Trojaner MacroMedia.exe "Coin-Miner"

SyRoX · 02.10.2013, 14:34

Hallo Community,

Ich habe seid gestern einen Trojaner auf meinem PC und brauche bitte dringend hilfe ! Er nimmt 90% der Auslastung von meiner CPU ein und nichts geht mehr richtig ....

Lg SyRoX

aharonov · 02.10.2013, 14:46

Hi,

mach bitte einen FRST-Scan:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

SyRoX · 02.10.2013, 14:53

FRST

Code:

ATTFilter

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
(Microsoft Corporation) C:\Windows\System32\WScript.exe
() C:\ProgramData\win0\bpvttlpxh.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Ufasoft) C:\Users\FLO\AppData\Roaming\WindowsHelp\macromedia.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1646216 2013-04-01] (Ask)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [svchost] - C:\ProgramData\win0\bpvttlpxh.exe [620032 2013-07-10] ()
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"
HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)
HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)
HKCU\...\Run: [svchost] - C:\ProgramData\win0\bpvttlpxh.exe [620032 2013-07-10] ()
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)
HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
HKCU\...\Policies\Explorer: [HideSCAHealth] 1
IMEO\mbam.exe: [Debugger] jfl_.exe
IMEO\mbamgui.exe: [Debugger] ekm_.exe
IMEO\rstrui.exe: [Debugger] rp_.exe
Startup: C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk
ShortcutTarget: Skype.lnk -> C:\Users\FLO\AppData\Roaming\WindowsHelp\usft_ext.exe.vbs ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946
SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Lyrics-Pal - {C8FBE488-BAF5-4019-A7F7-C888045987D3} - C:\Program Files\LyricsPal\120.dll No File
BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: Lyrics-Pal - {ebcafb3f-5032-49f2-bf60-b99beef14b5c} - C:\Program Files\LyricsPal\133.dll ()
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU -Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.13.1

FireFox:
========
FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default
FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946
FF SearchEngineOrder.1: Delta Search
FF SelectedSearchEngine: Delta Search
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi
FF Extension: No Name - C:\Program Files\LyricsPal\133.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe

Chrome: 
=======
CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\pdf.dll ()
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
CHR Plugin: (ESN Sonar API) - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
CHR Plugin: (Unity Player) - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.16) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0
CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR Extension: (Lyrics-Pal) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnbbffeddnekkhjmokkhdebbfbibbflc\1.133_0
CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx
CHR HKLM\...\Chrome\Extension: [pnbbffeddnekkhjmokkhdebbfbibbflc] - C:\Program Files\LyricsPal\133.crx

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-07-01] (Avira Operations GmbH & Co. KG)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)
R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)
S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST
2013-10-02 15:48 - 2013-10-02 15:48 - 01086873 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk
2013-10-02 14:24 - 2013-07-15 19:35 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Multiplayer.url
2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool
2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws
2013-09-20 21:36 - 2013-09-20 21:36 - 00000000 ____D C:\Users\FLO\AppData\Roaming\File Scout
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-14 15:33 - 2013-10-01 18:20 - 00000000 ____D C:\ProgramData\BitGuard
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-12 06:27 - 2013-09-12 06:27 - 00000000 ____D C:\Program Files\LyricsPal
2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url
2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

==================== One Month Modified Files and Folders =======

2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST
2013-10-02 15:48 - 2013-10-02 15:48 - 01086873 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:41 - 2013-04-13 13:59 - 01209612 _____ C:\Windows\WindowsUpdate.log
2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET
2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-10-02 14:33 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps
2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump
2013-10-02 14:33 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther
2013-10-02 14:29 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client
2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 13:01 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype
2013-10-02 13:01 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-02 11:26 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-02 11:26 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 11:22 - 2013-07-17 13:30 - 00000346 _____ C:\Windows\Tasks\Lyrics-Pal Update.job
2013-10-02 11:19 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-02 11:18 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-02 11:18 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe
2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool
2013-10-01 18:20 - 2013-09-14 15:33 - 00000000 ____D C:\ProgramData\BitGuard
2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla
2013-10-01 11:21 - 2013-08-28 19:37 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WindowsHelp
2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies
2013-09-28 18:30 - 2010-11-20 23:01 - 01589442 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google
2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-22 20:25 - 2013-04-13 14:41 - 00000000 ____D C:\Users\FLO\AppData\Local\DoNotTrackPlus
2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws
2013-09-20 21:36 - 2013-09-20 21:36 - 00000000 ____D C:\Users\FLO\AppData\Roaming\File Scout
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD
2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD
2013-09-19 13:42 - 2013-07-15 10:32 - 00000000 ____D C:\Users\FLO\AppData\Roaming\miner
2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-12 06:27 - 2013-09-12 06:27 - 00000000 ____D C:\Program Files\LyricsPal
2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions
2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url
2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft
2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

Some content of TEMP:
====================
C:\Users\FLO\AppData\Local\Temp\ppoazhovqwl.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-29 19:10

==================== End Of Log ============================

Addition

Code:

