02 14:58 - 2013-10-02 14:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 14:50 - 2013-10-02 14:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 14:49 - 2013-10-04 07:30 - 00000000 ____D C:\FRST
2013-10-02 14:47 - 2013-10-02 14:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 14:29 - 2013-10-02 14:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 14:19 - 2013-10-02 14:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 14:17 - 2013-10-02 14:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 14:09 - 2013-10-04 07:35 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 14:09 - 2013-10-02 14:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 14:09 - 2013-04-04 13:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-10-02 14:07 - 2013-10-02 14:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 13:24 - 2013-07-17 21:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk
2013-10-02 13:24 - 2013-05-17 14:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url
2013-10-02 13:17 - 2013-10-02 13:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 11:59 - 2013-10-02 12:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 11:57 - 2013-10-02 11:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 10:24 - 2013-10-02 10:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 09:47 - 2013-10-02 09:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 09:42 - 2013-10-02 09:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 09:41 - 2013-10-02 09:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 09:41 - 2013-10-02 09:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 09:41 - 2013-10-02 09:41 - 00000000 ____D C:\Game5
2013-10-02 09:37 - 2013-10-02 09:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 09:36 - 2013-10-03 09:37 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 09:34 - 2013-10-02 09:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-01 12:31 - 2013-10-01 12:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-09-29 19:17 - 2013-09-29 19:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-27 15:23 - 2013-09-27 15:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 14:51 - 2013-09-26 14:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 13:49 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-26 13:49 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-26 13:49 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-26 13:49 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-26 13:49 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-26 13:49 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-26 13:49 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-26 13:39 - 2013-09-26 13:45 - 00000000 ____D C:\Windows\System32\MRT
2013-09-26 13:38 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-09-26 13:38 - 2013-07-09 05:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-09-26 13:38 - 2013-07-09 05:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-09-26 13:38 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-09-26 13:38 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-09-26 13:38 - 2013-07-06 06:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-09-26 13:37 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-26 13:37 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-26 13:37 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-26 13:37 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-26 13:37 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 13:37 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 13:37 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-26 13:37 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-26 13:37 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-09-26 13:37 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-09-26 13:37 - 2013-07-09 06:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-09-26 13:37 - 2013-07-09 06:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-09-26 13:37 - 2013-07-09 05:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-09-26 13:36 - 2013-06-15 04:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-09-26 12:44 - 2013-09-26 12:44 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSX
2013-09-24 19:34 - 2013-09-24 19:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 19:33 - 2013-09-24 19:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-19 14:12 - 2013-09-19 14:12 - 00059023 _____ C:\Windows\System32\CCCInstall_201309191512339893.log
2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-13 19:52 - 2013-09-13 19:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 17:18 - 2013-09-13 17:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-08 19:31 - 2013-09-08 19:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 19:31 - 2013-09-08 19:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 02:51 - 2013-09-05 02:51 - 00038912 _____ C:\Windows\System32\kdbsdk32.dll

