| |
| |||||||
Log-Analyse und Auswertung: ZeuS/ZBot Abuse SicherheitswarnungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
20.11.2013, 19:41
| #1 |
 |  ZeuS/ZBot Abuse Sicherheitswarnung Ich bitte euch inständig um Hilfe mit diesem Mistvieh ZeuS. Ich hab gefühlte 1000 Scanner ausprobiert und keiner findet was. Da ist er jedoch definitiv, da bin ich mir Sicher. Und seid bitte gnädig mit mir, ich bin nicht die größte Heldin wenns um IT geht.  jetzt schon mal ein rießen  Hier die ersten Logs: FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by ###### (administrator) on ANNY-HP on 20-11-2013 18:41:02
Running from C:\Users\#####\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
(arvato digital services llc) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIJE.EXE
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicatorCom.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google) C:\Program Files (x86)\Google\Google Earth\plugin\geplugin.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\#####\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\#####\Downloads\Defogger.exe
(Farbar) C:\Users\#####\Downloads\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-17] (Synaptics Incorporated)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [HP Officejet 4620 series (NET)] - C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\System32\spool\drivers\x64\3\E_IATIIJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
MountPoints2: {b3873478-48a6-11e3-b71f-101f7411b07d} - G:\LGAutoRun.exe
MountPoints2: {ea208004-7d1a-11e2-bcec-101f7411b07d} - G:\setup.exe -a
MountPoints2: {fd6a0764-7891-11e1-8673-101f7411b07d} - H:\LaunchU3.exe -a
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-03-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-02-15] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-03-16] (EasyBits Software AS)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-06-14] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [CitrixReceiver] - "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [Redirector] - C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-06-14] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [AirPort Base Station Agent] - C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
Startup: C:\Users\#####\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citrix Receiver.lnk
ShortcutTarget: Citrix Receiver.lnk -> C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe (Citrix Systems, Inc.)
Startup: C:\Users\#####\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\#####\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4620 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4620 series (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 4620 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
URLSearchHook: HKLM-x32 - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
URLSearchHook: HKCU - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {00DB204B-7265-4A18-A6E0-7445FEEC4D7B} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {00DB204B-7265-4A18-A6E0-7445FEEC4D7B} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKCU - {00DB204B-7265-4A18-A6E0-7445FEEC4D7B} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-04-09] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR HomePage: hxxp://www.google.de/ig?hl=de&source=iglk
CHR RestoreOnStartup: "hxxp://www.google.de/ig?hl=de&source=iglk"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\#####\u#\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\#####\#\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\#####\#\AppData\Local\Google\Chrome\Application\31.0.1650.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\#####\#\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.50.255) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\#####\#\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll No File
CHR Plugin: (Google Update) - C:\Users\##### \#\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (All Java Sources) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aleifhehdjlljnlbaplopcbnbgifpphg\0.96_0
CHR Extension: (DVDVideoSoftTB DE) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhphemoobgnikcoofkgackkaimpfmenm\10.22.3.518_0
CHR Extension: (YouTube) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.14_0
CHR Extension: (SaveFrom.net helper lite) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdpljndcmbeikfnlflcggaipgnhiedbl\2.23_0
CHR Extension: (Notes) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\molpbbfgiohpdmhnpadnonkfgahjfbem\1.0.1_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (Google Wallet) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Bitdefender QuickScan) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.131_0
CHR Extension: (Gmail) - C:\Users\####~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [fdloijijlkoblmigdofommgnheckmaki] - C:\Users\####~1\AppData\Local\funmoods.crx
CHR HKLM-x32\...\Chrome\Extension: [bhphemoobgnikcoofkgackkaimpfmenm] - C:\Users\####\AppData\Local\CRE\bhphemoobgnikcoofkgackkaimpfmenm.crx
CHR HKLM-x32\...\Chrome\Extension: [dfaldikcoaplhepekpbngkepfcoiihef] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR StartMenuInternet: Google Chrome - C:\Users\####\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 HPSLPSVC; C:\Users\####\AppData\Local\Temp\7zS3443\HPSLPSVC64.DLL [1039360 2011-11-14] (Hewlett-Packard Co.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
S3 Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe /RunAsService [x]
==================== Drivers (Whitelisted) ====================
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20101123.003\BHDrvx64.sys [953904 2010-11-23] (Symantec Corporation)
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2011-01-06] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [132656 2011-01-06] (Symantec Corporation)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2013-11-17] ()
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20101201.001\IDSVia64.sys [476792 2010-11-11] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110106.003\ENG64.SYS [117880 2011-01-06] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110106.003\EX64.SYS [1791096 2011-01-06] (Symantec Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1206000.01D\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1206000.01D\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2012-02-03] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [382584 2011-03-22] (Symantec Corporation)
S3 massfilter; system32\drivers\massfilter.sys [x]
S3 massfilter_hs; system32\drivers\massfilter_hs.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-20 18:41 - 2013-11-20 18:41 - 00031399 _____ C:\Users\####\Downloads\FRST.txt
2013-11-20 18:40 - 2013-11-20 18:40 - 01957964 _____ (Farbar) C:\Users\####\Downloads\FRST64 (1).exe
2013-11-20 18:40 - 2013-11-20 18:40 - 00000000 ____D C:\FRST
2013-11-20 18:39 - 2013-11-20 18:39 - 00000486 _____ C:\Users\####\Downloads\defogger_disable.log
2013-11-20 18:39 - 2013-11-20 18:39 - 00000000 _____ C:\Users\####\defogger_reenable
2013-11-20 18:38 - 2013-11-20 18:38 - 00050477 _____ C:\Users\####\Downloads\Defogger.exe
2013-11-19 22:19 - 2013-11-19 22:19 - 00000000 ____D C:\ProgramData\Visan
2013-11-19 22:19 - 2013-11-19 22:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-11-19 22:19 - 2013-11-19 22:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-11-19 17:51 - 2013-11-19 17:53 - 126764512 _____ C:\Users\####\Downloads\avira_free1401_antivirus_de.exe
2013-11-19 17:47 - 2013-11-19 17:47 - 00237056 _____ (SC BitDefender , Romania) C:\Users\####\Downloads\ZbotRemovalTool.exe
2013-11-18 19:48 - 2013-11-18 19:48 - 02347384 _____ (ESET) C:\Users\####\Downloads\esetsmartinstaller_enu.exe
2013-11-18 19:15 - 2013-11-18 19:59 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-18 19:14 - 2013-11-18 19:14 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-18 19:13 - 2013-11-18 19:59 - 00000000 ____D C:\Users\####\Desktop\mbar
2013-11-18 19:13 - 2013-11-18 19:13 - 12576792 _____ (Malwarebytes Corp.) C:\Users\####\Downloads\mbar-1.07.0.1007.exe
2013-11-18 05:55 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-18 05:55 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-18 05:55 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-18 05:55 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-18 05:55 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-18 05:55 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-18 05:55 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-18 05:55 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-18 05:55 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-18 05:55 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-18 05:55 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-18 05:55 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-18 05:48 - 2013-11-18 05:48 - 00590776 _____ C:\Windows\Minidump\111813-23478-01.dmp
2013-11-17 21:35 - 2013-11-17 21:35 - 00377856 _____ C:\Users\####\Downloads\kbh25ryd.exe
2013-11-17 21:32 - 2013-11-17 21:32 - 00377856 _____ C:\Users\####\Downloads\wlge7vdk.exe
2013-11-17 21:29 - 2013-11-17 21:29 - 22791896 _____ (Microsoft Corporation) C:\Users\####\Downloads\Windows-KB890830-x64-V5.6.exe
2013-11-17 19:26 - 2013-11-17 19:26 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-17 19:26 - 2013-11-17 19:26 - 00000000 ____D C:\Users\####\AppData\Roaming\Malwarebytes
2013-11-17 19:26 - 2013-11-17 19:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-17 19:26 - 2013-11-17 19:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-17 19:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-17 19:25 - 2013-11-17 19:25 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\####\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-17 15:21 - 2013-11-17 15:21 - 00001845 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2013-11-17 15:21 - 2013-11-17 15:21 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-11-17 15:20 - 2013-11-17 15:20 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-17 15:19 - 2013-11-17 15:20 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-17 15:19 - 2013-11-17 15:20 - 00000000 ____D C:\Program Files\iTunes
2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 ____D C:\Program Files\iPod
2013-11-17 12:35 - 2013-11-17 12:35 - 00014428 _____ C:\Windows\system32\.crusader
2013-11-17 12:27 - 2013-11-17 12:37 - 00032512 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2013-11-17 12:26 - 2013-11-17 12:35 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-17 12:26 - 2013-11-17 12:26 - 10264904 _____ (SurfRight B.V.) C:\Users\####\Downloads\hitmanpro_x64.exe
2013-11-13 22:05 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 22:05 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 22:05 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 22:05 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 22:05 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 22:05 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 22:05 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 22:05 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 22:05 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 22:05 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 22:05 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 22:05 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 22:05 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 22:05 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 22:05 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 22:05 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 22:05 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 22:05 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 22:05 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 22:05 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 22:05 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 22:05 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 22:05 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 22:05 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 22:05 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 22:05 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 22:05 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 22:05 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 22:05 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 22:05 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-10 19:56 - 2013-11-10 20:19 - 00000000 ____D C:\Users\####\Desktop\TIM2
2013-11-08 09:43 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2013-11-08 09:43 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2013-11-08 09:43 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2013-11-08 09:43 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2013-11-08 09:43 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2013-11-08 09:43 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2013-11-08 09:43 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2013-11-08 09:43 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2013-11-08 09:43 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2013-11-08 09:43 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2013-11-08 09:43 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2013-11-08 09:43 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2013-11-08 09:43 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2013-11-08 09:43 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2013-11-08 09:43 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2013-11-08 09:43 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2013-11-08 09:43 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2013-11-08 09:43 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2013-11-08 09:43 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2013-11-08 09:43 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2013-11-08 09:43 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2013-11-08 09:43 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2013-11-08 09:43 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2013-11-08 09:43 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2013-11-08 09:43 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2013-11-08 09:43 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2013-11-08 09:43 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2013-11-08 09:43 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2013-11-08 09:43 - 2008-10-10 04:52 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2013-11-08 09:43 - 2008-10-10 04:52 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2013-11-08 09:43 - 2008-10-10 04:52 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2013-11-08 09:43 - 2008-10-10 04:52 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2013-11-08 09:43 - 2008-10-10 04:52 