ATTFilter

==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20
Adobe Reader XI (11.0.04) - Deutsch (Version: 11.0.04)
Akamai NetSession Interface
AMD Accelerated Video Transcoding (Version: 13.20.100.30905)
AMD APP SDK Runtime (Version: 10.0.1084.4)
AMD Catalyst Control Center (Version: 2013.0905.312.3832)
AMD Catalyst Install Manager (Version: 8.0.915.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Fuel (Version: 2013.0905.312.3832)
AMD Media Foundation Decoders (Version: 1.0.80905.0331)
AMD Wireless Display v3.0 (Version: 1.0.0.14)
Application Profiles (Version: 2.0.4888.34279)
Ask Toolbar (Version: 1.15.24.0)
aTube Catcher (Version: 2.9.1347)
Avira Free Antivirus (Version: 13.0.0.3737)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU Version: 1.2.5.42066)
Battlefield 3™ (Version: 1.6.0.0)
Battlelog Web Plugins (Version: 2.1.7)
Call of Duty: Black Ops II - Multiplayer
Call of Duty: Black Ops II - Zombies
Call of Duty: Modern Warfare 2 - Multiplayer
Call of Duty: Modern Warfare 3 - Dedicated Server
Call of Duty: Modern Warfare 3 - Multiplayer
Camtasia Studio 8 (Version: 8.0.4.1060)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version: 2013.0905.312.3832)
Catalyst Control Center InstallProxy (Version: 2013.0815.818.13017)
Catalyst Control Center Localization All (Version: 2013.0905.312.3832)
CCC Help Chinese Standard (Version: 2013.0905.0311.3832)
CCC Help Chinese Traditional (Version: 2013.0905.0311.3832)
CCC Help Czech (Version: 2013.0905.0311.3832)
CCC Help Danish (Version: 2013.0905.0311.3832)
CCC Help Dutch (Version: 2013.0905.0311.3832)
CCC Help English (Version: 2013.0905.0311.3832)
CCC Help Finnish (Version: 2013.0905.0311.3832)
CCC Help French (Version: 2013.0905.0311.3832)
CCC Help German (Version: 2013.0905.0311.3832)
CCC Help Greek (Version: 2013.0905.0311.3832)
CCC Help Hungarian (Version: 2013.0905.0311.3832)
CCC Help Italian (Version: 2013.0905.0311.3832)
CCC Help Japanese (Version: 2013.0905.0311.3832)
CCC Help Korean (Version: 2013.0905.0311.3832)
CCC Help Norwegian (Version: 2013.0905.0311.3832)
CCC Help Polish (Version: 2013.0905.0311.3832)
CCC Help Portuguese (Version: 2013.0905.0311.3832)
CCC Help Russian (Version: 2013.0905.0311.3832)
CCC Help Spanish (Version: 2013.0905.0311.3832)
CCC Help Swedish (Version: 2013.0905.0311.3832)
CCC Help Thai (Version: 2013.0905.0311.3832)
CCC Help Turkish (Version: 2013.0905.0311.3832)
ccc-utility (Version: 2013.0905.312.3832)
CCleaner (Version: 4.03)
Dead Island Riptide
Firefox Browser (remove only)
Fraps (remove only)
Google Chrome (Version: 29.0.1547.76)
Google Earth (Version: 7.1.1.1888)
Google Update Helper (Version: 1.3.21.153)
HydraVision (Version: 4.2.252.0)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
League of Legends (Version: 1.3)
Lyrics-Pal
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
McAfee Security Scan Plus (Version: 3.0.285.6)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (Version: 11.0.50727.1)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)
Nexon Game Manager
Realtek Ethernet Controller Driver (Version: 7.49.927.2011)
Realtek HDMI Audio Driver for ATI (Version: 6.0.1.6650)
Realtek High Definition Audio Driver (Version: 6.0.1.6662)
Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.30.0)
Skype™ 6.6 (Version: 6.6.106)
Steam (Version: 1.0.0.0)
TeamSpeak 3 Client (Version: 3.0.13)
Unity Web Player (HKCU Version: )
Uplay (Version: 2.0)
WinRAR 4.20 (32-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

02-10-2013 12:34:01 Removed Paint.NET v3.5.10

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {07E887E3-D81F-41C3-A282-CA02110C312B} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2013-04-01] ()
Task: {1009E27B-6FC3-4D8B-9163-89EFFC1B6B6D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-15] (Google Inc.)
Task: {30769C4E-4BFE-4B1B-9768-B1F23B736DA2} - System32\Tasks\Razer_Game_Booster_AutoUpdate => D:\Program Files\Razer\Razer Game Booster\AutoUpdate.exe
Task: {3363F52E-549D-438D-8BC3-374B6120FE36} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {3861583A-86F7-4A98-9CE8-2FB788770FFD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)
Task: {6A3CCF2C-528D-40F7-B40F-8AD05F48D3FE} - System32\Tasks\Game_Booster_AutoUpdate => D:\Program Files\IObit\Game Booster 3\AutoUpdate.exe
Task: {BB921791-C88C-424A-ACBC-E138F4D36A97} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-15] (Google Inc.)
Task: {EB3651DC-6E87-428A-A75C-2E95E0A1CF6E} - System32\Tasks\Lyrics-Pal Update => C:\Program Files\LyricsPal\Lyrics.exe [2013-09-11] ()
Task: {F912CE69-2F0E-43E6-8854-E8EBD4D5C0DC} - System32\Tasks\Windows Update Check - 0x21BF04DF => C:\ProgramData\win0\bpvttlpxh.exe [2013-07-10] ()
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Lyrics-Pal Update.job => C:\Program Files\LyricsPal\Lyrics.exe

==================== Loaded Modules (whitelisted) =============

2013-10-01 17:07 - 2013-10-01 11:46 - 02704352 _____ () C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll
2013-09-05 03:13 - 2013-09-05 03:13 - 00095744 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-09-26 15:53 - 2013-09-17 05:20 - 00709584 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\libglesv2.dll
2013-09-26 15:53 - 2013-09-17 05:20 - 00099792 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\libegl.dll
2013-09-26 15:53 - 2013-09-17 05:21 - 04053456 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\pdf.dll
2013-09-26 15:53 - 2013-09-17 05:21 - 00410576 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll
2013-09-26 15:53 - 2013-09-17 05:20 - 01604560 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\ffmpegsumo.dll
2013-09-26 15:53 - 2013-09-17 05:21 - 13611984 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Marvell 91xx Config ATA Device
Description: Marvell 91xx Config ATA Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/02/2013 02:19:09 PM) (Source: Application Hang) (User: )
Description: Programm Steam.exe, Version 1.91.87.3 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 2794

Startzeit: 01cebf68ac6f5709

Endzeit: 42

Anwendungspfad: D:\Program Files\Steam\Steam.exe

Berichts-ID: d47d6453-2b5c-11e3-9671-6cf04950c1b3

Error: (10/02/2013 01:01:30 PM) (Source: Application Hang) (User: )
Description: Programm iw5mp.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1924

Startzeit: 01cebf5e8e6a36bd

Endzeit: 2098

Anwendungspfad: D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe

Berichts-ID: f9ad682a-2b51-11e3-9671-6cf04950c1b3

Error: (10/02/2013 00:40:22 PM) (Source: Application Hang) (User: )
Description: Programm iw5mp.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1290

Startzeit: 01cebf53576731b9

Endzeit: 197

Anwendungspfad: D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe

Berichts-ID: 07ab13bd-2b4f-11e3-9671-6cf04950c1b3

Error: (10/02/2013 11:20:16 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2013 11:19:35 AM) (Source: ESENT) (User: )
Description: taskhost (1424) Versuch, Datei "C:\Users\FLO\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (10/02/2013 09:15:35 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: dependant.exe, Version: 0.0.0.0, Zeitstempel: 0x51a843e9
Name des fehlerhaften Moduls: amdocl.dll, Version: 10.0.1307.1, Zeitstempel: 0x520ccecc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002f346
ID des fehlerhaften Prozesses: 0x120
Startzeit der fehlerhaften Anwendung: 0xdependant.exe0
Pfad der fehlerhaften Anwendung: dependant.exe1
Pfad des fehlerhaften Moduls: dependant.exe2
Berichtskennung: dependant.exe3

Error: (10/02/2013 09:13:26 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2013 08:17:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2013 08:16:30 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: dependant.exe, Version: 0.0.0.0, Zeitstempel: 0x51a843e9
Name des fehlerhaften Moduls: amdocl.dll, Version: 10.0.1307.1, Zeitstempel: 0x520ccecc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002f346
ID des fehlerhaften Prozesses: 0xbe4
Startzeit der fehlerhaften Anwendung: 0xdependant.exe0
Pfad der fehlerhaften Anwendung: dependant.exe1
Pfad des fehlerhaften Moduls: dependant.exe2
Berichtskennung: dependant.exe3

Error: (10/01/2013 08:10:07 PM) (Source: Application Hang) (User: )
Description: Programm rads_user_kernel.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: d0

Startzeit: 01cebed1399f57f3

Endzeit: 9635

Anwendungspfad: D:\Program Files\League of Legends\RADS\system\rads_user_kernel.exe

Berichts-ID: a93ec7e8-2ac4-11e3-83e0-6cf04950c1b3


System errors:
=============
Error: (10/02/2013 02:48:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (10/02/2013 11:18:24 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎02.‎10.‎2013 um 11:17:35 unerwartet heruntergefahren.