==================== One Month Modified Files and Folders =======

2013-10-04 19:26 - 2013-04-13 13:04 - 00000000 ____D C:\users\FLO
2013-10-04 17:56 - 2009-07-14 05:34 - 00021088 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-04 17:56 - 2009-07-14 05:34 - 00021088 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-04 17:52 - 2013-04-13 12:59 - 01316127 _____ C:\Windows\WindowsUpdate.log
2013-10-04 17:49 - 2013-10-02 15:10 - 00003080 _____ C:\Windows\setupact.log
2013-10-04 17:49 - 2013-07-15 11:56 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-10-04 17:09 - 2009-07-14 05:34 - 00012288 _____ C:\Windows\System32\umstartup.etl
2013-10-04 16:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2013-10-04 10:32 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-10-04 07:51 - 2013-10-02 15:09 - 00010908 _____ C:\Windows\PFRO.log
2013-10-04 07:51 - 2013-07-15 09:29 - 00000000 __SHD C:\ProgramData\win0
2013-10-04 07:51 - 2013-04-13 13:55 - 00000000 ____D C:\Windows\Panther
2013-10-04 07:45 - 2010-11-20 22:01 - 01616098 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-04 07:35 - 2013-10-04 07:35 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-04 07:35 - 2013-10-04 07:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes
2013-10-04 07:35 - 2013-10-02 14:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-04 07:34 - 2013-10-04 07:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe
2013-10-04 07:33 - 2013-10-04 07:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe
2013-10-04 07:33 - 2013-10-04 07:33 - 00000000 ____D C:\Program Files\ESET
2013-10-04 07:31 - 2013-10-02 16:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-04 07:31 - 2013-04-18 13:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype
2013-10-04 07:30 - 2013-10-02 14:49 - 00000000 ____D C:\FRST
2013-10-04 07:27 - 2013-10-04 07:27 - 01087213 _____ (Farbar) C:\Users\FLO\Desktop\FRST (1).exe
2013-10-04 07:19 - 2013-06-03 19:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps
2013-10-03 16:38 - 2013-04-18 15:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client
2013-10-03 15:32 - 2013-10-03 15:32 - 11935034 _____ C:\Users\FLO\Downloads\AC-MUV3.5.rar
2013-10-03 15:13 - 2013-10-03 15:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe
2013-10-03 09:37 - 2013-10-03 09:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-03 09:37 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-03 08:17 - 2013-10-03 08:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe
2013-10-03 08:10 - 2013-10-03 08:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe
2013-10-03 07:35 - 2013-10-03 07:35 - 00038025 _____ C:\Users\FLO\Downloads\FRST.txt
2013-10-02 18:25 - 2013-10-02 18:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 16:59 - 2013-10-02 15:16 - 00000000 ____D C:\Qoobox
2013-10-02 16:58 - 2013-10-02 16:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 16:57 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-02 16:53 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-10-02 16:11 - 2013-10-02 16:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 16:11 - 2013-10-02 16:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 16:04 - 2013-10-02 16:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 16:04 - 2013-10-02 16:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 15:59 - 2009-07-14 03:37 - 00000000 __RHD C:\users\Default
2013-10-02 15:59 - 2009-07-14 03:37 - 00000000 ___RD C:\users\Public
2013-10-02 15:54 - 2013-10-02 15:15 - 00000000 ____D C:\Windows\erdnt
2013-10-02 15:13 - 2013-10-02 15:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 15:10 - 2013-10-02 15:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 15:08 - 2013-10-02 14:58 - 00000000 ____D C:\AdwCleaner
2013-10-02 14:58 - 2013-10-02 14:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 14:51 - 2013-10-02 14:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 14:47 - 2013-10-02 14:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 14:29 - 2013-10-02 14:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 14:19 - 2013-10-02 14:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 14:17 - 2013-10-02 14:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 14:09 - 2013-10-02 14:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 14:09 - 2013-10-02 14:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 13:34 - 2013-06-20 18:18 - 00000000 ____D C:\Program Files\Paint.NET
2013-10-02 13:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-02 13:33 - 2013-08-08 11:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-10-02 13:33 - 2013-04-19 16:53 - 00000000 ____D C:\Windows\Minidump
2013-10-02 13:25 - 2011-04-12 02:39 - 00000000 ____D C:\Windows\ShellNew
2013-10-02 13:17 - 2013-10-02 13:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 12:08 - 2013-10-02 11:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 11:57 - 2013-10-02 11:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 11:56 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-10-02 10:24 - 2013-10-02 10:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 09:47 - 2013-10-02 09:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 09:43 - 2013-10-02 09:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 09:43 - 2013-10-02 09:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 09:42 - 2013-10-02 09:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 09:41 - 2013-10-02 09:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 09:41 - 2013-10-02 09:41 - 00000000 ____D C:\Game5
2013-10-02 09:39 - 2013-04-14 17:15 - 00000000 ____D C:\ProgramData\Adobe
2013-10-02 09:38 - 2013-10-02 09:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 09:38 - 2013-04-14 17:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe
2013-10-02 09:37 - 2013-10-02 09:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-01 12:36 - 2013-10-01 12:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-10-01 10:48 - 2013-04-13 13:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla
2013-09-29 19:20 - 2013-09-29 19:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-28 19:21 - 2013-04-13 13:22 - 00000000 ____D C:\Program Files\ATI Technologies
2013-09-27 15:23 - 2013-09-27 15:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 18:54 - 2013-04-14 17:18 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-09-26 14:53 - 2013-06-15 09:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google
2013-09-26 14:53 - 2013-06-15 09:23 - 00000000 ____D C:\Program Files\Google
2013-09-26 14:52 - 2013-09-26 14:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 14:20 - 2009-07-14 05:33 - 00268272 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-26 14:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-26 13:45 - 2013-09-26 13:39 - 00000000 ____D C:\Windows\System32\MRT
2013-09-26 12:44 - 2013-09-26 12:44 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSX
2013-09-24 19:34 - 2013-09-24 19:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 19:34 - 2013-09-24 19:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-19 14:12 - 2013-09-19 14:12 - 00059023 _____ C:\Windows\System32\CCCInstall_201309191512339893.log
2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 14:12 - 2013-09-19 14:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-19 14:12 - 2013-04-13 13:29 - 00000000 ____D C:\ProgramData\AMD
2013-09-19 14:04 - 2013-04-13 13:27 - 00000000 ____D C:\AMD
2013-09-16 14:22 - 2013-05-10 17:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M
2013-09-13 19:52 - 2013-09-13 19:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 17:17 - 2013-09-13 17:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-12 05:27 - 2013-07-17 12:32 - 00000000 ____D C:\Windows\System32\Extensions
2013-09-11 16:48 - 2013-07-17 12:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft
2013-09-08 19:49 - 2013-09-08 19:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 19:42 - 2013-09-08 19:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 02:51 - 2013-09-05 02:51 - 00038912 _____ C:\Windows\System32\kdbsdk32.dll