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2013-11-08 09:43 - 2008-10-10 04:52 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2013-11-08 09:43 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2013-11-08 09:43 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2013-11-08 09:43 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2013-11-08 09:43 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2013-11-08 09:43 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2013-11-08 09:43 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2013-11-08 09:43 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2013-11-08 09:43 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2013-11-08 09:43 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2013-11-08 09:43 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2013-11-08 09:43 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2013-11-08 09:43 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2013-11-08 09:43 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2013-11-08 09:43 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2013-11-08 09:43 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2013-11-08 09:43 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2013-11-08 09:43 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2013-11-08 09:43 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2013-11-08 09:43 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2013-11-08 09:43 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2013-11-08 09:43 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2013-11-08 09:43 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2013-11-08 09:43 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2013-11-08 09:43 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2013-11-08 09:43 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2013-11-08 09:43 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2013-11-08 09:43 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2013-11-08 09:43 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2013-11-08 09:43 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2013-11-08 09:43 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2013-11-08 09:43 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2013-11-08 09:43 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2013-11-08 09:43 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2013-11-08 09:43 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2013-11-08 09:43 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2013-11-08 09:43 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2013-11-08 09:43 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2013-11-08 09:43 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2013-11-08 09:43 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2013-11-08 09:43 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2013-11-08 09:43 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2013-11-08 09:43 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2013-11-08 09:43 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2013-11-08 09:43 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2013-11-08 09:43 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2013-11-08 09:43 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2013-11-08 09:43 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2013-11-08 09:43 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2013-11-08 09:43 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2013-11-08 09:43 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2013-11-08 09:43 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2013-11-08 09:43 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2013-11-08 09:43 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2013-11-08 09:43 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2013-11-08 09:43 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2013-11-08 09:43 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2013-11-08 09:43 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2013-11-08 09:43 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2013-11-08 09:43 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2013-11-08 09:43 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2013-11-08 09:43 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2013-11-08 09:43 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2013-11-08 09:43 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2013-11-08 09:43 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2013-11-08 09:43 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2013-11-08 09:43 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2013-11-08 09:43 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2013-11-08 09:43 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2013-11-08 09:43 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2013-11-08 09:43 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2013-11-08 09:43 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2013-11-08 09:43 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2013-11-08 09:43 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2013-11-08 09:43 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2013-11-08 09:43 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2013-11-08 09:43 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2013-11-08 09:43 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2013-11-08 09:43 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2013-11-08 09:43 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2013-11-08 09:43 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2013-11-08 09:43 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2013-11-08 09:43 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2013-11-08 09:43 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2013-11-08 09:43 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2013-11-08 09:43 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2013-11-08 09:43 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2013-11-08 09:43 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2013-11-08 09:43 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2013-11-08 09:43 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2013-11-08 09:43 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2013-11-08 09:43 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2013-11-08 09:43 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2013-11-08 09:43 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2013-11-08 09:43 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2013-11-08 09:43 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2013-11-08 09:43 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2013-11-08 09:43 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2013-11-08 09:43 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2013-11-08 09:43 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2013-11-08 09:43 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2013-11-08 09:43 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2013-11-08 09:43 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2013-11-08 09:43 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2013-11-08 09:43 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2013-11-08 09:43 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2013-11-08 09:43 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2013-11-08 09:43 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2013-11-08 09:43 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2013-11-08 09:43 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2013-11-08 09:43 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2013-11-08 09:43 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2013-11-08 09:43 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2013-11-08 09:43 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2013-11-08 09:43 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2013-11-08 09:40 - 2013-11-08 09:43 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-08 09:40 - 2013-11-08 09:42 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-08 09:40 - 2013-11-08 09:40 - 00292184 _____ (Microsoft Corporation) C:\Users\####\Downloads\dxwebsetup.exe
2013-11-08 09:29 - 2013-11-08 09:29 - 00262144 _____ C:\Windows\Minidump\110813-35989-01.dmp
2013-11-08 09:25 - 2013-11-08 09:32 - 00001794 _____ C:\Users\Public\Desktop\Lightworks (11.1).lnk
2013-11-08 09:25 - 2013-11-08 09:25 - 00000000 ____D C:\Users\Public\Documents\Lightworks
2013-11-08 09:25 - 2013-11-08 09:25 - 00000000 ____D C:\ProgramData\Geevs
2013-11-08 09:24 - 2013-11-08 09:32 - 00000000 ____D C:\Program Files\Lightworks
2013-11-08 09:22 - 2013-11-08 09:23 - 76074768 _____ (Lightworks) C:\Users\####\Downloads\nw_29603_setupfullbitexe.exe
2013-11-07 21:21 - 2013-11-07 21:22 - 00262144 _____ C:\Windows\Minidump\110713-24351-01.dmp
2013-11-05 19:52 - 2013-11-05 19:52 - 00013485 _____ C:\Users\####\Desktop\tickets - Verknüpfung.lnk
2013-11-05 18:24 - 2013-11-05 18:24 - 00266288 _____ C:\Windows\Minidump\110513-23056-01.dmp
2013-11-01 00:07 - 2013-11-01 00:07 - 00262144 _____ C:\Windows\Minidump\110113-23602-01.dmp
2013-10-31 18:29 - 2013-10-31 18:29 - 00846864 _____ (Microsoft Corporation) C:\Users\####\Downloads\IE10-Windows6.1-en-us.exe
2013-10-31 18:10 - 2013-10-31 18:10 - 00266288 _____ C:\Windows\Minidump\103113-28142-01.dmp
2013-10-31 17:45 - 2013-10-31 17:45 - 00266288 _____ C:\Windows\Minidump\103113-25334-01.dmp
2013-10-29 07:02 - 2013-10-29 07:02 - 00262144 _____ C:\Windows\Minidump\102913-20638-01.dmp
2013-10-26 19:32 - 2013-10-26 19:32 - 00000871 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-26 19:31 - 2013-10-26 19:31 - 23280480 _____ C:\Users\####\Downloads\vlc-2.1.0-win64.exe
2013-10-26 19:31 - 2013-10-26 19:31 - 00000000 ____D C:\Program Files\VideoLAN
==================== One Month Modified Files and Folders =======
2013-11-20 18:41 - 2013-11-20 18:41 - 00031399 _____ C:\Users\####\Downloads\FRST.txt
2013-11-20 18:40 - 2013-11-20 18:40 - 01957964 _____ (Farbar) C:\Users\####\Downloads\FRST64 (1).exe
2013-11-20 18:40 - 2013-11-20 18:40 - 00000000 ____D C:\FRST
2013-11-20 18:40 - 2012-02-01 19:00 - 00001148 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000UA.job
2013-11-20 18:39 - 2013-11-20 18:39 - 00000486 _____ C:\Users\####\Downloads\defogger_disable.log
2013-11-20 18:39 - 2013-11-20 18:39 - 00000000 _____ C:\Users\####\defogger_reenable
2013-11-20 18:39 - 2012-02-01 17:25 - 00000000 ____D C:\Users\####
2013-11-20 18:38 - 2013-11-20 18:38 - 00050477 _____ C:\Users\####\Downloads\Defogger.exe
2013-11-20 18:36 - 2012-03-23 19:30 - 00000000 ____D C:\Users\####\Desktop\Krimskrams
2013-11-20 17:55 - 2013-06-27 23:30 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-20 17:53 - 2012-09-24 07:29 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-20 17:21 - 2012-04-17 21:50 - 00000956 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000UA.job
2013-11-20 17:19 - 2011-08-08 16:19 - 01813730 _____ C:\Windows\WindowsUpdate.log
2013-11-20 16:40 - 2012-02-01 19:00 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000Core.job
2013-11-20 16:20 - 2012-04-17 21:50 - 00000934 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000Core.job
2013-11-20 08:48 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-20 08:48 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-20 08:47 - 2011-04-10 05:19 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-11-20 08:47 - 2011-04-10 05:19 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-11-20 08:47 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-20 08:41 - 2013-06-27 23:30 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-20 08:41 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-20 08:40 - 2009-07-14 05:51 - 00092287 _____ C:\Windows\setupact.log
2013-11-20 07:02 - 2013-10-05 20:38 - 00000000 ____D C:\Users\####\AppData\Roaming\HpUpdate
2013-11-19 22:19 - 2013-11-19 22:19 - 00000000 ____D C:\ProgramData\Visan
2013-11-19 22:19 - 2013-11-19 22:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-11-19 22:19 - 2013-11-19 22:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-11-19 17:53 - 2013-11-19 17:51 - 126764512 _____ C:\Users\####\Downloads\avira_free1401_antivirus_de.exe
2013-11-19 17:47 - 2013-11-19 17:47 - 00237056 _____ (SC BitDefender , Romania) C:\Users\####\Downloads\ZbotRemovalTool.exe
2013-11-19 11:21 - 2010-11-21 04:27 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-19 09:15 - 2012-02-01 21:43 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-19 09:15 - 2012-02-01 21:43 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-19 09:15 - 2012-02-01 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-18 21:16 - 2012-05-05 13:31 - 00000000 ____D C:\Users\####\AppData\Roaming\Skype
2013-11-18 19:59 - 2013-11-18 19:15 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-18 19:59 - 2013-11-18 19:13 - 00000000 ____D C:\Users\####\Desktop\mbar
2013-11-18 19:48 - 2013-11-18 19:48 - 02347384 _____ (ESET) C:\Users\####\Downloads\esetsmartinstaller_enu.exe
2013-11-18 19:14 - 2013-11-18 19:14 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-18 19:13 - 2013-11-18 19:13 - 12576792 _____ (Malwarebytes Corp.) C:\Users\####\Downloads\mbar-1.07.0.1007.exe
2013-11-18 18:39 - 2012-03-18 23:57 - 00000000 ____D C:\Users\####\Documents\Youcam
2013-11-18 18:29 - 2012-05-05 13:31 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-18 18:29 - 2012-05-05 13:31 - 00000000 ____D C:\ProgramData\Skype
2013-11-18 17:55 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-18 05:56 - 2012-02-01 19:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-18 05:48 - 2013-11-18 05:48 - 00590776 _____ C:\Windows\Minidump\111813-23478-01.dmp
2013-11-18 05:48 - 2012-07-06 15:01 - 1151112258 _____ C:\Windows\MEMORY.DMP
2013-11-18 05:48 - 2012-07-06 15:01 - 00000000 ____D C:\Windows\Minidump
2013-11-17 21:35 - 2013-11-17 21:35 - 00377856 _____ C:\Users\####\Downloads\kbh25ryd.exe
2013-11-17 21:35 - 2012-02-01 19:14 - 00000000 ____D C:\Users\####\AppData\Local\CrashDumps
2013-11-17 21:32 - 2013-11-17 21:32 - 00377856 _____ C:\Users\####\Downloads\wlge7vdk.exe
2013-11-17 21:29 - 2013-11-17 21:29 - 22791896 _____ (Microsoft Corporation) C:\Users\####\Downloads\Windows-KB890830-x64-V5.6.exe
2013-11-17 21:26 - 2010-11-21 04:47 - 00069264 _____ C:\Windows\PFRO.log
2013-11-17 19:26 - 2013-11-17 19:26 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-17 19:26 - 2013-11-17 19:26 - 00000000 ____D C:\Users\####\AppData\Roaming\Malwarebytes