Error: (10/01/2013 08:15:30 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎01.‎10.‎2013 um 20:13:56 unerwartet heruntergefahren.

Error: (10/01/2013 06:41:06 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎01.‎10.‎2013 um 18:34:13 unerwartet heruntergefahren.

Error: (10/01/2013 06:20:26 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎01.‎10.‎2013 um 18:19:23 unerwartet heruntergefahren.

Error: (10/01/2013 05:06:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147014847

Error: (10/01/2013 11:18:54 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147014847

Error: (09/30/2013 08:46:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147014847

Error: (09/30/2013 08:46:06 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎30.‎09.‎2013 um 20:44:52 unerwartet heruntergefahren.

Error: (09/30/2013 07:51:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: 
%%-2147014847


Microsoft Office Sessions:
=========================
Error: (10/02/2013 02:19:09 PM) (Source: Application Hang)(User: )
Description: Steam.exe1.91.87.3279401cebf68ac6f570942D:\Program Files\Steam\Steam.exed47d6453-2b5c-11e3-9671-6cf04950c1b3

Error: (10/02/2013 01:01:30 PM) (Source: Application Hang)(User: )
Description: iw5mp.exe0.0.0.0192401cebf5e8e6a36bd2098D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exef9ad682a-2b51-11e3-9671-6cf04950c1b3

Error: (10/02/2013 00:40:22 PM) (Source: Application Hang)(User: )
Description: iw5mp.exe0.0.0.0129001cebf53576731b9197D:\Program Files\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe07ab13bd-2b4f-11e3-9671-6cf04950c1b3

Error: (10/02/2013 11:20:16 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/02/2013 11:19:35 AM) (Source: ESENT)(User: )
Description: taskhost1424C:\Users\FLO\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Error: (10/02/2013 09:15:35 AM) (Source: Application Error)(User: )
Description: dependant.exe0.0.0.051a843e9amdocl.dll10.0.1307.1520cceccc00000050002f34612001cebf3f1b7cdcd8C:\Users\FLO\AppData\Roaming\miner\dependant.exeC:\Windows\system32\amdocl.dll6e190455-2b32-11e3-beac-6cf04950c1b3

Error: (10/02/2013 09:13:26 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2013 08:17:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/01/2013 08:16:30 PM) (Source: Application Error)(User: )
Description: dependant.exe0.0.0.051a843e9amdocl.dll10.0.1307.1520cceccc00000050002f346be401cebed24fcc9079C:\Users\FLO\AppData\Roaming\miner\dependant.exeC:\Windows\system32\amdocl.dll97fc4f6e-2ac5-11e3-ad62-6cf04950c1b3

Error: (10/01/2013 08:10:07 PM) (Source: Application Hang)(User: )
Description: rads_user_kernel.exe0.0.0.0d001cebed1399f57f39635D:\Program Files\League of Legends\RADS\system\rads_user_kernel.exea93ec7e8-2ac4-11e3-83e0-6cf04950c1b3


==================== Memory info =========================== 

Percentage of memory in use: 57%
Total physical RAM: 3326.49 MB
Available physical RAM: 1422.29 MB
Total Pagefile: 6322.72 MB
Available Pagefile: 3939.22 MB
Total Virtual: 2047.88 MB
Available Virtual: 1875.82 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:48.73 GB) (Free:25.23 GB) NTFS
Drive d: (FLO) (Fixed) (Total:184.06 GB) (Free:54.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: F3246542)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=49 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=184 GB) - (Type=07 NTFS)

==================== End Of Log ============================

aharonov · 02.10.2013, 14:56

Die Logs bitte immer vollständig posten.

Schritt 1

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 3

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Log von Adwcleaner
Log von Combofix
Log von FRST

SyRoX · 02.10.2013, 16:01

Code:

