| |
| |||||||
Log-Analyse und Auswertung: Windows 8: qvo6.com als Zwangsstartseite in Firefox und Internet ExplorerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
07.10.2013, 05:47
| #3 |
| |  Windows 8: qvo6.com als Zwangsstartseite in Firefox und Internet Explorer Hallo,
__________________anbei die 2 Logfiles von MBAR: mbar-log-2013-10-06 (23-37-45): Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org
Database version: v2013.10.06.05
Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16688
Jola und Klaus :: LAPTOP [administrator]
06.10.2013 23:37:45
mbar-log-2013-10-06 (23-37-45).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 211134
Time elapsed: 1 hour(s), 1 minute(s), 54 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 6
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page (Hijack.StartPage) -> Bad: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504) Good: (hxxp://www.google.com) -> Replace on reboot.
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL (Hijack.StartPage) -> Bad: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504) Good: (hxxp://www.google.com) -> Replace on reboot.
HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL (Hijack.StartPage) -> Bad: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504) Good: (hxxp://www.google.com) -> Replace on reboot.
HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page (Hijack.StartPage) -> Bad: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504) Good: (hxxp://www.google.com) -> Replace on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL (Hijack.StartPage) -> Bad: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504) Good: (hxxp://www.google.com) -> Replace on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page (Hijack.StartPage) -> Bad: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504) Good: (hxxp://www.google.com) -> Replace on reboot.
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org
Database version: v2013.10.06.05
Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16688
Jola und Klaus :: LAPTOP [administrator]
07.10.2013 00:43:39
mbar-log-2013-10-07 (00-43-39).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 210963
Time elapsed: 1 hour(s), 18 minute(s), 35 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Verstehe ich das richtig, dass es sich hier hauptsächlich um Registry-Einträge bzw. den Startmenü-Eintrag von Firefox handelt? Wenn ich Firefox direkt aus dem Programmordner starte, wird wieder die reguläre Startseite angezeigt. Das selbe gilt für den Internet Explorer (google.de wird als Startseite angezeigt). Edit: Ich habe noch einmal FRST durchlaufen lassen: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Jola und Klaus (administrator) on LAPTOP on 07-10-2013 06:49:05
Running from C:\Users\Jola und Klaus\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2873744 2013-07-23] (ELAN Microelectronics Corp.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-01-28] ( (Atheros Communications))
HKLM-x32\...\Run: [BakupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [624192 2012-11-02] (NTI Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - [x]
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [170496 2009-02-06] (ArcSoft Inc.)
HKU\Default\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-07-20] (Acer Incorporated)
HKU\Default User\...\RunOnce: [RegAutoPlay] - C:\Program Files (x86)\Acer\clear.fi Media\RegAutoplay.exe [1845392 2012-07-20] (Acer Incorporated)
==================== Internet (Whitelisted) ====================
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504&type=default&q={searchTerms}
SearchScopes: HKLM - {21A292E5-3F0E-4260-9168-8B0DE3BA80ED} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {21A292E5-3F0E-4260-9168-8B0DE3BA80ED} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504&type=default&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504&type=default&q={searchTerms}
SearchScopes: HKCU - {21A292E5-3F0E-4260-9168-8B0DE3BA80ED} URL =
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504&type=default&q={searchTerms}
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Jola und Klaus\AppData\Roaming\Mozilla\Firefox\Profiles\9hud3g0n.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\qvo6.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=HitachiXHTS545050A7E380_TA95123VJVH5SXJVH5SXX&ts=1381084504