2013-11-17 19:26 - 2013-11-17 19:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-17 19:26 - 2013-11-17 19:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-17 19:25 - 2013-11-17 19:25 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\####\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-17 15:21 - 2013-11-17 15:21 - 00001845 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2013-11-17 15:21 - 2013-11-17 15:21 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-11-17 15:20 - 2013-11-17 15:20 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-17 15:20 - 2013-11-17 15:19 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-17 15:20 - 2013-11-17 15:19 - 00000000 ____D C:\Program Files\iTunes
2013-11-17 15:20 - 2013-10-19 20:47 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 ____D C:\Program Files\iPod
2013-11-17 15:14 - 2012-02-01 17:28 - 00000000 ____D C:\Users\####\AppData\Roaming\hpqlog
2013-11-17 12:37 - 2013-11-17 12:27 - 00032512 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2013-11-17 12:35 - 2013-11-17 12:35 - 00014428 _____ C:\Windows\system32\.crusader
2013-11-17 12:35 - 2013-11-17 12:26 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-17 12:26 - 2013-11-17 12:26 - 10264904 _____ (SurfRight B.V.) C:\Users\####\Downloads\hitmanpro_x64.exe
2013-11-16 22:13 - 2012-03-13 20:19 - 00000000 ____D C:\ProgramData\Apple Computer
2013-11-10 20:19 - 2013-11-10 19:56 - 00000000 ____D C:\Users\####\Desktop\TIM2
2013-11-10 19:51 - 2012-03-13 20:19 - 00000000 ____D C:\Users\####\AppData\Roaming\Apple Computer
2013-11-08 19:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-11-08 09:43 - 2013-11-08 09:40 - 00000000 ____D C:\Windows\SysWOW64\directx
2013-11-08 09:43 - 2011-04-09 19:44 - 00010123 _____ C:\Windows\DirectX.log
2013-11-08 09:42 - 2013-11-08 09:40 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-11-08 09:40 - 2013-11-08 09:40 - 00292184 _____ (Microsoft Corporation) C:\Users\####\Downloads\dxwebsetup.exe
2013-11-08 09:32 - 2013-11-08 09:25 - 00001794 _____ C:\Users\Public\Desktop\Lightworks (11.1).lnk
2013-11-08 09:32 - 2013-11-08 09:24 - 00000000 ____D C:\Program Files\Lightworks
2013-11-08 09:30 - 2012-03-02 17:32 - 00000000 ____D C:\Users\####\Desktop\Fotos
2013-11-08 09:29 - 2013-11-08 09:29 - 00262144 _____ C:\Windows\Minidump\110813-35989-01.dmp
2013-11-08 09:25 - 2013-11-08 09:25 - 00000000 ____D C:\Users\Public\Documents\Lightworks
2013-11-08 09:25 - 2013-11-08 09:25 - 00000000 ____D C:\ProgramData\Geevs
2013-11-08 09:23 - 2013-11-08 09:22 - 76074768 _____ (Lightworks) C:\Users\####\Downloads\nw_29603_setupfullbitexe.exe
2013-11-07 21:22 - 2013-11-07 21:21 - 00262144 _____ C:\Windows\Minidump\110713-24351-01.dmp
2013-11-07 16:00 - 2012-02-19 20:10 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-06 03:23 - 2013-09-11 08:07 - 00000000 ____D C:\Users\####\AppData\Roaming\ICAClient
2013-11-06 03:23 - 2012-12-20 20:54 - 00000000 ____D C:\Users\####\AppData\Local\Wuala
2013-11-06 03:23 - 2012-11-22 13:20 - 00000000 ____D C:\Users\####\AppData\Roaming\vlc
2013-11-06 03:23 - 2012-02-01 17:29 - 00000000 ___RD C:\Users\####\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-06 03:23 - 2011-08-08 16:27 - 00000000 ____D C:\ProgramData\Norton
2013-11-06 03:23 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-11-06 03:22 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-11-05 19:52 - 2013-11-05 19:52 - 00013485 _____ C:\Users\####\Desktop\tickets - Verknüpfung.lnk
2013-11-05 18:24 - 2013-11-05 18:24 - 00266288 _____ C:\Windows\Minidump\110513-23056-01.dmp
2013-11-01 00:07 - 2013-11-01 00:07 - 00262144 _____ C:\Windows\Minidump\110113-23602-01.dmp
2013-10-31 18:36 - 2013-10-16 02:13 - 00014202 _____ C:\Windows\IE10_main.log
2013-10-31 18:29 - 2013-10-31 18:29 - 00846864 _____ (Microsoft Corporation) C:\Users\####\Downloads\IE10-Windows6.1-en-us.exe
2013-10-31 18:10 - 2013-10-31 18:10 - 00266288 _____ C:\Windows\Minidump\103113-28142-01.dmp
2013-10-31 17:45 - 2013-10-31 17:45 - 00266288 _____ C:\Windows\Minidump\103113-25334-01.dmp
2013-10-29 07:02 - 2013-10-29 07:02 - 00262144 _____ C:\Windows\Minidump\102913-20638-01.dmp
2013-10-26 19:32 - 2013-10-26 19:32 - 00000871 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-26 19:31 - 2013-10-26 19:31 - 23280480 _____ C:\Users\####\Downloads\vlc-2.1.0-win64.exe
2013-10-26 19:31 - 2013-10-26 19:31 - 00000000 ____D C:\Program Files\VideoLAN
Some content of TEMP:
====================
C:\Users\####\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\####\AppData\Local\Temp\proxy_util_w32.dll
C:\Users\####\AppData\Local\Temp\SkypeSetup.exe
C:\Users\####\AppData\Local\Temp\vlc-2.0.8-win32.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-20 00:35
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-11-2013
Ran by########## at 2013-11-20 18:42:14
Running from C:\Users\########\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
==================== Installed Programs ======================
7-Zip 9.30 (x64 edition) (Version: 9.30.00.0)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212)
Adobe Flash Player 10 Plugin (x32 Version: 10.0.12.36)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.5.635)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)
AGIS (HKCU Version: 1.0)
AirPort (x32 Version: 5.6.1.2)
Apple Application Support (x32 Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (x32 Version: 2.1.3.127)
ATI Catalyst Install Manager (Version: 3.0.816.0)
AuthenTec TrueAPI (Version: 1.3.0.144)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Benutzerhandbuch - Grundlagen EPSON XP-402 403 405 406 Series (x32)
Benutzerhandbuch EPSON XP-402 403 405 406 Series (x32)
Big Rig Europe (x32 Version: 2.2.0.95)
Blasterball 3 (x32 Version: 2.2.0.95)
Bonjour (Version: 3.0.0.10)
Bounce Symphony (x32 Version: 2.2.0.95)
Broadcom 802.11 Wireless LAN Adapter (Version: 5.60.48.61)
Cake Mania (x32 Version: 2.2.0.95)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2011.0315.958.16016)
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0315.958.16016)
Catalyst Control Center InstallProxy (x32 Version: 2011.0315.958.16016)
Catalyst Control Center Localization All (x32 Version: 2011.0315.958.16016)
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0315.958.16016)
CCC Help Chinese Standard (x32 Version: 2011.0315.0957.16016)
CCC Help Chinese Traditional (x32 Version: 2011.0315.0957.16016)
CCC Help Czech (x32 Version: 2011.0315.0957.16016)
CCC Help Danish (x32 Version: 2011.0315.0957.16016)
CCC Help Dutch (x32 Version: 2011.0315.0957.16016)
CCC Help English (x32 Version: 2011.0315.0957.16016)
CCC Help Finnish (x32 Version: 2011.0315.0957.16016)
CCC Help French (x32 Version: 2011.0315.0957.16016)
CCC Help German (x32 Version: 2011.0315.0957.16016)
CCC Help Greek (x32 Version: 2011.0315.0957.16016)
CCC Help Hungarian (x32 Version: 2011.0315.0957.16016)
CCC Help Italian (x32 Version: 2011.0315.0957.16016)
CCC Help Japanese (x32 Version: 2011.0315.0957.16016)
CCC Help Korean (x32 Version: 2011.0315.0957.16016)
CCC Help Norwegian (x32 Version: 2011.0315.0957.16016)
CCC Help Polish (x32 Version: 2011.0315.0957.16016)
CCC Help Portuguese (x32 Version: 2011.0315.0957.16016)
CCC Help Russian (x32 Version: 2011.0315.0957.16016)
CCC Help Spanish (x32 Version: 2011.0315.0957.16016)
CCC Help Swedish (x32 Version: 2011.0315.0957.16016)
CCC Help Thai (x32 Version: 2011.0315.0957.16016)
CCC Help Turkish (x32 Version: 2011.0315.0957.16016)
ccc-utility64 (Version: 2011.0315.958.16016)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Citrix Authentication Manager (x32 Version: 5.0.0.60597)
Citrix Online Plug-in (Web) (x32 Version: 12.1.0.30)
Citrix Receiver (DV) (x32 Version: 14.0.0.91)
Citrix Receiver (HDX Flash-Umleitung) (x32 Version: 14.0.0.91)
Citrix Receiver (USB) (x32 Version: 14.0.0.91)
Citrix Receiver (x32 Version: 14.0.0.91)
Citrix Receiver Inside (x32 Version: 3.4.0.45902)
Citrix Receiver Updater (x32 Version: 4.0.0.45893)
Citrix Receiver(Aero) (x32 Version: 14.0.0.91)
Corel Graphics - Windows Shell Extension (Version: 16.0.0.707)
Corel Graphics - Windows Shell Extension (Version: 16.0.707)
Corel Graphics - Windows Shell Extension 32 Bit (Version: 16.0.707)
CorelDRAW Graphics Suite X6 - Capture (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Common (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Connect (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Custom Data (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - DE (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Draw (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Filters (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - FontNav (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - IPM (Version: 16.0)
CorelDRAW Graphics Suite X6 - PHOTO-PAINT (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Photozoom Plugin (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Redist (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Setup Files (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - VBA (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - VideoBrowser (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - VSTA (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 - Writing Tools (x64) (Version: 16.0)
CorelDRAW Graphics Suite X6 (64-Bit) (Version: 16.0.0.707)
CorelDRAW Graphics Suite X6 (x64) (Version: 16.0)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.95)
CyberLink YouCam (x32 Version: 3.5.1.3908)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
DHTML Editing Component (x32 Version: 6.02.0001)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)
DVDVideoSoftTB DE Toolbar (x32 Version: 6.9.0.16)
Easy Phone Tunes (x32 Version: 137)
EGecko (HKCU Version: 1.0)
Energy Star Digital Logo (x32 Version: 1.0.1)
Epson Easy Photo Print 2 (x32 Version: 2.3.2.0)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000)
Epson Event Manager (x32 Version: 3.01.0000)
EPSON Scan (x32)
EPSON XP-402 403 405 406 Series Printer Uninstall
EpsonNet Print (x32 Version: 2.5.00)
ESU for Microsoft Windows 7 (x32 Version: 1.0.0)
Evernote v. 4.2.2 (x32 Version: 4.2.2.3979)
Explorer (HKCU Version: 1.0)
Facebook Messenger 2.1.4814.0 (x32 Version: 2.1.4814.0)
Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)
Farm Frenzy (x32 Version: 2.2.0.95)
FATE (x32 Version: 2.2.0.95)
Fishdom (x32 Version: 2.2.0.95)
Free Audio CD to MP3 Converter version 1.3.12.1228 (x32 Version: 1.3.12.1228)
Free Audio Converter version 5.0.21.1212 (x32 Version: 5.0.21.1212)
Free Audio Dub version 1.7.9.908 (x32 Version: 1.7.9.908)
Free PDF to Word Doc Converter v1.1 (x32 Version: 1.1)
Free Video Dub version 2.0.17.128 (x32 Version: 2.0.17.128)
Free YouTube Download version 3.2.0.128 (x32 Version: 3.2.0.128)
Free YouTube to MP3 Converter version 3.12.0.128 (x32 Version: 3.12.0.128)
Funmoods Web Search (HKCU)
GIMP 2.8.2 (Version: 2.8.2)
Google Chrome (HKCU Version: 31.0.1650.57)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google SketchUp 8 (x32 Version: 3.0.14358)
Google Update Helper (x32 Version: 1.3.21.165)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (x32 Version: 1)
HP 3D DriveGuard (Version: 4.1.9.1)
HP Auto (Version: 1.0.12935.3667)
HP Client Services (Version: 1.1.12938.3539)
HP Connection Manager (x32 Version: 4.0.45.1)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7)
HP Documentation (x32 Version: 1.1.0.0)
HP Games (x32 Version: 1.0.2.4)
HP Officejet 4620 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Officejet 4620 series Hilfe (x32 Version: 6.0.0)
HP On Screen Display (x32 Version: 1.1.2)
HP Photo Creations (x32 Version: 1.0.0.9572)
HP Power Manager (x32 Version: 1.2.3)
HP Quick Launch (x32 Version: 2.3.6)
HP Setup (x32 Version: 8.6.4530.3651)
HP Setup Manager (x32 Version: 1.1.13231.3673)
HP SimplePass 2011 (x32 Version: 5.3.0.273)
HP Software Framework (x32 Version: 4.1.13.1)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Update (x32 Version: 5.003.003.001)
I.R.I.S. OCR (x32 Version: 12.3.4.0)
iCloud (Version: 3.0.2.163)
IDT Audio (x32 Version: 1.0.6329.0)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)
iTunes (Version: 11.1.3.8)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 6 Update 24 (64-bit) (Version: 6.0.240)
Java(TM) 6 Update 33 (x32 Version: 6.0.330)
JavaFX 2.1.1 (x32 Version: 2.1.1)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kalenderchen 5 (x32)
Kalender-Excel-8.8 (x32 Version: 8.8)
LEGO MINDSTORMS NXT - (Deutsch) Sprachenpaket (x32 Version: 2.0.100.0)
LEGO MINDSTORMS NXT Driver for x64 (Version: 1.17.770)
LEGO MINDSTORMS NXT Migration Package (x32 Version: 1.2.8.0)
LEGO MINDSTORMS NXT Software v2.0 (x32 Version: 2.0.108.0)
Lightworks (x32 Version: 11.1.0.0)
Magic Desktop (x32 Version: 3.0)
Mah Jong Medley (x32 Version: 2.2.0.95)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Home and Business 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Outlook 2010 (HKCU Version: 1.0)
Microsoft Security Client (Version: 4.4.0304.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 4.4.304.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual Basic for Applications 7.1 (x64) (Version: 7.1.00.00)
Microsoft Visual Basic for Applications 7.1 (x64) English (Version: 7.1.0.0)
Microsoft Visual Basic for Applications 7.1 (x64) German (Version: 7.1.0.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (x32 Version: 9.0.30729)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (x32 Version: 9.0.30729)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (x32 Version: 9.0.30729)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (x32 Version: 9.0.30729)
Microsoft Word 2010 (HKCU Version: 1.0)
MorphVOX Pro (x32 Version: 4.3.16)
Mozilla Maintenance Service (x32 Version: 17.0.6)
Mozilla Thunderbird 17.0.6 (x86 de) (x32 Version: 17.0.6)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Mystery P.I. - The London Caper (x32 Version: 2.2.0.95)
Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95)
Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0)
Nero Blu-ray Player (x32 Version: 12.0.17700)
Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.9000)
Nero ControlCenter (x32 Version: 11.0.15500)
Nero ControlCenter Help (CHM) (x32 Version: 12.0.7000)
Nero Core Components (x32 Version: 11.0.18900)
Nero Disc Menus Basic (x32 Version: 12.0.11500)
Nero Effects Basic (x32 Version: 12.0.11500)
Nero Kwik Media (x32 Version: 1.18.19600)
Nero Kwik Media Help (CHM) (x32 Version: 12.0.7000)
Nero Kwik Themes Basic (x32 Version: 12.0.11500)
Nero PiP Effects Basic (x32 Version: 12.0.11500)
Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0)
Nero Update (x32 Version: 11.0.11800.31.0)
Nero Video (x32 Version: 12.0.8000)
Nero Video 12 (x32 Version: 12.0.01000)
Nero Video Help (CHM) (x32 Version: 12.0.7000)
neroxml (x32 Version: 1.0.0)
Netzwerkhandbuch EPSON XP-402 403 405 406 Series (x32)
Norton Internet Security (x32 Version: 18.6.0.29)
Online Plug-in (x32 Version: 14.0.0.91)
Penguins! (x32 Version: 2.2.0.95)
Photo to Cartoon (x32 Version: 1.0.0)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Polar Bowler (x32 Version: 2.2.0.95)
Prerequisite installer (x32 Version: 12.0.0003)
Prozess-Landkarte (HKCU Version: 1.0)
PX Profile Update (x32 Version: 1.00.1.)