ATTFilter

omboFix 13-10-01.03 - FLO 02.10.2013  16:30:55.1.4 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3326.2534 [GMT 2:00]
ausgeführt von:: c:\users\FLO\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
Die folgenden Dateien wurden während des Laufs deaktiviert:
c:\program files\ATI Technologies\HydraVision\HydraDMH.dll
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Skype.lnk
c:\users\FLO\AppData\Roaming\WindowsHelp
c:\users\FLO\AppData\Roaming\WindowsHelp\coinutil.dll
c:\users\FLO\AppData\Roaming\WindowsHelp\killer.bat
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\compile.bat
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part1
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part10
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part11
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part12
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part13
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part14
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part15
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part16
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part17
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part18
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part19
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part2
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part20
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part21
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part22
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part23
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part24
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part25
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part26
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part27
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part28
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part29
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part3
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part30
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part31
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part32
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part33
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part34
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part35
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part36
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part37
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part38
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part39
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part4
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part40
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part41
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part42
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part43
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part44
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part45
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part46
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part47
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part48
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part49
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part5
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part50
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part51
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part52
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part53
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part54
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part55
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part56
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part57
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part58
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part59
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part6
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part60
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part61
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part62
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part63
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part64
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part65
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part66
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part67
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part68
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part69
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part7
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part70
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part71
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part72
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part73
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part74
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part75
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part76
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part77
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part78
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part79
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part8
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part80
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part81
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part82
c:\users\FLO\AppData\Roaming\WindowsHelp\macro\macromedia.exe_part9
c:\users\FLO\AppData\Roaming\WindowsHelp\macromedia.exe
c:\users\FLO\AppData\Roaming\WindowsHelp\miner.dll
c:\users\FLO\AppData\Roaming\WindowsHelp\openssl.dll
c:\users\FLO\AppData\Roaming\WindowsHelp\phatk.cl
c:\users\FLO\AppData\Roaming\WindowsHelp\phatk.ptx
c:\users\FLO\AppData\Roaming\WindowsHelp\puts.vbs
c:\users\FLO\AppData\Roaming\WindowsHelp\serials.txt
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\compile.bat
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part10
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part11
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part12
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part13
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part14
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part15
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part16
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part17
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part18
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part19
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part2
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part20
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part21
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part22
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part23
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part24
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part25
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part26
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part27
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part28
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part29
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part3
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part30
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part31
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part32
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part33
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part34
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part35
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part36
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part37
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part38
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part39
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part4
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part40
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part41
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part42
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part43
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part44
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part45
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part46
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part47
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part48
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part49
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part5
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part50
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part51
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part52
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part53
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part54
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part55
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part56
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part57
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part58
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part59
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part6
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part60
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part61
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part62
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part63
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part64
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part65
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part66
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part67
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part68
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part69
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part7
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part70
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part71
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part72
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part73
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part74
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part75
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part76
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part77
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part78
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part79
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part8
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part80
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part81
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part82
c:\users\FLO\AppData\Roaming\WindowsHelp\shel\shell.exe_part9
c:\users\FLO\AppData\Roaming\WindowsHelp\shell.exe
c:\users\FLO\AppData\Roaming\WindowsHelp\usft_ext.dll
c:\users\FLO\AppData\Roaming\WindowsHelp\usft_ext.exe.vbs
c:\windows\system32\frapsvid.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-09-02 bis 2013-10-02  ))))))))))))))))))))))))))))))
.
.
2013-10-02 14:49 . 2013-10-02 14:51	--------	d-----w-	c:\users\FLO\AppData\Local\temp
2013-10-02 13:58 . 2013-10-02 14:08	--------	d-----w-	C:\AdwCleaner
2013-10-02 13:49 . 2013-10-02 13:49	--------	d-----w-	C:\FRST
2013-10-02 13:09 . 2013-10-02 13:09	--------	d-----w-	c:\programdata\Malwarebytes
2013-10-02 13:09 . 2013-10-02 13:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-10-02 13:09 . 2013-04-04 12:50	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-10-02 10:59 . 2013-10-02 11:08	--------	d-----w-	c:\users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 10:56 . 2013-10-02 10:56	--------	d-----w-	c:\users\FLO\AppData\Local\ElevatedDiagnostics
2013-10-02 08:43 . 2013-10-02 08:43	--------	d-----w-	c:\users\FLO\AppData\Roaming\Apple Computer
2013-10-02 08:43 . 2013-10-02 08:43	--------	d-----w-	c:\users\FLO\AppData\Local\Apple Computer
2013-10-02 08:43 . 2013-10-02 08:43	--------	d-----w-	c:\users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 08:41 . 2013-10-02 08:41	--------	d-----w-	C:\Game5
2013-10-02 08:37 . 2013-10-02 08:37	--------	d-----w-	c:\programdata\McAfee Security Scan
2013-10-02 08:36 . 2013-10-02 08:36	--------	d-----w-	c:\programdata\McAfee
2013-10-02 08:36 . 2013-10-02 08:36	--------	d-----w-	c:\program files\McAfee Security Scan
2013-10-02 08:36 . 2013-10-02 08:36	--------	d-----w-	c:\program files\Common Files\Adobe
2013-10-02 08:34 . 2013-10-02 08:38	--------	d-----w-	c:\users\FLO\AppData\Local\Adobe
2013-10-02 07:17 . 2013-10-02 07:17	--------	d-----w-	c:\users\FLO\AppData\Roaming\WINSpool
2013-09-27 14:23 . 2013-09-27 14:23	--------	d-----w-	c:\windows\Sun
2013-09-26 12:39 . 2013-09-26 12:45	--------	d-----w-	c:\windows\system32\MRT
2013-09-26 12:38 . 2013-07-09 04:50	652800	----a-w-	c:\windows\system32\rpcrt4.dll
2013-09-26 12:38 . 2013-07-09 04:52	175104	----a-w-	c:\windows\system32\wintrust.dll
2013-09-26 12:38 . 2013-07-09 04:46	140288	----a-w-	c:\windows\system32\cryptsvc.dll
2013-09-26 12:38 . 2013-07-09 04:46	1166848	----a-w-	c:\windows\system32\crypt32.dll
2013-09-26 12:38 . 2013-07-09 04:46	103936	----a-w-	c:\windows\system32\cryptnet.dll
2013-09-26 12:38 . 2013-07-06 05:05	1293760	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-09-26 12:36 . 2013-06-15 03:38	31232	----a-w-	c:\windows\system32\drivers\tssecsrv.sys
2013-09-26 11:44 . 2013-09-26 11:44	--------	d-----w-	c:\users\FLO\AppData\Roaming\WINSX
2013-09-22 11:13 . 2013-09-22 11:13	--------	d-----w-	c:\users\FLO\AppData\Roaming\wiiunuws
2013-09-19 13:12 . 2013-09-19 13:12	--------	d-----w-	c:\programdata\ATI
2013-09-19 13:12 . 2013-09-19 13:12	--------	d-----w-	c:\program files\AMD AVT
2013-09-13 18:52 . 2013-09-13 18:52	--------	d-----w-	c:\users\FLO\AppData\Local\fabi.me
2013-09-08 18:31 . 2013-09-08 18:49	--------	d-----w-	c:\users\FLO\AppData\Roaming\Bioshock
2013-09-05 01:51 . 2013-09-05 01:51	38912	----a-w-	c:\windows\system32\kdbsdk32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-15 13:11 . 2013-08-15 13:11	142304	----a-w-	c:\windows\system32\amdhcp32.dll
2013-08-15 13:11 . 2013-08-15 13:11	71704	----a-w-	c:\windows\system32\atimpc32.dll
2013-08-15 13:11 . 2013-08-15 13:11	71704	----a-w-	c:\windows\system32\amdpcom32.dll
2013-08-15 13:11 . 2012-12-19 19:31	126336	----a-w-	c:\windows\system32\atiuxpag.dll
2013-08-15 13:11 . 2012-12-19 19:30	98496	----a-w-	c:\windows\system32\atiu9pag.dll
2013-08-15 13:11 . 2012-12-19 20:09	1052264	----a-w-	c:\windows\system32\aticfx32.dll
2013-08-15 13:11 . 2012-12-19 20:06	7919328	----a-w-	c:\windows\system32\atidxx32.dll
2013-08-15 13:10 . 2012-12-19 19:44	6502024	----a-w-	c:\windows\system32\atiumdva.dll
2013-08-15 13:10 . 2012-12-19 20:50	6549928	----a-w-	c:\windows\system32\atiumdag.dll
2013-08-15 13:07 . 2013-08-15 13:07	11037696	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2013-08-15 12:55 . 2013-08-15 12:55	200704	----a-w-	c:\windows\system32\clinfo.exe
2013-08-15 12:54 . 2013-08-15 12:54	83456	----a-w-	c:\windows\system32\OpenVideo.dll
2013-08-15 12:54 . 2013-08-15 12:54	73216	----a-w-	c:\windows\system32\OVDecode.dll
2013-08-15 12:51 . 2013-08-15 12:51	23989248	----a-w-	c:\windows\system32\amdocl.dll
2013-08-15 12:49 . 2013-08-15 12:49	57344	----a-w-	c:\windows\system32\OpenCL.dll
2013-08-15 12:45 . 2013-08-15 12:45	114688	----a-w-	c:\windows\system32\coinst_13.20.11.dll
2013-08-15 12:33 . 2013-08-15 12:33	368640	----a-w-	c:\windows\system32\atiapfxx.exe
2013-08-15 12:33 . 2013-08-15 12:33	52224	----a-w-	c:\windows\system32\aticalrt.dll
2013-08-15 12:33 . 2013-08-15 12:33	49152	----a-w-	c:\windows\system32\aticalcl.dll
2013-08-15 12:29 . 2013-08-15 12:29	14302208	----a-w-	c:\windows\system32\aticaldd.dll
2013-08-15 12:15 . 2013-08-15 12:15	21624832	----a-w-	c:\windows\system32\atioglxx.dll
2013-08-15 12:12 . 2013-08-15 12:12	442368	----a-w-	c:\windows\system32\atidemgy.dll
2013-08-15 12:12 . 2013-08-15 12:12	25600	----a-w-	c:\windows\system32\atimuixx.dll
2013-08-15 12:11 . 2013-08-15 12:11	483328	----a-w-	c:\windows\system32\atieclxx.exe
2013-08-15 12:10 . 2013-08-15 12:10	209408	----a-w-	c:\windows\system32\atiesrxx.exe
2013-08-15 12:09 . 2013-08-15 12:09	164352	----a-w-	c:\windows\system32\atitmmxx.dll
2013-08-15 11:40 . 2013-08-15 11:40	828416	----a-w-	c:\windows\system32\atiadlxx.dll
2013-08-15 11:40 . 2013-08-15 11:40	69632	----a-w-	c:\windows\system32\atiglpxx.dll
2013-08-15 11:40 . 2013-08-15 11:40	96768	----a-w-	c:\windows\system32\atigktxx.dll
2013-08-15 11:38 . 2013-08-15 11:38	495104	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2013-08-15 11:37 . 2013-08-15 11:37	90112	----a-w-	c:\windows\system32\amdave32.dll
2013-08-15 11:37 . 2013-08-15 11:37	80896	----a-w-	c:\windows\system32\atisamu32.dll
2013-08-15 11:36 . 2013-08-15 11:36	43520	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2013-08-09 18:45 . 2013-08-09 18:28	290184	----a-w-	c:\windows\system32\PnkBstrB.xtr
2013-08-09 18:44 . 2013-08-08 10:15	280904	----a-w-	c:\windows\system32\PnkBstrB.ex0
2013-08-08 10:15 . 2013-08-08 10:15	138056	----a-w-	c:\users\FLO\AppData\Roaming\PnkBstrK.sys
2013-07-17 11:14 . 2013-07-17 11:14	94632	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-07-17 11:14 . 2013-07-17 11:14	867240	----a-w-	c:\windows\system32\npDeployJava1.dll
2013-07-17 11:14 . 2013-07-17 11:14	789416	----a-w-	c:\windows\system32\deployJava1.dll
2013-07-05 08:40 . 2013-07-05 08:40	78848	----a-w-	c:\windows\system32\drivers\AtihdW73.sys
2013-07-05 08:40 . 2013-07-05 08:40	84480	----a-w-	c:\windows\system32\DelayAPO.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\program files\Steam\steam.exe" [2013-09-21 1814440]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-21 19875432]
"HKCUwvcs"="c:\users\FLO\AppData\Roaming\wiiunuws\windcis.exe" [2013-09-22 385024]
"HKCUwinfc"="\Windows\Explorer.exe" [2011-02-25 2616320]
"HydraVisionDesktopManager"="c:\program files\ATI Technologies\HydraVision\HydraDM.exe" [2013-03-28 389120]
"HKCUWINStvl"="c:\users\FLO\AppData\Roaming\WINSpool\WINSVch.exe" [2013-10-02 294912]
"svchost"="\Windows\Explorer.exe" [2011-02-25 2616320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2012-06-11 10996368]
"NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-01 345144]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe" [2013-09-05 747264]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.285\SSScheduler.exe [2012-9-5 271808]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe]
"Debugger"=ntibcp_.exe
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-06-21 162408]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.285\McCHSvc.exe [2012-09-05 234776]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys [2013-04-03 29184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 WinRing0_1_2_0;WinRing0_1_2_0;d:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-04-13 37352]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-08-15 209408]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-09-05 276992]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-07-01 84024]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2013-06-19 29184]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2013-07-05 78848]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-11-19 62208]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-11-19 141568]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-09-29 490088]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-26 13:52	1177552	----a-w-	c:\program files\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-15 08:23]
.
2013-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-15 08:23]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.13.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files\Ask.com\GenericAskToolbar.dll
AddRemove-{5526d33c-7120-4326-9097-defcbdfa0dbc} - c:\program files\LyricsPal\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3944)
c:\program files\ATI Technologies\HydraVision\HydraDMH.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-10-02  16:58:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-10-02 14:58
.
Vor Suchlauf: 11 Verzeichnis(se), 27.691.302.912 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 27.579.015.168 Bytes frei
.
- - End Of File - - 491149B456505D6D20C1438A9452EF38
A36C5E4F47E84449FF07ED3517B43A31