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

1
Restore point made on: 2013-10-04 18:19:44

==================== Memory info =========================== 

Percentage of memory in use: 12%
Total physical RAM: 4094.49 MB
Available physical RAM: 3576.97 MB
Total Pagefile: 4092.78 MB
Available Pagefile: 3571.37 MB
Total Virtual: 2047.88 MB
Available Virtual: 1944.69 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:48.73 GB) (Free:24.81 GB) NTFS
Drive e: (FLO) (Fixed) (Total:184.06 GB) (Free:49.69 GB) NTFS
Drive g: () (Removable) (Total:14.83 GB) (Free:10.26 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: F3246542)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=49 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=184 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2013-10-02 16:50

==================== End Of Log ============================

--- --- ---

--- --- ---

aharonov · 04.10.2013, 23:46

Tatsächlich, da ist die explorer.exe flöten gegangen.. Ohne die bleibts natürlich dunkel..
Wir müssen einen Ersatz finden:

Starte FRST wieder wie zuvor in den Reperaturoptionen.
Gib dann folgendes in die Search: Box von FRST ein:
Code:
ATTFilter
```
explorer.exe
         
```
und drücke auf Search File(s).
FRST erstellt nach Ablauf des Scans eine Logdatei Search.txt auf dem USB-Stick.
Poste deren Inhalt bitte hier.

SyRoX · 05.10.2013, 07:19

Werde es gleich nach dem aufstehen machen! Wie kann denn die explorer exe flöten gehen? Habe ichvetwas falsch gemacht ?

Code:

ATTFilter

Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by SYSTEM at 2013-10-05 08:11:11
Running from G:\
Boot Mode: Recovery

================== Search: "explorer.exe" ===================

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2013-04-13 14:09] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2013-04-13 14:09] - [2011-02-25 06:30] - 2616320 ____N (Microsoft Corporation) 8B88EBBB05A0E56B7DCC708498C02B3E

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2010-11-20 22:29] - [2010-11-20 22:29] - 2616320 ____A (Microsoft Corporation) 40D777B7A95E00593EB1568C68514493

C:\Windows\erdnt\cache\explorer.exe
[2013-10-02 15:54] - [2011-02-25 06:30] - 2616320 ____A (Microsoft Corporation) 8B88EBBB05A0E56B7DCC708498C02B3E

=== End Of Search ===

aharonov · 05.10.2013, 10:29

Zitat:

Wie kann denn die explorer exe flöten gehen? Habe ichvetwas falsch gemacht ?

Ich kann dir im Moment noch nicht sagen, wie und wo das passiert ist..