QuickTime (x32 Version: 7.74.80.86)
Realtek Ethernet Controller Driver (x32 Version: 7.41.216.2011)
Realtek PCIE Card Reader (x32 Version: 6.1.7600.74)
Recovery Manager (x32 Version: 2.0.0)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
Self-Service Plug-in (x32 Version: 4.0.0.40674)
Selling Version 1.2.35 (x32 Version: 1.2.35)
Skype™ 6.10 (x32 Version: 6.10.104)
Slingo Deluxe (x32 Version: 2.2.0.95)
Software Updater (x32 Version: 4.1.1)
SoulSeek 157 NS 13e (x32)
Studie zur Verbesserung von HP Officejet 4620 series Produkten (Version: 28.0.1315.0)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 15.2.4.4)
Synctunes Desktop (x32 Version: 1.1.0)
Terminplanung für Arztpraxen v2.06 Demo (x32)
Turbo Lister 2 (x32 Version: 2.00.0000)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
Update Installer for WildTangent Games App (x32)
Validity WBF DDK (Version: 4.3.118.0)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
VLC media player 2.1.0 (Version: 2.1.0)
Wedding Dash (x32 Version: 2.2.0.95)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.17)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)
Wuala (HKCU Version: 1.0.423.0)
Wuala CBFS (x32 Version: 3.2.107.0)
Wuala OverlayIcons (x32 Version: 1.0.0.2)
Zuma Deluxe (x32 Version: 2.2.0.95)
==================== Restore Points =========================
05-11-2013 17:35:29 Windows Update
08-11-2013 08:24:23 Microsoft Visual C++ 2005 Redistributable (x64) wird installiert
08-11-2013 08:42:20 DirectX wurde installiert
09-11-2013 10:26:26 Windows Update
13-11-2013 17:07:06 Windows Update
17-11-2013 07:05:58 Windows Update
18-11-2013 04:52:52 Windows Update
19-11-2013 08:14:40 Windows Update
20-11-2013 05:32:26 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {070F7364-5EF0-442D-9284-AF37BEA6E8A9} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-31] ()
Task: {0CCCEAEB-71EC-4664-A5EC-182EDD3F8CB8} - System32\Tasks\{D19DFB86-BE7D-4872-BE88-ECFB9E1B6A2C} => C:\Program Files (x86)\Blaze Audio\Voice Cloak Plus Trial\VoiceCloakPlus.exe
Task: {0D002376-8467-42B0-B672-F6058724E290} - System32\Tasks\{06D86622-D896-46B9-A96A-3C826E8D4406} => C:\Program Files (x86)\Blaze Audio\Voice Cloak Plus Trial\VoiceCloakPlus.exe
Task: {13B4D62B-22E1-4BED-832A-41D5DDECD96A} - System32\Tasks\Symantec\Norton Error Analyzer 18.6.0.29 => C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\symerr.exe [2011-04-29] (Symantec Corporation)
Task: {16A72C7B-92F3-46A3-BF09-9E54317E8193} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {2D87175B-104B-4F4A-93F4-69A5965C0AC2} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4E9C5679-4B49-4D86-9A9C-50D1D8596246} - System32\Tasks\HPCustParticipation HP Officejet 4620 series => C:\Program Files\HP\HP Officejet 4620 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {57DFFC28-7968-496A-A415-E6E3E94AAA2B} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5874455A-797D-4671-A5AA-DF00A35D03B2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
Task: {59380388-7899-48E8-924E-82A95ECD900F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-03-08] (CyberLink)
Task: {5BCE22F0-968B-4B23-85FD-74D5B4CDD6E1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {7ACE10F9-02EE-4401-9CC0-0C87716FB1D0} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000UA => C:\Users\#########\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-05-29] (Facebook Inc.)
Task: {7F6D2919-F2D2-4706-B959-611FA2C369C3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {876DE34D-12E1-4721-B8EE-B539D6017471} - System32\Tasks\{E82587B8-C2C7-4E90-A554-03E4408A8136} => C:\Program Files (x86)\Blaze Audio\Voice Cloak Plus Trial\VoiceCloakPlus.exe
Task: {90894C2E-FD6C-4546-8D62-FE60D2AFA020} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-27] (Google Inc.)
Task: {95CB1A59-BE35-4615-9051-023A4CD1D8EF} - System32\Tasks\{614BCC3B-2FFE-45EE-851F-91B20B673CB0} => C:\Program Files (x86)\Blaze Audio\Voice Cloak Plus Trial\VoiceCloakPlus.exe
Task: {A6F9ED11-8C78-4259-93FE-C844F639BEBA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)
Task: {B3E0FE72-954D-48D7-8038-5E47166CED36} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-27] (Google Inc.)
Task: {BE222695-099E-4C78-BB1B-1917CABB1926} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2012-10-29] (Microsoft)
Task: {C1BBAE0A-467E-482A-8D2F-0C63045A1D31} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000Core => C:\Users\#######\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-01] (Google Inc.)
Task: {CAC26E95-A9D7-4F2D-A5E1-3B7D252F06E2} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000Core => C:\Users\#######\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-05-29] (Facebook Inc.)
Task: {D8ECA8B4-9CFD-465C-A4D9-D71269639E27} - System32\Tasks\Symantec\Norton Error Processor 18.6.0.29 => C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\symerr.exe [2011-04-29] (Symantec Corporation)
Task: {E7627476-85EC-4FAA-8098-0F1111E8BFD2} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {E945C7F1-623E-4586-B0AB-5753FE4762DF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000UA => C:\Users\########\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-01] (Google Inc.)
Task: {F829B4E0-8308-49E0-8E44-EAF6A4050B59} - System32\Tasks\{E85CD784-2F1B-4C7F-9B3B-CC4C03E37B8F} => Chrome.exe hxxp://ui.skype.com/ui/0/5.1.0.104.161/de/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000Core.job => C:\Users\A#####\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000UA.job => C:\Users\#####\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000Core.job => C:\Users\#####\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136344677-1945465916-3901381102-1000UA.job => C:\Users\#####\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-08-08 16:15 - 2011-01-27 17:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-03-14 13:21 - 2011-03-14 13:21 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-03-15 08:57 - 2011-03-15 08:57 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-06-24 01:21 - 2010-06-24 01:21 - 01102336 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll
2012-02-20 21:29 - 2012-02-20 21:29 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 21:28 - 2012-02-20 21:28 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-11-17 07:59 - 2013-11-14 12:28 - 00702416 _____ () C:\Users\#####\AppData\Local\Google\Chrome\Application\31.0.1650.57\libglesv2.dll
2013-11-17 07:59 - 2013-11-14 12:28 - 00099792 _____ () C:\Users\#####\AppData\Local\Google\Chrome\Application\31.0.1650.57\libegl.dll
2013-11-17 07:59 - 2013-11-14 12:29 - 04055504 _____ () C:\Users\#####\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll
2013-11-17 07:59 - 2013-11-14 12:29 - 00399312 _____ () C:\Users\#####\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll
2013-11-17 07:59 - 2013-11-14 12:28 - 01619408 _____ () C:\Users\#####\AppData\Local\Google\Chrome\Application\31.0.1650.57\ffmpegsumo.dll
2013-08-16 04:29 - 2013-08-16 04:29 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9ab0e818cb3d1b6930eba54179f89300\IsdiInterop.ni.dll
2011-08-08 16:15 - 2011-01-13 02:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2010-06-24 01:19 - 2010-06-24 01:19 - 00514570 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll
2013-07-12 11:22 - 2013-07-12 11:22 - 01777664 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\QtCore4.dll
2013-07-12 11:25 - 2013-07-12 11:25 - 01224192 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\IGCore.dll
2013-07-12 11:25 - 2013-07-12 11:25 - 00290816 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\IGUtils.DLL
2013-07-12 11:25 - 2013-07-12 11:25 - 00631808 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\IGMath.dll
2013-07-12 11:26 - 2013-07-12 11:26 - 01393664 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\alchemy\ogles20\IGSg.dll
2013-07-12 11:26 - 2013-07-12 11:26 - 00751104 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\alchemy\ogles20\IGAttrs.dll
2013-07-12 11:26 - 2013-07-12 11:26 - 03105280 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\alchemy\ogles20\IGGfx.dll
2013-07-12 11:26 - 2013-07-12 11:26 - 00059392 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\alchemy\ogles20\libEGL.dll
2013-07-12 11:26 - 2013-07-12 11:26 - 00519168 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\alchemy\ogles20\libGLESv2.dll
2013-07-12 11:53 - 2013-07-12 11:53 - 17645056 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\googleearth_free.dll
2013-07-12 11:25 - 2013-07-12 11:25 - 00726016 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\IGExportCommon.dll
2013-07-12 11:25 - 2013-07-12 11:25 - 01050624 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\IGOpt.dll
2013-07-12 11:32 - 2013-07-12 11:32 - 00015872 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\alchemyext.dll
2013-07-12 11:22 - 2013-07-12 11:22 - 07877632 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\QtWebKit4.dll
2013-07-12 11:22 - 2013-07-12 11:22 - 06174208 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\QtGui4.dll
2013-07-12 11:22 - 2013-07-12 11:22 - 00518656 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\QtNetwork4.dll
2013-07-12 11:29 - 2013-07-12 11:29 - 00086528 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\ge_expat.dll
2013-07-12 11:25 - 2013-07-12 11:25 - 00145408 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\alchemy\optimizations\IGOptExtension.dll
2013-07-12 11:22 - 2013-07-12 11:22 - 00018944 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\imageformats\qgif4.dll
2013-07-12 11:22 - 2013-07-12 11:22 - 00158208 _____ () C:\Program Files (x86)\Google\Google Earth\plugin\imageformats\qjpeg4.dll
2013-11-17 07:59 - 2013-11-14 12:29 - 13582800 _____ () C:\Users\#####\AppData\Local\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: BHDrvx64
Description: BHDrvx64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: BHDrvx64
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Officejet 4620 series
Description: Officejet 4620 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/20/2013 06:37:33 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (11/20/2013 05:09:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Error: (11/20/2013 09:11:02 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6037
Error: (11/20/2013 09:11:02 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6037
Error: (11/20/2013 09:11:02 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (11/20/2013 09:11:01 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5038
Error: (11/20/2013 09:11:01 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5038
Error: (11/20/2013 09:11:01 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (11/20/2013 09:11:00 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4040
Error: (11/20/2013 09:11:00 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4040
System errors:
=============
Error: (11/20/2013 08:41:10 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
BHDrvx64
Error: (11/20/2013 08:40:51 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 20.11.2013 um 08:14:55 unerwartet heruntergefahren.
Error: (11/20/2013 08:39:35 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.
Error: (11/20/2013 08:39:05 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SysMain erreicht.