Endlich geht wieder alles !

danke !

aharonov · 02.10.2013, 16:19

Es läuft immer noch Malware!
Ich warte noch auf die anderen Logs und dann geht's weiter.

SyRoX · 02.10.2013, 18:26

FRST

Code:

ATTFilter

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avscan.exe
() C:\Users\FLO\AppData\Roaming\miner\dependant.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)
HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)
HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)
HKCU\...\Run: [svchost] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)
HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35256 2013-08-22] (Overwolf)
HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.13.1

FireFox:
========
FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0
CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)
R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)
S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)
R3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
U3 mbr; \??\C:\ComboFix\mbr.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 17:04 - 2013-10-02 17:26 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 17:02 - 2013-10-02 17:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 16:27 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-02 16:27 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-02 16:27 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-02 16:16 - 2013-10-02 17:59 - 00000000 ____D C:\Qoobox
2013-10-02 16:15 - 2013-10-02 16:54 - 00000000 ____D C:\Windows\erdnt
2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 16:10 - 2013-10-02 17:23 - 00001064 _____ C:\Windows\setupact.log
2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 16:09 - 2013-10-02 16:50 - 00009136 _____ C:\Windows\PFRO.log
2013-10-02 15:58 - 2013-10-02 16:08 - 00000000 ____D C:\AdwCleaner
2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 15:50 - 2013-10-02 15:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk
2013-10-02 14:24 - 2013-07-15 19:35 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Multiplayer.url
2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool
2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url
2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

==================== One Month Modified Files and Folders =======

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 18:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-02 17:59 - 2013-10-02 16:16 - 00000000 ____D C:\Qoobox
2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 17:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-02 17:53 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-02 17:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing
2013-10-02 17:31 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-02 17:31 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-02 17:29 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype
2013-10-02 17:27 - 2013-04-13 13:59 - 01226674 _____ C:\Windows\WindowsUpdate.log
2013-10-02 17:26 - 2013-10-02 17:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-02 17:24 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-02 17:24 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-02 17:23 - 2013-10-02 16:10 - 00001064 _____ C:\Windows\setupact.log
2013-10-02 17:23 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-02 17:22 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client
2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 17:04 - 2013-10-02 17:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-10-02 16:54 - 2013-10-02 16:15 - 00000000 ____D C:\Windows\erdnt
2013-10-02 16:50 - 2013-10-02 16:09 - 00009136 _____ C:\Windows\PFRO.log
2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 16:11 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps
2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 16:08 - 2013-10-02 15:58 - 00000000 ____D C:\AdwCleaner
2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 15:51 - 2013-10-02 15:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET
2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump
2013-10-02 14:33 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther
2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe
2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool
2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla
2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies
2013-09-28 18:30 - 2010-11-20 23:01 - 01589442 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google
2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD
2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD
2013-09-19 13:42 - 2013-07-15 10:32 - 00000000 ____D C:\Users\FLO\AppData\Roaming\miner
2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions
2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url
2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft
2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

Some content of TEMP:
====================
C:\Users\FLO\AppData\Local\temp\gvytjdpthvm.exe
C:\Users\FLO\AppData\Local\temp\nircmd.exe
C:\Users\FLO\AppData\Local\temp\wget.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-02 17:50

==================== End Of Log ============================

aharonov · 02.10.2013, 18:31

Da fehlt der obere Teil des Logs. Bitte vollständig posten.