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-02-06] (ArcSoft Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227456 2013-01-28] (Qualcomm Atheros Commnucations)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2415760 2012-07-27] (Acer Incorporated)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [466064 2012-07-31] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [659600 2012-07-31] (Acer Incorporated)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [92560 2013-07-23] (ELAN Microelectronics Corp.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-11-02] (NTI Corporation)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-08-27] (Dritek System INC.)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-28] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-08-27] (Dritek System Inc.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-06 23:37 - 2013-10-07 00:54 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-06 23:37 - 2013-10-06 23:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 23:35 - 2013-10-07 06:34 - 00000000 ____D C:\Users\Jola und Klaus\Desktop\mbar
2013-10-06 23:33 - 2013-10-06 23:33 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Jola und Klaus\Desktop\mbar-1.07.0.1005.exe
2013-10-06 23:21 - 2013-10-06 23:21 - 00035900 _____ C:\Users\Jola und Klaus\Downloads\FRST.txt
2013-10-06 23:18 - 2013-10-06 23:21 - 00017312 _____ C:\Users\Jola und Klaus\Downloads\Addition.txt
2013-10-06 23:16 - 2013-10-06 23:16 - 00000000 ____D C:\FRST
2013-10-06 22:44 - 2013-10-06 22:46 - 01954124 _____ (Farbar) C:\Users\Jola und Klaus\Desktop\FRST64.exe
2013-10-06 21:06 - 2013-10-06 21:06 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\MusicPlayer
2013-10-06 20:53 - 2013-10-06 22:52 - 00098375 _____ C:\Windows\WindowsUpdate.log
2013-10-06 20:44 - 2013-10-06 21:04 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\Mp3tag
2013-10-06 20:43 - 2013-10-06 20:43 - 00000000 ____D C:\Program Files (x86)\Mp3tag
2013-10-06 20:36 - 2013-10-06 20:41 - 00000000 ____D C:\ProgramData\eSafe
2013-10-06 20:35 - 2013-10-06 20:36 - 02634152 _____ C:\Users\Jola und Klaus\Downloads\mp3tagv258setup.exe
2013-10-06 20:34 - 2013-10-06 20:39 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-10-06 20:34 - 2013-10-06 20:34 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\BonanzaDealsLive
2013-10-06 20:34 - 2013-10-06 20:34 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-10-06 20:33 - 2013-10-06 20:38 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-10-06 20:33 - 2013-10-06 20:33 - 00002668 _____ C:\Windows\System32\Tasks\DigitalSite
2013-10-06 20:33 - 2013-10-06 20:33 - 00000330 _____ C:\Windows\Tasks\DigitalSite.job
2013-10-06 20:33 - 2013-10-06 20:33 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\DigitalSite
2013-10-06 20:33 - 2013-10-06 20:33 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\Google
2013-10-06 20:33 - 2013-10-06 20:33 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-10-06 20:32 - 2013-10-06 20:32 - 00679000 _____ C:\Users\Jola und Klaus\Downloads\ImageEditorSetup.exe
2013-10-04 19:02 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\tssdisai.dll
2013-09-24 15:29 - 2013-10-06 20:50 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\CrashDumps
2013-09-24 15:17 - 2013-09-24 15:17 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\ArcSoft
2013-09-24 15:16 - 2013-09-24 15:21 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\ArcSoft
2013-09-24 15:16 - 2013-09-24 15:16 - 00001969 _____ C:\Users\Public\Desktop\TotalMedia 3.5.lnk
2013-09-24 15:16 - 2013-09-24 15:16 - 00000000 ____D C:\ProgramData\ArcSoft
2013-09-24 15:16 - 2006-11-14 11:31 - 00022784 _____ (Arcsoft, Inc.) C:\Windows\SysWOW64\Drivers\afc.sys
2013-09-24 15:15 - 2013-09-24 15:15 - 00000000 ____D C:\Program Files (x86)\ArcSoft
2013-09-24 15:15 - 2005-07-16 02:35 - 00245408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unicows.dll
2013-09-24 15:15 - 2003-03-18 22:14 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-09-24 15:15 - 2003-02-21 04:42 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-09-24 15:13 - 2011-06-13 13:06 - 00048488 _____ (Realtek) C:\Windows\SysWOW64\Drivers\RTL2832U_IRHID.sys
2013-09-24 15:13 - 2011-06-13 13:06 - 00048488 _____ (Realtek) C:\Windows\system32\Drivers\RTL2832U_IRHID.sys
2013-09-24 15:13 - 2011-05-24 11:25 - 00135271 _____ (Realtek) C:\Windows\SysWOW64\RTKISDBTSOURCE.dll
2013-09-24 15:13 - 2011-05-24 11:21 - 05746780 _____ ( ) C:\Windows\SysWOW64\RTKISDBT.dll
2013-09-24 15:13 - 2011-05-17 14:48 - 00225256 _____ (REALTEK SEMICONDUCTOR Corp.) C:\Windows\SysWOW64\Drivers\RTL2832UBDA.sys
2013-09-24 15:13 - 2011-05-17 14:48 - 00225256 _____ (REALTEK SEMICONDUCTOR Corp.) C:\Windows\system32\Drivers\RTL2832UBDA.sys
2013-09-24 15:13 - 2011-05-17 14:48 - 00039016 _____ (REALTEK SEMICONDUCTOR Corp.) C:\Windows\SysWOW64\Drivers\RTL2832UUSB.sys
2013-09-24 15:13 - 2011-05-17 14:48 - 00039016 _____ (REALTEK SEMICONDUCTOR Corp.) C:\Windows\system32\Drivers\RTL2832UUSB.sys
2013-09-24 15:13 - 2011-04-21 19:13 - 05775441 ____T (Realtek) C:\Windows\SysWOW64\RTKDAB.dll