Mach bitte folgenden Fix. Kannst du den Rechner danach wieder normal starten? Falls ja, dann suche und poste ebenfalls das MBAM-Log wie oben angegeben. (Und ebenfalls das alte FRST-Fixlog, welches du vor dem MBAM-Scan erstellt hast.)

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Replace: C:\Windows\erdnt\cache\explorer.exe C:\Windows\explorer.exe
HKLM\...\Run: [svchost] - "C:\ProgramData\win0\bpvttlpxh.exe"
C:\ProgramData\win0
HKU\FLO\...\Run: [svchost] - C:\Users\FLO\AppData\Roaming\WINSX\winfvc.exe [ 2013-09-26] (IKARUS Security)
C:\Users\FLO\AppData\Roaming\WINSX

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

SyRoX · 05.10.2013, 12:52

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by SYSTEM at 2013-10-05 13:43:01 Run:2
Running from G:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
Replace: C:\Windows\erdnt\cache\explorer.exe C:\Windows\explorer.exe
HKLM\...\Run: [svchost] - "C:\ProgramData\win0\bpvttlpxh.exe"
C:\ProgramData\win0
HKU\FLO\...\Run: [svchost] - C:\Users\FLO\AppData\Roaming\WINSX\winfvc.exe [ 2013-09-26] (IKARUS Security)
C:\Users\FLO\AppData\Roaming\WINSX
*****************

Could not find C:\Windows\explorer.exe
C:\Windows\erdnt\cache\explorer.exe copied successfully to C:\Windows\explorer.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\svchost => Value deleted successfully.
C:\ProgramData\win0 => Moved successfully.
HKU\FLO\Software\Microsoft\Windows\CurrentVersion\Run\\svchost => Value deleted successfully.
C:\Users\FLO\AppData\Roaming\WINSX => Moved successfully.

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by FLO (administrator) on FLO-PC on 05-10-2013 13:51:37
Running from C:\Users\FLO\Downloads
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) D:\Program Files\Steam\Steam.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)
HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35256 2013-08-22] (Overwolf)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.13.1

FireFox:
========
FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0
CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)
R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)
S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-05 14:43 - 2011-02-25 07:30 - 02616320 ____N (Microsoft Corporation) C:\Windows\explorer.exe
2013-10-04 08:35 - 2013-10-04 08:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes
2013-10-04 08:34 - 2013-10-04 08:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe
2013-10-04 08:33 - 2013-10-04 08:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe
2013-10-04 08:33 - 2013-10-04 08:33 - 00000000 ____D C:\Program Files\ESET
2013-10-03 16:13 - 2013-10-03 16:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe
2013-10-03 10:37 - 2013-10-03 10:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-03 09:17 - 2013-10-03 09:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe
2013-10-03 09:10 - 2013-10-03 09:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe
2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 17:04 - 2013-10-05 13:45 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 17:02 - 2013-10-02 17:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 16:27 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-02 16:27 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-02 16:27 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-02 16:16 - 2013-10-02 17:59 - 00000000 ____D C:\Qoobox
2013-10-02 16:15 - 2013-10-02 16:54 - 00000000 ____D C:\Windows\erdnt
2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 16:10 - 2013-10-05 13:44 - 00003248 _____ C:\Windows\setupact.log
2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 16:09 - 2013-10-04 08:51 - 00010908 _____ C:\Windows\PFRO.log
2013-10-02 15:58 - 2013-10-02 16:08 - 00000000 ____D C:\AdwCleaner
2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 15:50 - 2013-10-02 15:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 15:49 - 2013-10-04 08:30 - 00000000 ____D C:\FRST
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-04 08:35 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk
2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-03 10:37 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