SyRoX · 03.10.2013, 07:35

Also nochmal mit dem oberen

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by FLO (administrator) on FLO-PC on 03-10-2013 08:34:38
Running from C:\Users\FLO\Downloads
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Valve Corporation) D:\Program Files\Steam\Steam.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.285\SSScheduler.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avscan.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
() C:\Users\FLO\AppData\Roaming\miner\dependant.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10996368 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [NUSB3MON] - C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKCU\...\Run: [Steam] - D:\Program Files\Steam\steam.exe [1814440 2013-09-21] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)
HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)
HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)
HKCU\...\Run: [svchost] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)
HKCU\...\Run: [Overwolf] - C:\Program Files\Overwolf\Overwolf.exe [35256 2013-08-22] (Overwolf)
HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
IMEO\rstrui.exe: [Debugger] riaicca_.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA109AF1D4338CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.13.1

FireFox:
========
FF ProfilePath: C:\Users\FLO\AppData\Roaming\Mozilla\Firefox\Profiles\ypntwgra.default
FF Plugin: @esn/esnlaunch,version=2.1.7 - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKCU\...\Firefox\Extensions: [{8f5010e2-9577-4aed-ad42-f2098ea15def}] - C:\Program Files\LyricsPal\133.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Users\FLO\Documents\Firefox Browser\App\Firefox\firefox.exe

Chrome: 
=======
CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5AF26CF04950C1C3&affID=119821&tt=160713_91114&tsp=4946", "hxxp://www.google.com"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\29.0.1547.76\pdf.dll ()
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
CHR Plugin: (ESN Sonar API) - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
CHR Plugin: (Unity Player) - C:\Users\FLO\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.16) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.5_0
CHR Extension: (Google Search) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (GTA5) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjohnmajpleabijkmpeildakhgdfpem\1_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\FLO\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files\LyricsPal\125.crx

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-09-05] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-01] (Avira Operations GmbH & Co. KG)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
S3 OverwolfUpdaterService; C:\Program Files\Overwolf\OverwolfUpdater.exe [18360 2013-08-22] (Overwolf Ltd)

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [29184 2013-06-19] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-13] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R3 nusb3hub; C:\Windows\System32\DRIVERS\nusb3hub.sys [62208 2010-11-19] (Renesas Electronics Corporation)
R3 nusb3xhc; C:\Windows\System32\DRIVERS\nusb3xhc.sys [141568 2010-11-19] (Renesas Electronics Corporation)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [204432 2012-06-05] (Realtek Semiconductor Corp.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-04-13] (Avira GmbH)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [29184 2013-04-03] (Anchorfree Inc.)
S3 xnacc; C:\Windows\System32\DRIVERS\xnacc.sys [465408 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\FLO\AppData\Local\Temp\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 WinRing0_1_2_0; \??\D:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 17:04 - 2013-10-03 08:15 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 17:02 - 2013-10-02 17:04 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 16:27 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-02 16:27 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-02 16:27 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-02 16:27 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-02 16:16 - 2013-10-02 17:59 - 00000000 ____D C:\Qoobox
2013-10-02 16:15 - 2013-10-02 16:54 - 00000000 ____D C:\Windows\erdnt
2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 16:10 - 2013-10-03 08:14 - 00001120 _____ C:\Windows\setupact.log
2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 16:09 - 2013-10-03 08:14 - 00010026 _____ C:\Windows\PFRO.log
2013-10-02 15:58 - 2013-10-02 16:08 - 00000000 ____D C:\AdwCleaner
2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 15:50 - 2013-10-02 15:51 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 15:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-02 15:07 - 2013-10-02 15:09 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:24 - 2013-07-17 22:18 - 00001622 _____ C:\Users\Public\Desktop\LaunchIW4M - Verknüpfung.lnk
2013-10-02 14:24 - 2013-07-15 19:35 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Multiplayer.url
2013-10-02 14:24 - 2013-05-17 15:08 - 00000216 _____ C:\Users\Public\Desktop\Call of Duty Black Ops II - Zombies.url
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 12:59 - 2013-10-02 13:08 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:42 - 2013-10-02 10:43 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:41 - 2013-10-02 10:42 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 10:34 - 2013-10-02 10:38 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 09:47 - 2013-10-02 11:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool
2013-10-01 13:31 - 2013-10-01 13:36 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-09-29 20:17 - 2013-09-29 20:20 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 15:51 - 2013-09-26 15:52 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 14:49 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-26 14:49 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-26 14:49 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-26 14:49 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-26 14:49 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-26 14:49 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-26 14:39 - 2013-09-26 14:45 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 14:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-26 14:38 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-26 14:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-26 14:38 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-26 14:37 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-26 14:37 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-26 14:37 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-26 14:37 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 14:37 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-26 14:37 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-26 14:37 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-26 14:37 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-26 14:37 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-09-26 14:37 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-26 14:37 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-26 14:36 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:33 - 2013-09-24 20:34 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:18 - 2013-09-13 18:17 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url
2013-09-08 20:31 - 2013-09-08 20:49 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:31 - 2013-09-08 20:42 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