Error: (11/19/2013 05:42:31 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
BHDrvx64
Error: (11/18/2013 07:59:25 PM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES (X86)\ESET\ESET ONLINE SCANNER\ONLINECMDLINESCANNER.EXE
Error: (11/18/2013 07:59:25 PM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES (X86)\ESET\ESET ONLINE SCANNER\ONLINESCANNERAPP.EXE
Error: (11/18/2013 07:59:18 PM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\MICROSOFT SECURITY CLIENT\MSSECES.EXE
Error: (11/18/2013 07:59:18 PM) (Source: mbamchameleon) (User: )
Description: \Device\HarddiskVolume2\PROGRAM FILES\MICROSOFT SECURITY CLIENT\NISSRV.EXE
Error: (11/18/2013 07:59:17 PM) (Source: mbamchameleon) (User: )
Description: evice\HarddiskVolume2\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\18.6.0.29\CCSVCHST.EXE
Microsoft Office Sessions:
=========================
Error: (11/20/2013 06:37:33 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\#####\Downloads\esetsmartinstaller_enu.exe
Error: (11/20/2013 05:09:56 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Program Files (x86)\EPSON Software\Download Navigator\EPSDNAVI.EXE
Error: (11/20/2013 09:11:02 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6037
Error: (11/20/2013 09:11:02 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6037
Error: (11/20/2013 09:11:02 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (11/20/2013 09:11:01 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5038
Error: (11/20/2013 09:11:01 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5038
Error: (11/20/2013 09:11:01 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (11/20/2013 09:11:00 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4040
Error: (11/20/2013 09:11:00 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4040
CodeIntegrity Errors:
===================================
Date: 2012-12-26 10:01:24.346
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2012-12-26 10:01:24.322
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 44%
Total physical RAM: 8139.86 MB
Available physical RAM: 4545.31 MB
Total Pagefile: 16277.9 MB
Available Pagefile: 11541.64 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:450.41 GB) (Free:243.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:15.06 GB) (Free:1.64 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: ([N]2) (CDROM) (Total:0.14 GB) (Free:0 GB) UDF
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: EAA2A155)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-20 19:59:56
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950042
rev.0006 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\#####~1\AppData\Local\Temp\kwldrpob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528
fffff800031c0000 45 bytes [00, 00, 08, 02, 4D, 6D, 53, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575
fffff800031c002f 16 bytes [00, C5, 01, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4492] C:\Windows
\syswow64\psapi.dll!GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4492] C:\Windows
\syswow64\psapi.dll!GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4400] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4400] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe[4660] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe[4660] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[4992] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[4992] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[4168] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[4168] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[156] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[156] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[6048] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[6048] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[5824] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[5824] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe[8688] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe[8688] C:\Windows
\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4468] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4468] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
.text C:\Users\#####\Downloads\Defogger.exe[9608] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 69 0000000075001465 2 bytes [00, 75]
.text C:\Users\#####\Downloads\Defogger.exe[9608] C:\Windows\syswow64\PSAPI.DLL!
GetModuleInformation + 155 00000000750014bb 2 bytes [00, 75]
.text ... * 2
---- EOF - GMER 2.1
Geändert von an-ny (20.11.2013 um 20:09 Uhr) |
|
20.11.2013, 22:26
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | ZeuS/ZBot Abuse Sicherheitswarnung Hallo und
__________________ Wieso bist du dir so sicher, dass da etwas ist, also jetzt genau auf diesem Rechner. Oder hast du keine anderen Rechner in deinem Heimnetz? Zitat:
__________________ |
|
21.11.2013, 06:32
| #3 |
| | ZeuS/ZBot Abuse Sicherheitswarnung Hallo Cosinus,
__________________vielen Dank fürs annehmen und helfen  Zunächst, ich bin so sicher das da was ist weil ich gestern versucht habe ne Mail zu verschicken an die Firmenadresse einer Freundin. Der Virenschutz hat meine Mail geblockt. Hier mal ein Ausschnitt der Mail die ich bekam: Code:
ATTFilter mail.klema.at hat diesen Fehler ausgegeben:
Delivery from 62.218.22.114 rejected. Check at hxxp://www.commtouch.com/Site/Resources/Check_IP_Reputation.asp. Reference code: tid=0001.0A0C0302.528CE64C.004C
Fehler bei der Zustellung der Nachricht an diese E-Mail-Adresse. Versuchen Sie, die Nachricht erneut zu senden. Falls das Problem weiterhin besteht, wenden Sie sich an Ihr Helpdesk.
Diagnoseinformationen für Administratoren:
Generierender Server: KO-EXCHANGE.int.fantasie.com
mikey.mouse@fantasie.de
mail.klema.at #550-Delivery from 62.218.22.114 rejected. Check at 550-hxxp://www.commtouch.com/Site/Resources/Check_IP_Reputation.asp. Reference 550 code: tid=0001.0A0C0302.528CE64C.004C ##
Code:
ATTFilter Über Ihren Internetzugang wurde ein "Sinkhole" kontaktiert. Das ist ein
Server, der als Falle für durch Schadsoftware befallene Rechner dient,
indem er einen Command&Control-Server eines Botnets simuliert. Ein
Command&Control-Server ist ein Bestandteil eines Botnets, der zwischen
dem eigentlichen Verbrecher und seinen "Bots" vermittelt............
Bei den beschwerdegegenständlichen Zugriffen handelt es sich nicht um
den Versand von E-Mails. Die Steuerung der Bots erfolgt über die Ports
80 (HTTP) und 443 (HTTPS), das ist die übliche Vorgehensweise der
Botnetzbetreiber, da es keine Internetzugänge gibt, bei denen diese
Ports gesperrt sind. Per HTTP(S) aktualisieren sich die Bots, liefern
gestohlene Login-Daten ab und holen sich ihre Aufgabenlisten ab: An
DoS-Attacken teilnehmen, rechtswidrige Inhalte verbreiten, Spam
versenden, usw.......
Die beschwerdegegenständlichen Zugriffe fanden über die folgenden, Ihrem
Zugang zugewiesenen IP-Adressen zu den angegebenen Zeitpunkten statt,
die relevanten Zeitangaben aus den Beschwerden haben wir in die
jeweilige deutsche Zeitzone (MESZ/MEZ) umgerechnet:
87.145.85.214 Do, 07.11.2013 01:10:40 MEZ Ermahnung
Mögliche Ursache: Fremdnutzung des lokalen Netzwerks
 Kannst Du ihn mit mir aufspüren und einen Kopf kürzer machen? Und ja, es gibt noch ein Notebook(Kind) und 2 Handys(Android). Manchmal auch ein IPad, als Gast. MSE hab ich jetzt deaktiviert, muss Norton jetzt trotzdem runder? Bin voraussichtlich erst gegen 19:00Uhr wieder on. |
|
21.11.2013, 11:27
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ZeuS/ZBot Abuse SicherheitswarnungZitat:
Ich würde da eher auf das Notebook vom Kind tippen. Gab es da schon mal Funde oder hast du das Gerät noch nicht untersucht?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.11.2013, 21:32
| #5 |
| | ZeuS/ZBot Abuse Sicherheitswarnung Nein, das Notebook vom Sohnemann hab ich noch nicht gründlich durch da er seit er sich den Bundespolizeitrojaner eingefangen hatte, den wir professionell entfernen lassen mussten, nur noch Zugriff auf ein fast "rechteloses" Benutzerkonto hat. Aber man weiß nie... Dann wird das jetzt auch unter die Lupe kommen. Bin automatisch von meinem ausgegangen.  Logs folgen gleich. FRST läuft.... Läuft doch nicht..... ist eingefroren und lässt sich nicht beenden.... "Getting Application Errors 44936 " sagter auch noch Hab ihn über den Taskmanager beendet, ich versuchs gleich nochmal. Hier trotzdem die logs die er ausgespuckt hat: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by Administrator (administrator) on ACERASPIRE1410 on 21-11-2013 20:06:39
Running from C:\Users\Administrator\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Neuer Ordner\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\Administrator\Downloads\Defogger.exe
(Acer) C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-06] (Acer Incorporated)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [320000 2009-04-09] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKLM-x32\...\Run: [EgisTecLiveUpdate] - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Neuer Ordner\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Beschränkter Zugriff\...\Policies\system: [LogonHoursAction] 2
HKU\Beschränkter Zugriff\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\clean\...\Policies\system: [LogonHoursAction] 2
HKU\clean\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\Gast\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Gast\...\Policies\system: [LogonHoursAction] 2
HKU\Gast\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\TIMAdmin\...\Policies\system: [LogonHoursAction] 2
HKU\TIMAdmin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\TIMstandart\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\System32\spool\drivers\x64\3\E_IATIIJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\TIMstandart\...\Run: [Facebook Update] - C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-10-08] (Facebook Inc.)
HKU\TIMstandart\...\Policies\system: [LogonHoursAction] 2
HKU\TIMstandart\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\Beschränkter Zugriff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1410&r=273605105106l0393z1i5w4801r336
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1410&r=273605105106l0393z1i5w4801r336
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={2362DC32-D0E8-42CC-9A51-591180EB4266}
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={2362DC32-D0E8-42CC-9A51-591180EB4266}
SearchScopes: HKCU - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL =
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com/bin/srldetect_intel_4.5.15.0.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\rip7h9xf.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Neuer Ordner\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)
==================== Drivers (Whitelisted) ====================
U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
S3 int15.sys; C:\Windows\System32\OEM\Factory\int15.sys [17952 2008-03-28] (Acer, Inc.)