==================== One Month Modified Files and Folders =======

2013-10-05 13:51 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-05 13:51 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-05 13:45 - 2013-10-02 17:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-05 13:45 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype
2013-10-05 13:44 - 2013-10-02 16:10 - 00003248 _____ C:\Windows\setupact.log
2013-10-05 13:44 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-05 13:44 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-05 13:44 - 2013-04-13 14:04 - 00000000 ____D C:\Users\FLO
2013-10-05 13:44 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-05 13:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing
2013-10-04 19:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-04 18:52 - 2013-04-13 13:59 - 01321102 _____ C:\Windows\WindowsUpdate.log
2013-10-04 18:09 - 2009-07-14 06:34 - 00012288 _____ C:\Windows\system32\umstartup.etl
2013-10-04 11:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\LogFiles
2013-10-04 08:51 - 2013-10-02 16:09 - 00010908 _____ C:\Windows\PFRO.log
2013-10-04 08:51 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther
2013-10-04 08:45 - 2010-11-20 23:01 - 01616098 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-04 08:35 - 2013-10-04 08:35 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Malwarebytes
2013-10-04 08:35 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-04 08:34 - 2013-10-04 08:34 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (2).exe
2013-10-04 08:33 - 2013-10-04 08:33 - 02347384 _____ (ESET) C:\Users\FLO\Downloads\esetsmartinstaller_enu.exe
2013-10-04 08:33 - 2013-10-04 08:33 - 00000000 ____D C:\Program Files\ESET
2013-10-04 08:30 - 2013-10-02 15:49 - 00000000 ____D C:\FRST
2013-10-04 08:19 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps
2013-10-03 17:38 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client
2013-10-03 16:13 - 2013-10-03 16:13 - 00030208 _____ C:\Users\FLO\Desktop\MW3 MP FPS Unlocker.exe
2013-10-03 10:37 - 2013-10-03 10:37 - 00002010 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-03 10:37 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-03 09:17 - 2013-10-03 09:17 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader (1).exe
2013-10-03 09:13 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-03 09:10 - 2013-10-03 09:10 - 00792704 _____ (AMD) C:\Users\FLO\Downloads\amddriverdownloader.exe
2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 17:59 - 2013-10-02 16:16 - 00000000 ____D C:\Qoobox
2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 17:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-02 17:53 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 17:04 - 2013-10-02 17:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-10-02 16:54 - 2013-10-02 16:15 - 00000000 ____D C:\Windows\erdnt
2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 16:08 - 2013-10-02 15:58 - 00000000 ____D C:\AdwCleaner
2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 15:51 - 2013-10-02 15:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET
2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump
2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe
2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla
2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google
2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD
2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD
2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions
2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft
2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-02 17:50

==================== End Of Log ============================

--- --- ---

--- --- ---

aharonov · 05.10.2013, 13:15

Kannst du jetzt bitte noch das Log von MBAM suchen und hier posten wie folgt.
Danach hier weiter machen mit Schritt 3.

SyRoX · 05.10.2013, 16:53

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.04.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16686
FLO :: FLO-PC [Administrator]

Schutz: Aktiviert

04.10.2013 08:43:24
mbam-log-2013-10-04 (08-43-24).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 193596
Laufzeit: 6 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\ProgramData\win0\bpvttlpxh.exe (Backdoor.Bot) -> 3624 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|svchost (Backdoor.Bot) -> Daten: \Windows\Explorer.exe -> Löschen bei Neustart.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|svchost (Backdoor.Bot) -> Daten: "C:\ProgramData\win0\bpvttlpxh.exe" -> Löschen bei Neustart.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
\Windows\explorer.exe (Backdoor.Bot) -> Löschen bei Neustart.
C:\ProgramData\win0\bpvttlpxh.exe (Backdoor.Bot) -> Löschen bei Neustart.

(Ende)

04.10.2013, 19:04	#18
aharonov /// TB-Ausbilder	Trojaner MacroMedia.exe "Coin-Miner" Siehe oben. __________________ __________________

04.10.2013, 19:07	#20
aharonov /// TB-Ausbilder	Trojaner MacroMedia.exe "Coin-Miner" Gehe in den "abgesicherten Modus mit Netzwerktreibern", starte dort MBAM und finde das Log wie auf nachfolgendem Bild angezeigt. Dann poste den Inhalt des Logs hier in den Thread. __________________ cheers, Leo

05.10.2013, 13:15	#29
aharonov /// TB-Ausbilder	Trojaner MacroMedia.exe "Coin-Miner" Kannst du jetzt bitte noch das Log von MBAM suchen und hier posten wie folgt. Danach hier weiter machen mit Schritt 3. __________________ cheers, Leo

Trojaner MacroMedia.exe "Coin-Miner"

Log-Analyse und Auswertung: Trojaner MacroMedia.exe "Coin-Miner"