==================== One Month Modified Files and Folders =======

2013-10-03 08:35 - 2013-06-15 10:23 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-03 08:21 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-03 08:21 - 2009-07-14 06:34 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-03 08:15 - 2013-10-02 17:04 - 00000000 ____D C:\Users\FLO\AppData\Local\Overwolf
2013-10-03 08:15 - 2013-06-03 20:23 - 00000000 ____D C:\Users\FLO\AppData\Local\CrashDumps
2013-10-03 08:15 - 2013-04-18 14:07 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Skype
2013-10-03 08:14 - 2013-10-02 16:10 - 00001120 _____ C:\Windows\setupact.log
2013-10-03 08:14 - 2013-10-02 16:09 - 00010026 _____ C:\Windows\PFRO.log
2013-10-03 08:14 - 2013-07-15 12:56 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-03 08:14 - 2013-06-15 10:23 - 00001088 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-03 08:14 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-02 19:28 - 2013-04-13 13:59 - 01232160 _____ C:\Windows\WindowsUpdate.log
2013-10-02 19:25 - 2013-10-02 19:25 - 01087213 _____ (Farbar) C:\Users\FLO\Downloads\FRST.exe
2013-10-02 17:59 - 2013-10-02 16:16 - 00000000 ____D C:\Qoobox
2013-10-02 17:58 - 2013-10-02 17:58 - 00024820 _____ C:\ComboFix.txt
2013-10-02 17:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-02 17:53 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-02 17:44 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing
2013-10-02 17:22 - 2013-04-18 16:27 - 00000000 ____D C:\Users\FLO\AppData\Roaming\TS3Client
2013-10-02 17:11 - 2013-10-02 17:11 - 00001919 _____ C:\Users\Public\Desktop\Overwolf.lnk
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Overwolf
2013-10-02 17:11 - 2013-10-02 17:11 - 00000000 ____D C:\Program Files\Common Files\Overwolf
2013-10-02 17:04 - 2013-10-02 17:04 - 00000806 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-10-02 17:04 - 2013-10-02 17:02 - 30091160 _____ (TeamSpeak Systems GmbH) C:\Users\FLO\Downloads\TeamSpeak3-Client-win32-3.0.13.exe
2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2013-10-02 16:59 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-10-02 16:54 - 2013-10-02 16:15 - 00000000 ____D C:\Windows\erdnt
2013-10-02 16:13 - 2013-10-02 16:13 - 05132885 ____R (Swearware) C:\Users\FLO\Desktop\ComboFix.exe
2013-10-02 16:10 - 2013-10-02 16:10 - 00000000 _____ C:\Windows\setuperr.log
2013-10-02 16:08 - 2013-10-02 15:58 - 00000000 ____D C:\AdwCleaner
2013-10-02 15:58 - 2013-10-02 15:58 - 01045226 _____ C:\Users\FLO\Downloads\adwcleaner.exe
2013-10-02 15:51 - 2013-10-02 15:50 - 00018115 _____ C:\Users\FLO\Downloads\Addition.txt
2013-10-02 15:49 - 2013-10-02 15:49 - 00000000 ____D C:\FRST
2013-10-02 15:47 - 2013-10-02 15:47 - 01953880 _____ (Farbar) C:\Users\FLO\Downloads\FRST64.exe
2013-10-02 15:29 - 2013-10-02 15:29 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-10-02 15:19 - 2013-10-02 15:19 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader (1).exe
2013-10-02 15:17 - 2013-10-02 15:17 - 00614816 _____ C:\Users\FLO\Downloads\HijackThis - CHIP-Downloader.exe
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-02 15:09 - 2013-10-02 15:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-02 15:09 - 2013-10-02 15:07 - 10284808 _____ (Malwarebytes Corporation                                    ) C:\Users\FLO\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-02 14:34 - 2013-06-20 19:18 - 00000000 ____D C:\Program Files\Paint.NET
2013-10-02 14:34 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-02 14:33 - 2013-08-08 12:26 - 00000000 ____D C:\Program Files\Battlelog Web Plugins
2013-10-02 14:33 - 2013-04-19 17:53 - 00000000 ____D C:\Windows\Minidump
2013-10-02 14:33 - 2013-04-13 14:55 - 00000000 ____D C:\Windows\Panther
2013-10-02 14:25 - 2011-04-12 03:39 - 00000000 ____D C:\Windows\ShellNew
2013-10-02 14:17 - 2013-10-02 14:17 - 04054000 _____ (LionSea Software                                            ) C:\Users\FLO\Downloads\setup.exe
2013-10-02 13:08 - 2013-10-02 12:59 - 00000000 ____D C:\Users\FLO\AppData\Roaming\FPSUnlock
2013-10-02 12:57 - 2013-10-02 12:57 - 00915475 _____ C:\Users\FLO\Downloads\BO2 Camos for MW2 and MW3 TSF TheSkinForge.rar
2013-10-02 12:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-02 11:24 - 2013-10-02 11:24 - 00016320 _____ C:\Users\FLO\Downloads\[www.OldSchoolHack.de]_NeeHook.zip
2013-10-02 11:07 - 2013-10-02 09:47 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-10-02 10:47 - 2013-10-02 10:47 - 00171338 _____ C:\Users\FLO\Downloads\Mw3Aimbot.zip
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Game5_-_GameFive
2013-10-02 10:43 - 2013-10-02 10:43 - 00000000 ____D C:\Users\FLO\AppData\Local\Apple Computer
2013-10-02 10:43 - 2013-10-02 10:42 - 00000005 _____ C:\Users\FLO\AppData\Roaming\version.ini
2013-10-02 10:42 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup (1).exe
2013-10-02 10:41 - 2013-10-02 10:41 - 20272610 _____ C:\Users\FLO\Downloads\Game5Setup.exe
2013-10-02 10:41 - 2013-10-02 10:41 - 00000000 ____D C:\Game5
2013-10-02 10:39 - 2013-04-14 18:15 - 00000000 ____D C:\ProgramData\Adobe
2013-10-02 10:38 - 2013-10-02 10:34 - 00000000 ____D C:\Users\FLO\AppData\Local\Adobe
2013-10-02 10:38 - 2013-04-14 18:26 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Adobe
2013-10-02 10:37 - 2013-10-02 10:37 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\ProgramData\McAfee
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-02 10:36 - 2013-10-02 10:36 - 00000000 ____D C:\Program Files\Adobe
2013-10-02 09:17 - 2013-10-02 09:17 - 00000000 ____D C:\Users\FLO\AppData\Roaming\WINSpool
2013-10-01 13:36 - 2013-10-01 13:31 - 107327126 _____ C:\Users\FLO\Downloads\The Catalyst 2 Promo by FaZe SLP.mp4
2013-10-01 11:48 - 2013-04-13 14:40 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Mozilla
2013-09-29 20:20 - 2013-09-29 20:17 - 48245024 _____ C:\Users\FLO\Desktop\SyroX.wav
2013-09-28 20:21 - 2013-04-13 14:22 - 00000000 ____D C:\Program Files\ATI Technologies
2013-09-28 18:30 - 2010-11-20 23:01 - 01589442 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-27 16:23 - 2013-09-27 16:23 - 00000000 ____D C:\Windows\Sun
2013-09-26 19:54 - 2013-04-14 18:18 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Users\FLO\AppData\Local\Google
2013-09-26 15:53 - 2013-06-15 10:23 - 00000000 ____D C:\Program Files\Google
2013-09-26 15:52 - 2013-09-26 15:51 - 00784880 _____ (Google Inc.) C:\Users\FLO\Downloads\ChromeSetup.exe
2013-09-26 15:20 - 2009-07-14 06:33 - 00268272 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-26 15:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-26 14:45 - 2013-09-26 14:39 - 00000000 ____D C:\Windows\system32\MRT
2013-09-24 20:34 - 2013-09-24 20:34 - 82088344 _____ C:\Users\FLO\Downloads\Baum.wav
2013-09-24 20:34 - 2013-09-24 20:33 - 09140121 _____ C:\Users\FLO\Downloads\zonatic 5.wmv
2013-09-22 13:13 - 2013-09-22 13:13 - 00000000 ____D C:\Users\FLO\AppData\Roaming\wiiunuws
2013-09-19 15:12 - 2013-09-19 15:12 - 00059023 _____ C:\Windows\system32\CCCInstall_201309191512339893.log
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\ProgramData\ATI
2013-09-19 15:12 - 2013-09-19 15:12 - 00000000 ____D C:\Program Files\AMD AVT
2013-09-19 15:12 - 2013-04-13 14:29 - 00000000 ____D C:\ProgramData\AMD
2013-09-19 15:04 - 2013-04-13 14:27 - 00000000 ____D C:\AMD
2013-09-19 13:42 - 2013-07-15 10:32 - 00000000 ____D C:\Users\FLO\AppData\Roaming\miner
2013-09-16 15:22 - 2013-05-10 18:10 - 00000000 ____D C:\Users\FLO\AppData\Local\IW4M
2013-09-13 20:52 - 2013-09-13 20:52 - 00000000 ____D C:\Users\FLO\AppData\Local\fabi.me
2013-09-13 18:17 - 2013-09-13 18:18 - 00945284 _____ C:\Users\FLO\Desktop\706098_3128872.mp4
2013-09-12 06:27 - 2013-07-17 13:32 - 00000000 ____D C:\Windows\system32\Extensions
2013-09-11 18:33 - 2013-09-11 18:33 - 00000216 _____ C:\Users\FLO\Desktop\Call of Duty Black Ops II - Zombies.url
2013-09-11 17:48 - 2013-07-17 13:21 - 00000000 ____D C:\Users\FLO\AppData\Roaming\.minecraft
2013-09-08 20:49 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\AppData\Roaming\Bioshock
2013-09-08 20:42 - 2013-09-08 20:31 - 00000000 ____D C:\Users\FLO\Documents\Bioshock
2013-09-05 03:51 - 2013-09-05 03:51 - 00038912 _____ C:\Windows\system32\kdbsdk32.dll