S1 mbmiodrvr; C:\Windows\syswow64\mbmiodrvr.sys [4608 2004-04-10] (cansoft@livewiredev.com)
U5 TMUSB; C:\Windows\System32\DRIVERS\TMUSB64.SYS [63096 2012-12-05] (Seiko Epson Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-21 20:07 - 2013-11-21 20:07 - 00000000 ____D C:\fd713a2d84aa2ee5bf96916f4e12
2013-11-21 20:06 - 2013-11-21 20:07 - 00011557 _____ C:\Users\Administrator\Downloads\FRST.txt
2013-11-21 20:06 - 2013-11-21 20:06 - 00000000 ____D C:\FRST
2013-11-21 20:02 - 2013-11-21 20:07 - 01957964 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2013-11-21 19:57 - 2013-11-21 19:57 - 00000488 _____ C:\Users\Administrator\Downloads\defogger_disable.log
2013-11-21 19:57 - 2013-11-21 19:57 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-11-21 19:56 - 2013-11-21 19:56 - 00050477 _____ C:\Users\Administrator\Downloads\Defogger.exe
2013-11-21 19:55 - 2013-11-21 19:55 - 00007605 _____ C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2013-11-18 06:10 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-18 06:09 - 2013-11-18 06:09 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-18 06:09 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-18 06:09 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-18 06:09 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-17 21:22 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 21:22 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-17 21:22 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-17 21:22 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-17 21:22 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-17 21:22 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 21:22 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-17 21:22 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-17 21:22 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-17 21:21 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 21:21 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 21:21 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 21:21 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-17 21:21 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-17 18:53 - 2013-11-17 19:01 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-17 18:44 - 2013-11-17 18:53 - 10264904 _____ (SurfRight B.V.) C:\Users\TIMstandart\Downloads\hitmanpro_x64.exe
2013-11-17 18:40 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-17 18:40 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-17 18:40 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-17 18:40 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-17 18:40 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-17 18:40 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-17 18:40 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-17 18:40 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-17 18:40 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-17 18:40 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-17 18:40 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-17 18:40 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-17 18:40 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-17 18:40 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-17 18:39 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-17 18:39 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-17 18:38 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-17 18:38 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-17 18:38 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-17 18:38 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-17 18:38 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-17 18:38 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-17 18:38 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-17 18:37 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-17 18:37 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-17 18:37 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-17 18:37 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-17 18:37 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-17 18:37 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-17 18:37 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-15 13:47 - 2013-11-15 13:47 - 00000193 _____ C:\Windows\WORDPAD.INI
==================== One Month Modified Files and Folders =======
2013-11-21 20:07 - 2013-11-21 20:07 - 00000000 ____D C:\fd713a2d84aa2ee5bf96916f4e12
2013-11-21 20:07 - 2013-11-21 20:06 - 00011557 _____ C:\Users\Administrator\Downloads\FRST.txt
2013-11-21 20:07 - 2013-11-21 20:02 - 01957964 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2013-11-21 20:07 - 2008-01-02 17:34 - 01410521 _____ C:\Windows\WindowsUpdate.log
2013-11-21 20:06 - 2013-11-21 20:06 - 00000000 ____D C:\FRST
2013-11-21 20:04 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-21 20:04 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-21 20:02 - 2010-06-05 03:53 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-21 19:57 - 2013-11-21 19:57 - 00000488 _____ C:\Users\Administrator\Downloads\defogger_disable.log
2013-11-21 19:57 - 2013-11-21 19:57 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-11-21 19:57 - 2013-07-15 18:36 - 00000000 ____D C:\Users\Administrator
2013-11-21 19:56 - 2013-11-21 19:56 - 00050477 _____ C:\Users\Administrator\Downloads\Defogger.exe
2013-11-21 19:55 - 2013-11-21 19:55 - 00007605 _____ C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2013-11-21 19:55 - 2011-12-19 16:36 - 00001174 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000UA.job
2013-11-21 19:54 - 2013-09-21 09:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-21 19:52 - 2010-11-17 12:21 - 00000442 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-11-21 19:52 - 2010-06-05 03:53 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-21 19:50 - 2013-03-06 21:26 - 00009972 _____ C:\Windows\setupact.log
2013-11-21 19:50 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 06:16 - 2013-07-20 13:58 - 00001340 __RSH C:\Users\TIMstandart\ntuser.pol
2013-11-18 06:16 - 2013-07-20 13:57 - 00000000 ____D C:\Users\TIMstandart
2013-11-18 06:15 - 2013-07-15 18:36 - 00000680 __RSH C:\Users\Administrator\ntuser.pol
2013-11-18 06:11 - 2013-09-22 08:16 - 00000000 ____D C:\ProgramData\Oracle
2013-11-18 06:09 - 2013-11-18 06:09 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-18 06:09 - 2010-09-24 10:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-17 21:20 - 2013-07-17 18:09 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 21:17 - 2011-05-26 07:40 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-17 20:49 - 2013-07-18 20:28 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-17 20:38 - 2010-10-11 07:01 - 00001156 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000UA.job
2013-11-17 20:11 - 2012-09-13 15:29 - 00000000 ____D C:\Program Files (x86)\SweetIM
2013-11-17 19:33 - 2013-10-08 15:28 - 00000952 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005UA.job
2013-11-17 19:01 - 2013-11-17 18:53 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-17 18:53 - 2013-11-17 18:44 - 10264904 _____ (SurfRight B.V.) C:\Users\TIMstandart\Downloads\hitmanpro_x64.exe
2013-11-15 13:50 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-15 13:50 - 2008-01-03 02:26 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-11-15 13:50 - 2008-01-03 02:26 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-11-15 13:49 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-15 13:47 - 2013-11-15 13:47 - 00000193 _____ C:\Windows\WORDPAD.INI
2013-11-04 17:44 - 2013-10-08 15:28 - 00000930 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005Core.job
2013-11-04 17:44 - 2011-12-19 16:36 - 00001152 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000Core.job
2013-11-04 17:44 - 2010-10-11 07:01 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000Core.job
Files to move or delete:
====================
C:\ProgramData\3fl9.pad
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Administrator\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\TIMstandart\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-11-2013
Ran by Administrator at 2013-11-21 20:09:17
Running from C:\Users\Administrator\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Acer Crystal Eye webcam Ver:1.1.95.714 (x32 Version: 1.1.95.714)
Acer ePower Management (x32 Version: 4.05.3002)
Acer eRecovery Management (x32 Version: 4.05.3003)
Acer GameZone Console (x32 Version: 5.1.0.2)
Acer GridVista (x32 Version: 3.01.0730)
Acer Registration (x32 Version: 1.02.3004)
Acer ScreenSaver (x32 Version: 1.05.0804)
Acer Updater (x32 Version: 1.01.3014)
Acer VCM (x32 Version: 4.05.3000)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.22.87)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.4.144)
Alcor Micro USB Card Reader (x32 Version: 1.2.17.05001)
Alice Greenfingers (x32)
Amazonia (x32)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.5)
Avira Free Antivirus (x32 Version: 14.0.0.383)
Bonjour (Version: 3.0.0.10)
Choice Guard (x32 Version: 1.2.87.0)
CyberLink PowerDVD 8 (x32 Version: 8.1.2815o.50)
Dairy Dash (x32)
DivX-Setup (x32 Version: 1.0.2.23)
Download Navigator (x32 Version: 3.3.0)
Druckerdeinstallation für EPSON XP-402 403 405 406 Series
eBay Worldwide (x32 Version: 2.1.0703)
EpsonNet Config V4 (x32 Version: 4.1.1)
eSobi v2 (x32 Version: 2.0.4.000274)
Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)
Free Audio CD Burner version 1.3 (x32)
Free YouTube to MP3 Converter version 3.5 (x32)
Google Update Helper (x32 Version: 1.3.21.165)
Granny In Paradise (x32)
Heroes of Hellas (x32)
iCloud (Version: 3.0.2.163)
Identity Card (x32 Version: 1.00.3001)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.1892)
Intel® Matrix Storage Manager
iTunes (Version: 11.0.4.4)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 24 (x32 Version: 6.0.240)
Junk Mail filter update (x32 Version: 14.0.8064.206)
Launch Manager (x32 Version: 3.0.02)
LibreOffice 4.0.4.2 (x32 Version: 4.0.4.2)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Merriam Websters Spell Jam (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Motherboard Monitor 5 (x32 Version: 5)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mozilla Maintenance Service (x32 Version: 24.0)
Mozilla Thunderbird (3.1.2) (x32 Version: 3.1.2 (de))
MSVCRT (x32 Version: 14.0.1468.721)
MyWinLocker (x32 Version: 3.1.72.0)
Network Guide L355 Series (x32)
Pflanzen gegen Zombies (x32)
Qualcomm Gobi Images (x32 Version: 1.0.24)
QuickTime (x32 Version: 7.74.80.86)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6873)
Star Defender 4 (x32)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 13.2.2.0)
System Requirements Lab for Intel (x32 Version: 4.5.15.0)
Ultra Defragmenter (x32 Version: 6.0.2)
Uninstall 1.0.0.1 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update Manager for SweetPacks 1.1 (x32 Version: 1.1.0008)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0)
VLC media player 2.0.7 (x32 Version: 2.0.7)
VoiceOver Kit (x32 Version: 1.42.128.0)
Welcome Center (x32 Version: 1.00.3005)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8064.0206)
Windows Live Essentials (x32 Version: 14.0.8064.206)
Windows Live Fotogalerie (x32 Version: 14.0.8064.206)
Windows Live Mail (x32 Version: 14.0.8064.0206)
Windows Live Messenger (x32 Version: 14.0.8064.0206)
Windows Live Sync (x32 Version: 14.0.8064.206)
Windows Live Writer (x32 Version: 14.0.8064.0206)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
==================== Restore Points =========================
10-10-2013 05:08:07 Windows Update
15-10-2013 11:37:27 Windows Update
18-10-2013 15:46:11 Windows Update
23-10-2013 12:18:48 Windows Update
04-11-2013 17:03:14 Windows Update
11-11-2013 20:10:02 Windows Update
17-11-2013 17:28:15 Windows Update
17-11-2013 20:16:46 Windows Update
18-11-2013 05:07:36 Installed Java 7 Update 45
21-11-2013 19:05:23 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {014F4AD7-6D70-444B-9807-AD497753D194} - System32\Tasks\{E9C03329-E2EF-468E-BFB7-4E0CBC23E7AD} => C:\Program Files (x86)\Skype\\Phone\Skype.exe
Task: {05797F1F-22C9-4F9C-A0A9-44E3933F7DA4} - System32\Tasks\{983E774A-5C88-4FF5-93A7-727170418C6D} => Firefox.exe hxxp://ui.skype.com/ui/0/5.0.0.156.259/de/eula?source=lightinstaller
Task: {0C964131-D290-4DBC-92B9-C088BF284E31} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000UA => C:\Users\Acer (1274211)\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {0E00BAC2-5F8C-4B17-9612-18E9EFF762A1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005UA => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-08] (Facebook Inc.)
Task: {2809FF90-F526-43F5-8E38-E2D3BA2F2840} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000Core => C:\Users\Acer (1274211)\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: {3A553F6F-2324-4696-B16A-9A24852CD152} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000Core => C:\Users\Acer (1274211)\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {64AAAF77-2283-490B-A64A-FA5F7C4BC0DE} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-07-09] (Acer)
Task: {92F7B44E-6D8D-4838-916F-3651F6338766} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005Core => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-08] (Facebook Inc.)
Task: {9314AB6A-2654-4D7C-9DE2-6E03A9BBEDF9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05] (Google Inc.)
Task: {A57D4420-A396-4FC6-A1AC-7630B4264A41} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {BC9BFAA0-57BC-43C7-9DD7-B75334765E36} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000UA => C:\Users\Acer (1274211)\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: {CD73BF22-F837-4137-9DDF-1352815F15DD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F837F008-44D0-4BC3-AD99-66DD4F33AB0C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000Core.job => C:\Users\Acer (1274211)\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000UA.job => C:\Users\Acer (1274211)\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005Core.job => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005UA.job => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000Core.job => C:\Users\Acer (1274211)\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1000UA.job => C:\Users\Acer (1274211)\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-07-16 04:42 - 2013-06-20 13:49 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-11-01 23:26 - 2011-11-01 23:26 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-11-01 23:26 - 2011-11-01 23:26 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-21 09:47 - 2013-09-21 09:47 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:0B9176C0
AlternateDataStreams: C:\ProgramData\Temp:1D32EC29
AlternateDataStreams: C:\ProgramData\Temp:4D066AD2
AlternateDataStreams: C:\ProgramData\Temp:5D7E5A8F
AlternateDataStreams: C:\ProgramData\Temp:93DE1838
AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D
AlternateDataStreams: C:\ProgramData\Temp:E3C56885
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/04/2013 05:46:59 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: EXCEPTION calling function IThread(ProtocolSrvConThread)::run() for the file
unknown
[ACCESS_VIOLATION Exception!! EIP = 0x73918fbc]
Please inform Avira and submit the appropriate file!
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-21 21:25:21
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.11.0 149,05GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\kgliaaow.sys
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [264:1900] 000007fef95988f8
Thread C:\Windows\System32\svchost.exe [264:896] 000007fef8f244e0
Thread C:\Windows\System32\svchost.exe [264:908] 000007fef7ba5fd0
Thread C:\Windows\System32\svchost.exe [264:3024] 000007fef31942c8
Thread C:\Windows\System32\svchost.exe [264:2704] 000007fef7ba63ec
Thread C:\Windows\system32\svchost.exe [884:1124] 000007fefa768274
Thread C:\Windows\system32\svchost.exe [884:1716] 000007fefa768274
Thread C:\Windows\system32\svchost.exe [1140:1732] 000007fef954bd88
Thread C:\Windows\system32\svchost.exe [1140:1856] 000007fef92a83d8
Thread C:\Windows\system32\svchost.exe [1140:1956] 000007fef8af3f1c
Thread C:\Windows\system32\svchost.exe [1140:1960] 000007fef8ac1a38
Thread C:\Windows\system32\svchost.exe [1140:1988] 000007fef8aa5388
Thread C:\Windows\system32\svchost.exe [1140:1996] 000007fef8957738
Thread C:\Windows\system32\svchost.exe [1140:2000] 000007fef8941f90
Thread C:\Windows\system32\svchost.exe [1140:2892] 000007fef93f5124
Thread C:\Windows\system32\svchost.exe [1140:1964] 000007fef76a5170
Thread C:\Windows\System32\spoolsv.exe [1264:2092] 000007fef7e110c8
Thread C:\Windows\System32\spoolsv.exe [1264:2124] 000007fef7db6144
Thread C:\Windows\System32\spoolsv.exe [1264:2128] 000007fef7ba5fd0
Thread C:\Windows\System32\spoolsv.exe [1264:2140] 000007fef7b63438
Thread C:\Windows\System32\spoolsv.exe [1264:2144] 000007fef7ba63ec
Thread C:\Windows\System32\spoolsv.exe [1264:2148] 000007fef7b63438
Thread C:\Windows\System32\spoolsv.exe [1264:2152] 000007fef7ba63ec
Thread C:\Windows\System32\spoolsv.exe [1264:2176] 000007fef8295e5c
Thread C:\Windows\System32\spoolsv.exe [1264:2204] 000007fef8495074
Thread C:\Windows\System32\spoolsv.exe [1264:2360] 000007fef824e088
Thread C:\Windows\System32\spoolsv.exe [1264:2376] 000007fef8502288
Thread C:\Windows\System32\spoolsv.exe [1264:2380] 000007fef824e088
Thread C:\Windows\System32\spoolsv.exe [1264:2584] 000007fef81e8760
Thread C:\Windows\system32\svchost.exe [1320:1548] 000007fef9a735c0
Thread C:\Windows\system32\svchost.exe [1320:2460] 000007fef9a75600
Thread C:\Windows\system32\svchost.exe [1320:2652] 000007fef6e82940
Thread C:\Windows\system32\svchost.exe [1320:2664] 000007fef6e42888
Thread C:\Windows\system32\svchost.exe [1320:2396] 000007fef6e42a40
Thread C:\Windows\System32\svchost.exe [1812:2500] 000007fef3849688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind ????????????????????????????CB????N??????????????????????????????????????????????????????-???????.??6&12686711&0?6???????????.???????0??? ???????6??????????? ????????????????????????"?????????????????????? ???????????????????????????????????????f??????#???HID\VID_062A&PID_0000&REV_0000?HID\VID_062A&PID_0000?HID_DEVICE_SYSTEM_MOUSE?HID_DEVICE_UP:0001_U:0002?HID_DEVICE???????? ????????????????????N?????????????????{876ae072-717c-11df-a9f5-806e6f6e6963}??P?????N???????????D?????{4d36e96f-e325-11ce-bfc1-08002be10318}??????????????????????????? ???????????????????o????????????????????????s?????? ???????/?????????????,????????N???Q???????????????????????????????????????????????? ?????????????????????,??????????????#???????N?????????????????HID\VID_062A&PID_0000\6&4b7392e&0&0000??????????????????????????????\\?\HID#VID_062A&PID_0000#6&4b7392e&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}???????? ???????/???????????/?,????????N? ?Q?????????????????????????????????????????}???????h?????????????????????????????? ?????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route ????so???i??int?????????30????N??????k???????????????1??}???????????E6???????????????????????????????????????????????????????????B???????????????????????????E??9A??????????????????????BA??????????????????????6.1.7600.16385????????*??????D??????\q???????????5??9A????.?????????????????ip????N??????e???????????????A??D}??*6to4mp??t??????????????????????????????????nm????.??????????????????????9??30???(N?????????????????????????????????????????????????t?????????????X?????????????????????????????????????? ??cp??Microsoft???????????????????? ???????g????????????????0??????????????7???????????y???????????????????????y????????????6??????n??????e???hid_device???????),??????o????????????????????0l,-???????????+???????o?????????????????????6DP???+???????1?????????????????????61D???+???????F?????????????????????7tw????N??????r???????????e??????????????????hid_device_system_mouse??????????????.???/??????????????????????????????BD??????0????????????????????L??ma????N??????k???????????+???????o?????????????????????3l,???+?