2013-09-24 15:13 - 2011-04-21 19:13 - 00372812 ____T (Realtek) C:\Windows\SysWOW64\RTKFM.dll
2013-09-24 15:13 - 2011-03-10 16:30 - 00090243 _____ (Realtek) C:\Windows\SysWOW64\SuperFrameSplitter.dll
2013-09-24 15:13 - 2010-10-27 09:58 - 00139358 _____ (Realtek) C:\Windows\SysWOW64\RTKDABSOURCE.dll
2013-09-24 15:13 - 2010-01-28 19:41 - 00135277 _____ (Realtek) C:\Windows\SysWOW64\RTKFMSOURCE.dll
2013-09-24 15:13 - 2009-12-29 15:12 - 00069632 _____ (Realtek) C:\Windows\SysWOW64\RTKDABMWare.dll
2013-09-24 15:13 - 2009-09-11 14:15 - 00114688 ____T (Realtek) C:\Windows\SysWOW64\RTL283XACCESS.dll
2013-09-24 15:12 - 2013-09-24 15:12 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\InstallShield
2013-09-18 15:25 - 2013-09-18 15:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-13 17:15 - 2013-09-13 17:15 - 00335904 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 19:24 - 2013-09-12 19:24 - 00000000 ____D C:\65523015a903183ce7f3243e9ece
2013-09-11 14:41 - 2013-08-21 06:11 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 14:41 - 2013-08-21 06:11 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 14:41 - 2013-08-21 06:11 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-11 14:41 - 2013-08-21 04:05 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-11 14:41 - 2013-08-21 04:05 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-11 14:41 - 2013-08-16 07:41 - 00058200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dam.sys
2013-09-11 14:41 - 2013-08-16 07:39 - 02371728 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2013-09-11 14:41 - 2013-08-16 07:39 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-09-11 14:41 - 2013-08-16 07:32 - 00209200 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2013-09-11 14:41 - 2013-08-16 07:22 - 04917760 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2013-09-11 14:41 - 2013-08-16 07:22 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-09-11 14:41 - 2013-08-16 07:21 - 03275776 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 01621504 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 01164288 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\WSClient.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\WSSync.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\setupcln.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-09-11 14:41 - 2013-08-16 07:21 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-09-11 14:41 - 2013-08-16 07:20 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSClient.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSSync.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00083968 _____ C:\Windows\SysWOW64\OEMLicense.dll
2013-09-11 14:41 - 2013-08-16 00:43 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-09-11 14:41 - 2013-08-16 00:43 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2013-09-11 14:41 - 2013-08-16 00:42 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll
2013-09-11 14:41 - 2013-08-16 00:42 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll
2013-09-11 14:40 - 2013-08-21 06:12 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 14:40 - 2013-08-21 06:12 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 14:40 - 2013-08-21 06:11 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 14:40 - 2013-08-21 06:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 14:40 - 2013-08-21 04:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 14:40 - 2013-08-21 04:06 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-11 14:40 - 2013-08-21 04:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-11 14:40 - 2013-08-21 04:06 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-11 14:40 - 2013-08-21 04:05 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-11 14:40 - 2013-08-21 03:43 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-11 14:40 - 2013-08-21 01:52 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2013-09-11 14:40 - 2013-07-09 10:04 - 00120144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msgpioclx.sys
2013-09-11 14:40 - 2013-07-09 08:18 - 00439488 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2013-09-11 14:40 - 2013-07-09 06:25 - 00385768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2013-09-11 14:40 - 2013-07-09 05:57 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationApi.dll
2013-09-11 14:40 - 2013-07-09 00:46 - 00543744 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll
2013-09-11 14:40 - 2013-07-09 00:46 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2013-09-11 14:40 - 2013-07-09 00:46 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Wwanadvui.dll
2013-09-11 14:40 - 2013-07-09 00:45 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\LocationApi.dll