Some content of TEMP:
====================
C:\Users\FLO\AppData\Local\temp\dtdasndkufj.exe
C:\Users\FLO\AppData\Local\temp\gvytjdpthvm.exe
C:\Users\FLO\AppData\Local\temp\iuznffnsdug.exe
C:\Users\FLO\AppData\Local\temp\nircmd.exe
C:\Users\FLO\AppData\Local\temp\vxddtxwqyfo.exe
C:\Users\FLO\AppData\Local\temp\wget.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-02 17:50

==================== End Of Log ============================

--- --- ---

aharonov · 03.10.2013, 16:12

Ok, da läuft immer noch einiges.. Dann so weiter:

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKCU\...\Run: [HKCUwvcs] - C:\Users\FLO\AppData\Roaming\wiiunuws\windcis.exe [385024 2013-09-22] (Mozilla)
HKCU\...\Run: [HKCUwinfc] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)
C:\Users\FLO\AppData\Roaming\wiiunuws
HKCU\...\Run: [HKCUWINStvl] - C:\Users\FLO\AppData\Roaming\WINSpool\WINSVch.exe [294912 2013-10-02] (IKARUS Security)
HKCU\...\Run: [svchost] - \Windows\Explorer.exe [2616320 2011-02-25] (Microsoft Corporation)
C:\Users\FLO\AppData\Roaming\WINSpool
HKCU\...\Run: [miner] - "C:\Users\FLO\AppData\Roaming\miner\nircmd.exe" exec hide "C:\Users\FLO\AppData\Roaming\miner\start.bat"
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
IMEO\rstrui.exe: [Debugger] riaicca_.exe
C:\Users\FLO\AppData\Roaming\miner
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {FE4C0989-6A69-49E7-8229-4251F93E8597} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=8960151d-44c5-4d16-812c-cf913cd117eb&apn_sauid=3E6BEBCA-93F6-40BD-9FE7-AC6F8FCD78A6
C:\Users\FLO\AppData\Local\temp\*.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

Öffne das Programm Malwarebytes Anti-Malware.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke auf Aktualisierung --> Suche nach Aktualisierung.
Wenn das Update beendet wurde, aktiviere im Reiter Suchlauf die Option Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan fertig ist, klicke auf Ergebnisse anzeigen.
Versichere dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter dem Reiter Logdateien finden.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte poste in deiner nächsten Antwort:

Fixlog von FRST
Log von MBAM
Log von ESET
Log von FRST

SyRoX · 04.10.2013, 08:37

Nachdem malwerebyte ding da musdte ich den pc neu starten nun hab ich jetzt einen black screen und es passiert nix!!

aharonov · 04.10.2013, 11:08

Wann genau kommt der Blackscreen? Vor oder nach dem Windows Signet? Vor oder nach der Benutzeranmeldung?
Kannst du dich noch in den abgesicherten Modus einloggen?

SyRoX · 04.10.2013, 17:22

Hallo Community

Als ich heute morgen einen Malware check gemacht habe 5 Funde hatte und er mich aufforderte den PC zu restarten tat ich es.. Als er dann wieder hoch fuhr bekam ich einen blackscreen mit einem weißen cursor... Bitte um schnelle hilfe !

Mfg Flo

aharonov · 04.10.2013, 18:48

Kein Grund ein neues Thema zu eröffnen, ich hab die beiden Themen zusammengeführt.
Beantworte mal die obigen Fragen.

SyRoX · 04.10.2013, 19:02

Musste bei dem fund von malware ding da nach dem entfernen den pc neu starteb ich fahre ihn hoch und habe nach dem windows symbol einen blackscreen nur mit dem cursos

In den abgesicherten komm ich

In den abgesicherten modus komm ich noch

Nach dem abgesicherten modus komm ich noch rein

02.10.2013, 16:19	#6
aharonov /// TB-Ausbilder	Trojaner MacroMedia.exe "Coin-Miner" Es läuft immer noch Malware! Ich warte noch auf die anderen Logs und dann geht's weiter. __________________ --> Trojaner MacroMedia.exe "Coin-Miner"

02.10.2013, 18:31	#8
aharonov /// TB-Ausbilder	Trojaner MacroMedia.exe "Coin-Miner" Da fehlt der obere Teil des Logs. Bitte vollständig posten. __________________ cheers, Leo

04.10.2013, 11:08	#12
aharonov /// TB-Ausbilder	Trojaner MacroMedia.exe "Coin-Miner" Wann genau kommt der Blackscreen? Vor oder nach dem Windows Signet? Vor oder nach der Benutzeranmeldung? Kannst du dich noch in den abgesicherten Modus einloggen? __________________ cheers, Leo

04.10.2013, 18:48	#14
aharonov /// TB-Ausbilder	Trojaner MacroMedia.exe "Coin-Miner" Kein Grund ein neues Thema zu eröffnen, ich hab die beiden Themen zusammengeführt. Beantworte mal die obigen Fragen. __________________ cheers, Leo

Trojaner MacroMedia.exe "Coin-Miner"

Log-Analyse und Auswertung: Trojaner MacroMedia.exe "Coin-Miner"