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export ????????????????????? ???????????????????g????????????????????????sBH\??? ???????? ????????????0????????????&????????????????????r??????? ???????????????????????????????????????f??6-21-2006???? ?????????????????????0??L????????? ???????????????????????????????? ?????????????????????0????????????????????@input.inf,%stdmfg%;(Standardsystemger?te)?385??? ?????????????????????0????????????????????? ?????????????????????0????????&??????????????????????????????????????????????????????????P?????? ??????r??????nettun.inf?:?;???????????u??????????????????????????Laufwerk?9???????????????????????????????y???????l??????????????????????? ???????6??????t2????~??????y???????????????????s???j??????????????C9??????????????????? ?????????????????????0?????????????????????????????i??????????? ?????????????????????0????????.???????????? ?????????????????????0????????????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????? ?????????????????????0??L????????? ??????????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind ??????????6??????5??9A????N??????5?????D?????????????????????l?l???????l?l?l?l???"??????????????????????6-21-2006???????????nettun.inf?14A???????????????????????????8??tunnel??????usbccgp?-4??6to4mp.ndi?Tcp??????e\??Microsoft???????????????MD????:??????C?g04????????????????????N???????????????????????????????.??????????????????????-???????.???????????}??e\???????????????????????????p???????????????????????M?? ???????????p??????????cp????*??????.???????????????????E??s2??????4m???a??????????????????????????????????????????????????????nettun.inf???????????????????????????????????????D??ic??Microsoft????????????????????????????4??F-??6.1.7600.16385?%;W???????M??????" ??" ??????????????????????ISATAP.ndi???f??Realtek HDA HDMI Out????6-21-2006???????????6to4mp.ndi??????????????? ???????h????????????????"??????? ???????????0354??nettun.inf:Microsoft.NTamd64:6to4mp.ndi:6.1.7600.16385:*6to4mp???????????????????e??????????????????*6to4mp?2.??nettun.inf:Microsoft.NTamd64:6to4mp.ndi:6.1.7600.16385:*6to4mp????????N????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route ?????????????????p????????.???????????????????????????????N??????S??????Microsoft???text????*6to4mp???????0??????????????????????????????????????4??da??????????@keyboard.inf,%hid.keyboarddevice%;HID-Tastatur?3-??????????????????keyboard.inf:MS_KBD.NTamd64:HID_Keyboard_Inst:6.1.7601.17514::hid_device_system_keyboard?????e?f?h?r???r?t????????????.?????????????????.1??? ??????????????????????????????????????????????????????????????????6.1.7600.16385?AD-???????????B???????????????{??17???????????f??-0??-0??? ??????????????????????????????N?????????????sPPP????N??????????????????????????????????7???????????3??5????????????????????????????.??????C-???????????????????????????n??????????4m??msmouse.inf:MSMfg.NTamd64:HID_Mouse_Inst:6.1.7600.16385::hid_device_system_mouse????? ??????????????????msmouse.inf:MSMfg.NTamd64:HID_Mouse_Inst:6.1.7600.16385::hid_device_system_mouse?????????????b??}????????????O??GE??????????????-D??6.1.7600.16385?3A-??HID-konforme Maus???????????????????msmouse.inf??r???????????e?????????????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export ????BT??????????{6D653716-60B6-4117-9E28-5237A7392E8A}??3E??\Device\{6D653716-60B6-4117-9E28-5237A7392E8A}??-2??? ??????????????????????????????<??????i????? ??????????????????????????????"??? ???????03??? ???????n?????ft%??? "?????????????????ndis5_ip6_tunnel?D??????????? ??????????????????????????????????????????? ?????????????????????????????? ????????????????? ??????f??????????Netzwerkadresse??????????????????t???? ?????????????? ???????????????????????????????????????????????????4??????C9???????????k???t??????????????????int??}???????????B??\\?\HID#VID_046D&PID_C52F&MI_00#7&aaeff20&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}?{3??? ???????/?????????????,????????Z???W????????????????????????????????????????????}??HID\VID_046D&PID_C52F&MI_00\7&aaeff20&0&0000?4??\\?\HID#VID_046D&PID_C52F&MI_00#7&aaeff20&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}?e6??? ?????????????????????0????????????????????? ?????????????????????0?????????????????????????????0????s1ed??4m????????????????inte??????#???????#???????? ?
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Bind ???p?p???????p???????r??????5-????????????????????????????????????:????????gcp???????????????????????n??????????????????????????????????????t????t?t?t??? ???????n??????????????????????2?K????G????system32\DRIVERS\ipfltdrv.sys????????????????r???j??text?????????o????????????P??s????????h?????.NT?FD??Typ?????????????????????????????????????????????????????????????? ???????n??????????????????????V?L?????????Kernel Streaming Thunks??????????s???-??????29??*6to4mp??e???????|???????????????m??????????.NTAMD64?????????p???????e??????????@%SystemRoot%\system32\drivers\partmgr.sys,-100???????:??p????????h?????System32\drivers\partmgr.sys?????????????????????????n??????????RDPUDD???}??????????t???? ???????r?????p?????p???????????????????????????????p??????????????FileInfo?<??? ???????p???????????p???????????????????????????p??????????45000????????????????????p?p???????p????? ???????n?????p?????r??????????h?s???????e???????h??p?????????e????@%SystemRoot%\system32\drivers\filetrace.sys,-10001???????4??p??????p???FSFilte
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Route ???d?p????$??@???7???????9???????????????k?p?r???U?W????System???????@??? ???????@???????????????????? ?f? ?????cM???????????&????????????N??@???~??????????{78032B7E-4968-42D3-9F37-287EA86C0AAA}???????????????????e??????*????????????s???????????~????????????????????????f??@??????????????SW\{EEAB7790-C514-11D1-B42B-00805FC1270E}\ASYNCMAC???????????????~???h???????@???????????????????????????????s??? ???????????????????T??@?????????d????sw\{eeab7790-c514-11d1-b42b-00805fc1270e}???????????? ?????????????????????????????? ????????????? ???????3?????enum????? ??????????????wa???????????9?????????l??????????????????????????.??@???????????????????:9??9??? ???????@?????@?????@????????$?N???????????\\?\Root#*6TO4MP#0004#{ad498944-762f-11d0-8dcb-00c04fc3358c}\{1411A974-3571-4BCF-AAC9-D4B3783850D4}?9-????$??@???"???????7??\\?\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\{8E301A52-AFFA-4F49-B9CA-C79096A1A056}????Root\SYSTEM\0000??????????????????N??k????????D??????@??Root\MS_NDISWANIPV6\0000????Ndi
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Export ???p????????????????????????????????*6to4mp??7??????????????????? ??????????????????p?p H????D??p???????????e??????????????t???HID_Inst?????????;??? ???????n?????????????,??????$???c??????r????J??p?????????????????? H??t???? ???????n?????p?????p?2??????$?h?[???????????N??p?????????e????@%SystemRoot%\System32\dnsapi.dll,-101???????????p??????p????p?p?p???p???p????????????????h??p????????h?????%SystemRoot%\system32\svchost.exe -k NetworkService???????N??p?????????n????@%SystemRoot%\System32\dnsapi.dll,-102??????? 8??p??????????????NT AUTHORITY\NetworkService????????????????????????????p0??????p????????????????t??????? ?????????????,??p???????????????????p???????????e??????????????????????? F??p???????????????p????b??p??????????????????SeChangeNotifyPrivilege?SeCreateGlobalPrivilege??????????????????????????????p?p?p?p?p?p?p?p?p?p?p?p????? ???????p?????p?????p?2??????,?F??? ???????????%SystemRoot%\System32\dnsrslvr.dll????????????????????????????????B??p????????n?????%SystemRoot%\System32\dnsext.dll????? ?????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Bind ???k?p??????????????{8ECC055D-047F-11D1-A537-0000F8753ED1}???????l?lxe???l?l????? ???f??????????s????????????????????????????k??????s???11???????????g???l?l?????????????????????}??{71a27cdd-812a-11d0-bec7-08002be2092f}?amd??????????????????{8ECC055D-047F-11D1-A537-0000F8753ED1}??????LegacyDriver?????????????????????????????????????t?????sLS???l?l????? ??9???0?????47F???g?k?k?k?k?k?k???????????????????k?l??????X??????{???t???l?l?l???????????????????????l?lUM???????????????????????????????k??????????????? ???????j?????k?????j???????????????????????????????k??????s?????:??k???????????????????????????????k??????????LegacyDriver?g??LegacyDriver?a??????0-???????????????????????????????????????????????k??? ???????k??????????????????????N????????????W?g?h?k?k?k?k??????????t???????C0??? ???????j?????k?????i???????????????????????E??? ???k??????????????? ???????k??????????????????????N???????? ???????k???????????????k???????????????k???????????????????????????????????????f????X??????????????????k?????????????????????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Route ???p?k??????ep????f??p??????????int15.sys????????????????????e????????????????n???????????v??????|???????????????????=??tl???<??????????????????????? ???????p???????????p?,?????? ?@?????????????????????????????????????@??p??????????????C:\Windows\system32\mscoree.dll??????p?p?????????????????????????p?p?????????p??????????????? ???????p???????????p?,?????? ?@???!?????????????????e???????@??p??????????????C:\Windows\system32\mscoree.dll??????p?p?p???p??? ???????p???????????p????????&?D??????????n????? ??????????????t????p????D??p?????????????e????%SystemRoot%\system32\wevtapi.dll???????????????????????? ???????p???????????p????????&?<?????????????r???????<??p??????????????%SystemRoot%\System32\wer.dll?????????????????????????<??p?????????????e????%SystemRoot%\System32\wer.dll???? ??????????????t????p?p?p?p????? ???????p???????????p???????? ?B?????????????????B??p??????????????%SystemRoot%\System32\wersvc.dll??????????????????????????N??p???????????????p???p???p??? ???????p???????????p????????&?|??????????????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export ???r????? ???????q???????????r??????????N?????????????N??r??????????????{2992E9CF-4F99-48f5-A0B6-B99B11CD387D}??????????????@%systemroot%\system32\rascfg.dll,-32013??????????????????????????8??t????????h?????usb.inf??????????r???0?????????????????g??????????????X??????z???t???????????????????????l???????????????????????????????????????????s?t????????????????????????p????????????????????r?s?????j?j?j?j?j?jrs???j?j?j?j?j?j-1??System Bus Extender?????Net?????*6to4mp?????Net??t???????????????l?????????????????????????u?????????????????????????n???????????r??????????Microsoft?????N??r?????????e????@%SystemRoot%\system32\ikeext.dll,-501????????Z??r????????h?????%systemroot%\system32\svchost.exe -k netsvcs??????N??r?????????n????@%SystemRoot%\system32\ikeext.dll,-502??????? ???r??????????????LocalSystem?????????????????????????????????????t????????r??????p??????? ????????????? ??j???????????e????,??r??????????????????????????????????????????????t???%SystemRoot%\System32\umpnpmgr.dll??????????????????????????? ?????