2013-09-11 14:40 - 2013-07-06 02:16 - 01025024 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2013-09-11 14:40 - 2013-07-03 02:23 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-09-11 14:40 - 2013-07-03 02:23 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll
2013-09-11 14:40 - 2013-07-03 02:22 - 02839552 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2013-09-11 14:40 - 2013-07-03 02:22 - 01300480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-09-11 14:40 - 2013-07-03 02:11 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-09-11 14:40 - 2013-07-03 02:11 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2013-09-11 14:40 - 2013-07-03 02:10 - 02273792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2013-09-11 14:40 - 2013-07-02 00:08 - 00387583 _____ C:\Windows\system32\ApnDatabase.xml
2013-09-11 14:40 - 2013-07-01 00:30 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\openfiles.exe
2013-09-11 14:40 - 2013-07-01 00:29 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\openfiles.exe
2013-09-11 14:40 - 2013-06-29 08:15 - 00195416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-09-11 14:40 - 2013-06-29 08:15 - 00125784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-09-11 14:40 - 2013-06-29 07:43 - 00327512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2013-09-11 14:40 - 2013-06-29 03:12 - 01022464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-09-11 14:40 - 2013-06-26 05:01 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2013-09-11 14:40 - 2013-06-26 04:59 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys
2013-09-11 14:40 - 2013-06-25 00:54 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-09-11 14:40 - 2013-06-25 00:54 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2013-09-11 14:40 - 2013-06-25 00:54 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2013-09-11 14:40 - 2013-06-19 07:36 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\winmmbase.dll
2013-09-11 14:40 - 2013-06-19 07:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2013-09-11 14:40 - 2013-06-19 00:38 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmmbase.dll
2013-09-11 14:40 - 2013-06-19 00:38 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2013-09-11 14:40 - 2013-06-12 01:43 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2013-09-11 14:40 - 2013-06-12 01:26 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2013-09-11 14:40 - 2013-06-10 23:17 - 00096512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2013-09-11 14:40 - 2013-06-10 21:16 - 00888832 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-09-11 14:40 - 2013-06-10 21:15 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-09-11 14:40 - 2013-06-10 21:15 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2013-09-11 14:40 - 2013-06-10 21:15 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-09-11 14:40 - 2013-06-10 21:10 - 00702464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-09-11 14:40 - 2013-06-10 21:10 - 00245248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-09-11 14:40 - 2013-06-06 10:03 - 00119040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2013-09-11 14:39 - 2013-08-03 06:30 - 04038144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-08 16:40 - 2013-09-08 17:25 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\vlc
2013-09-08 16:39 - 2013-09-08 16:39 - 00000000 ____D C:\Program Files (x86)\VideoLAN
==================== One Month Modified Files and Folders =======
2013-10-07 06:35 - 2013-10-06 23:37 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-07 06:34 - 2013-10-06 23:35 - 00000000 ____D C:\Users\Jola und Klaus\Desktop\mbar
2013-10-07 04:16 - 2013-08-12 19:38 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-07 04:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-10-07 02:20 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-10-07 00:41 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-06 23:43 - 2013-07-24 01:51 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3233286183-1029804279-3505129346-1001
2013-10-06 23:37 - 2013-10-06 23:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-06 23:33 - 2013-10-06 23:33 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Jola und Klaus\Desktop\mbar-1.07.0.1005.exe
2013-10-06 23:21 - 2013-10-06 23:21 - 00035900 _____ C:\Users\Jola und Klaus\Downloads\FRST.txt
2013-10-06 23:21 - 2013-10-06 23:18 - 00017312 _____ C:\Users\Jola und Klaus\Downloads\Addition.txt
2013-10-06 23:16 - 2013-10-06 23:16 - 00000000 ____D C:\FRST
2013-10-06 22:52 - 2013-10-06 20:53 - 00098375 _____ C:\Windows\WindowsUpdate.log
2013-10-06 22:46 - 2013-10-06 22:44 - 01954124 _____ (Farbar) C:\Users\Jola und Klaus\Desktop\FRST64.exe
2013-10-06 21:06 - 2013-10-06 21:06 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\MusicPlayer
2013-10-06 21:04 - 2013-10-06 20:44 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\Mp3tag
2013-10-06 20:50 - 2013-09-24 15:29 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\CrashDumps
2013-10-06 20:43 - 2013-10-06 20:43 - 00000000 ____D C:\Program Files (x86)\Mp3tag
2013-10-06 20:41 - 2013-10-06 20:36 - 00000000 ____D C:\ProgramData\eSafe
2013-10-06 20:39 - 2013-10-06 20:34 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-10-06 20:38 - 2013-10-06 20:33 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-10-06 20:36 - 2013-10-06 20:35 - 02634152 _____ C:\Users\Jola und Klaus\Downloads\mp3tagv258setup.exe
2013-10-06 20:35 - 2013-07-24 09:22 - 00001423 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-06 20:35 - 2013-07-24 01:45 - 00001766 _____ C:\Users\Jola und Klaus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-10-06 20:34 - 2013-10-06 20:34 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\BonanzaDealsLive
2013-10-06 20:34 - 2013-10-06 20:34 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-10-06 20:33 - 2013-10-06 20:33 - 00002668 _____ C:\Windows\System32\Tasks\DigitalSite
2013-10-06 20:33 - 2013-10-06 20:33 - 00000330 _____ C:\Windows\Tasks\DigitalSite.job
2013-10-06 20:33 - 2013-10-06 20:33 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\DigitalSite
2013-10-06 20:33 - 2013-10-06 20:33 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\Google
2013-10-06 20:33 - 2013-10-06 20:33 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-10-06 20:32 - 2013-10-06 20:32 - 00679000 _____ C:\Users\Jola und Klaus\Downloads\ImageEditorSetup.exe
2013-10-06 20:25 - 2012-08-28 06:00 - 00753134 _____ C:\Windows\system32\perfh007.dat
2013-10-06 20:25 - 2012-08-28 06:00 - 00155826 _____ C:\Windows\system32\perfc007.dat
2013-10-06 20:25 - 2012-07-26 09:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-04 19:04 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-10-01 19:07 - 2012-07-26 07:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-09-24 15:21 - 2013-09-24 15:16 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\ArcSoft
2013-09-24 15:17 - 2013-09-24 15:17 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\ArcSoft
2013-09-24 15:17 - 2013-07-24 01:45 - 00000000 ___RD C:\Users\Jola und Klaus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-24 15:17 - 2013-07-24 01:45 - 00000000 ___RD C:\Users\Jola und Klaus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-24 15:16 - 2013-09-24 15:16 - 00001969 _____ C:\Users\Public\Desktop\TotalMedia 3.5.lnk
2013-09-24 15:16 - 2013-09-24 15:16 - 00000000 ____D C:\ProgramData\ArcSoft
2013-09-24 15:15 - 2013-09-24 15:15 - 00000000 ____D C:\Program Files (x86)\ArcSoft
2013-09-24 15:15 - 2012-08-02 13:32 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-24 15:13 - 2012-08-27 20:22 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-09-24 15:12 - 2013-09-24 15:12 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\InstallShield
2013-09-19 16:24 - 2013-07-24 09:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-19 15:54 - 2013-07-24 09:22 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Local\Mozilla
2013-09-19 01:26 - 2013-07-23 23:42 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-19 01:26 - 2013-07-23 23:42 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-18 15:26 - 2013-09-18 15:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-15 16:44 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\WinStore
2013-09-15 16:44 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-09-15 16:43 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-09-15 16:10 - 2013-07-24 08:48 - 00000000 ____D C:\Windows\system32\MRT
2013-09-15 16:06 - 2013-07-23 23:22 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-13 17:15 - 2013-09-13 17:15 - 00335904 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 19:24 - 2013-09-12 19:24 - 00000000 ____D C:\65523015a903183ce7f3243e9ece
2013-09-11 14:16 - 2013-08-12 19:38 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-08 17:25 - 2013-09-08 16:40 - 00000000 ____D C:\Users\Jola und Klaus\AppData\Roaming\vlc
2013-09-08 16:39 - 2013-09-08 16:39 - 00000000 ____D C:\Program Files (x86)\VideoLAN
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-06 22:43
==================== End Of Log ============================
|
| Themen zu Windows 8: qvo6.com als Zwangsstartseite in Firefox und Internet Explorer |
| .com, computer, cpu, defender, farbar, farbar recovery scan tool, fehler, fehlercode 1, firefox, flash player, home, homepage, iexplore.exe, installation, internet, internet explorer, launch, mozilla, mp3, msiinstaller, nicht installiert, programm, realtek, registry, scan, security, services.exe, software, svchost.exe, windows, wlan |
Baum-Darstellung