---- EOF - GMER 2.1 ----
Geändert von an-ny (21.11.2013 um 20:45 Uhr) |
|
22.11.2013, 00:29
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ZeuS/ZBot Abuse Sicherheitswarnung Ok, machen wir mal mit dem ACERASPIRE1410 weiter. Vergiss erstmal den anderen Rechner. Auf dem Notebook bitte mal CF ausführen: Scan mit Combofix
__________________ --> ZeuS/ZBot Abuse Sicherheitswarnung |
|
22.11.2013, 06:40
| #7 |
| | ZeuS/ZBot Abuse Sicherheitswarnung OK, erledigt. Hier Combofix. und danke danke danke, immer wieder! Code:
ATTFilter ComboFix 13-11-19.01 - Administrator 22.11.2013 6:19.1.1 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.955.323 [GMT 1:00]
ausgeführt von:: c:\users\Administrator\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\users\Gast\AppData\Roaming\.#
c:\users\Public\sdelevURL.tmp
c:\users\TIMstandart\AppData\Roaming\.#
c:\windows\SysWow64\FlashPlayerApp.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-22 bis 2013-11-22 ))))))))))))))))))))))))))))))
.
.
2013-11-22 05:30 . 2013-11-22 05:30 -------- d-----w- c:\users\TIMstandart\AppData\Local\temp
2013-11-22 05:30 . 2013-11-22 05:30 -------- d-----w- c:\users\TIMAdmin\AppData\Local\temp
2013-11-21 19:19 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{015C17A6-6A19-49D7-868F-8C3484091876}\mpengine.dll
2013-11-21 19:06 . 2013-11-21 19:06 -------- d-----w- C:\FRST
2013-11-18 05:09 . 2013-10-08 06:50 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-11-17 20:21 . 2013-10-12 08:45 2241536 ----a-w- c:\windows\system32\wininet.dll
2013-11-17 20:21 . 2013-10-12 08:43 15404544 ----a-w- c:\windows\system32\ieframe.dll
2013-11-17 20:21 . 2013-10-12 08:43 19269632 ----a-w- c:\windows\system32\mshtml.dll
2013-11-17 17:53 . 2013-11-17 18:01 -------- d-----w- c:\programdata\HitmanPro
2013-11-17 17:39 . 2013-10-05 20:25 1474048 ----a-w- c:\windows\system32\crypt32.dll
2013-11-17 17:39 . 2013-10-05 19:57 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-11-17 17:38 . 2013-09-28 01:09 497152 ----a-w- c:\windows\system32\drivers\afd.sys
2013-11-17 17:38 . 2013-10-04 02:28 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2013-11-17 17:38 . 2013-10-04 02:24 1930752 ----a-w- c:\windows\system32\authui.dll
2013-11-17 17:38 . 2013-10-04 01:56 1796096 ----a-w- c:\windows\SysWow64\authui.dll
2013-11-17 17:38 . 2013-10-04 02:25 197120 ----a-w- c:\windows\system32\credui.dll
2013-11-17 17:38 . 2013-10-04 01:58 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll
2013-11-17 17:38 . 2013-10-04 01:56 168960 ----a-w- c:\windows\SysWow64\credui.dll
2013-11-17 17:37 . 2013-10-03 02:23 404480 ----a-w- c:\windows\system32\gdi32.dll
2013-11-17 17:37 . 2013-10-03 02:00 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2013-11-17 17:37 . 2013-10-12 02:30 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-11-17 17:37 . 2013-10-12 02:29 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-11-17 17:37 . 2013-10-12 02:29 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-11-17 17:37 . 2013-10-12 02:01 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-11-17 17:37 . 2013-10-12 02:03 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-17 20:17 . 2011-05-26 06:40 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-10-10 13:49 . 2012-01-02 12:33 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-07 13:17 . 2013-07-16 04:15 83160 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-10-07 13:17 . 2013-07-16 03:42 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-10-07 13:17 . 2013-07-16 03:42 132600 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-10-07 13:17 . 2013-07-16 03:42 105856 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-08 02:30 . 2013-10-09 17:18 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-09 17:18 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-09 17:18 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-09-04 12:12 . 2013-10-09 17:18 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-09-04 12:11 . 2013-10-09 17:18 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-09-04 12:11 . 2013-10-09 17:18 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-09-04 12:11 . 2013-10-09 17:18 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-09-04 12:11 . 2013-10-09 17:18 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-09-04 12:11 . 2013-10-09 17:18 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-09-04 12:11 . 2013-10-09 17:18 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-09-03 12:35 . 2013-03-06 12:51 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-08-29 02:17 . 2013-10-09 17:18 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-29 02:16 . 2013-10-09 17:18 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-08-29 02:16 . 2013-10-09 17:18 243712 ----a-w- c:\windows\system32\wow64.dll
2013-08-29 02:16 . 2013-10-09 17:18 859648 ----a-w- c:\windows\system32\tdh.dll
2013-08-29 02:13 . 2013-10-09 17:18 878080 ----a-w- c:\windows\system32\advapi32.dll
2013-08-29 01:51 . 2013-10-09 17:18 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-08-29 01:51 . 2013-10-09 17:18 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-08-29 01:50 . 2013-10-09 17:18 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-08-29 01:50 . 2013-10-09 17:18 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-08-29 01:50 . 2013-10-09 17:18 619520 ----a-w- c:\windows\SysWow64\tdh.dll
2013-08-29 01:48 . 2013-10-09 17:18 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
2013-08-29 01:48 . 2013-10-09 17:18 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-08-29 00:49 . 2013-10-09 17:18 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-08-29 00:49 . 2013-10-09 17:18 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-08-29 00:49 . 2013-10-09 17:18 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-08-29 00:49 . 2013-10-09 17:18 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-08-28 01:21 . 2013-10-09 17:18 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-08-28 01:12 . 2013-10-09 17:18 461312 ----a-w- c:\windows\system32\scavengeui.dll
2013-07-12 19:44 . 2013-07-12 19:44 4167680 ----a-w- c:\program files (x86)\GUTEBB6.tmp
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-06 17:18 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-10-07 681032]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\neuer ordner\iTunesHelper.exe" [2013-05-31 152392]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [x]
R3 NETw1v64;Intel(R) Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw1v64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw1v64.sys [x]
R3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R4 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe;c:\program files (x86)\Acer\Registration\GregHSRW.exe [x]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [x]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [x]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys;c:\windows\SYSNATIVE\drivers\IntcHdmi.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-22 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-18 13:49]
.
2013-11-04 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005Core.job
- c:\users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-08 14:28]
.
2013-11-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005UA.job
- c:\users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-08 14:28]
.
2013-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05 02:53]
.
2013-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05 02:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-06 17:19 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-06 828960]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-04-09 320000]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 159232]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 380928]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 358912]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1410&r=273605105106l0393z1i5w4801r336
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\rip7h9xf.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
c:\users\Beschränkter Zugriff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,3b,1b,ab,8d,04,
6f,c7,8d,45,0e,ad,e0,91,9a,f3,9b,60,5a
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,ce,20,
89,35,17,d6,02,95,c7,14,24,74,4a,2e,df
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1a,d8,
c2,72,ff,32,0b,a7,7f,d9,65,c3,87,c5,b0
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (Administrator)
"Timestamp"=hex:2d,84,d4,79,0c,85,ce,01
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,fb,a3,2b,a1,e3,59,49,90,39,0a,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,de,fb,a3,2b,a1,e3,59,49,90,39,0a,\
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-4200865707-2185321332-2637488627-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="FirefoxHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-11-22 06:35:17
ComboFix-quarantined-files.txt 2013-11-22 05:35
.
Vor Suchlauf: 11 Verzeichnis(se), 103.992.197.120 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 104.574.115.840 Bytes frei
.
- - End Of File - - 0E4BB6DD6907D3648BD0AF9F193FB83C
A36C5E4F47E84449FF07ED3517B43A31
|
|
22.11.2013, 09:41
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ZeuS/ZBot Abuse Sicherheitswarnung Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.11.2013, 20:30
| #9 |
| | ZeuS/ZBot Abuse Sicherheitswarnung Hier MBAR ........ beim 2ten Scan hat er nichts mehr gefunden Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1007
www.malwarebytes.org
Database version: v2013.11.22.09
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Administrator :: ACERASPIRE1410 [administrator]
22.11.2013 19:09:55
mbar-log-2013-11-22 (19-09-55).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 381764
Time elapsed: 15 minute(s), 29 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 1
HKLM\SOFTWARE\Refog Software (Refog.Keylogger) -> Delete on reboot.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
23.11.2013, 01:16
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ZeuS/ZBot Abuse Sicherheitswarnung Wer hat denn den refog keylogger installiert?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.11.2013, 08:45
| #11 |
| | ZeuS/ZBot Abuse Sicherheitswarnung Der Keylogger war zum Zeitpunkt des Bundespolizeitrojaners schon drauf, wurde aber angeblich auch vernichtet. Damals waren auch die Benutzerkonten alle im Eimer, Passwörter geändert. Keine Ahnung woher der kam, dachte das hing mit dem ersten Virenbefall zusammen. Ist aber schon ne ganze Weile her. Seit dem letzten cleanen wurde meines Wissens nach nur noch ein Drucker und so Zeug installiert. |
|
23.11.2013, 15:12
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ZeuS/ZBot Abuse Sicherheitswarnung Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.11.2013, 11:28
| #13 |
| | ZeuS/ZBot Abuse Sicherheitswarnung ADWCleaner: Code:
ATTFilter # AdwCleaner v3.013 - Bericht erstellt am 24/11/2013 um 11:20:19
# Updated 24/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Administrator - ACERASPIRE1410
# Gestartet von : C:\Users\Administrator\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\SweetIM
Ordner Gelöscht : C:\Program Files (x86)\SweetIM
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\Beschränkter Zugriff\AppData\LocalLow\facemoods.com
Ordner Gelöscht : C:\Users\Beschränkter Zugriff\AppData\LocalLow\SweetIM
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_google-sketchup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_google-sketchup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_minecraft_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_minecraft_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_puddle_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_puddle_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ea8fa6be-29be-4af2-9352-841f83215eb0}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\EB6AF8AEEB922FA4392548F13812E50B
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\EB6AF8AEEB922FA4392548F13812E50B
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16736
-\\ Mozilla Firefox v25.0.1 (de)
[ Datei : C:\Users\Beschränkter Zugriff\AppData\Roaming\Mozilla\Firefox\Profiles\asyhz338.default\prefs.js ]
[ Datei : C:\Users\TIMstandart\AppData\Roaming\Mozilla\Firefox\Profiles\sx3fhwnx.default\prefs.js ]
[ Datei : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\rip7h9xf.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [4997 octets] - [24/11/2013 11:14:42]
AdwCleaner[S0].txt - [4798 octets] - [24/11/2013 11:20:20]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4858 octets] ##########
JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Administrator on 24.11.2013 at 11:36:08,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files (x86)\sweetim"
~~~ FireFox
Emptied folder: C:\Users\Administrator\AppData\Roaming\mozilla\firefox\profiles\rip7h9xf.default\minidumps [1 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.11.2013 at 11:49:24,65
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2013 03
Ran by Administrator (administrator) on ACERASPIRE1410 on 24-11-2013 11:57:31
Running from C:\Users\Administrator\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-06] (Acer Incorporated)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [320000 2009-04-09] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKLM-x32\...\Run: [EgisTecLiveUpdate] - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Neuer Ordner\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Beschränkter Zugriff\...\Policies\system: [LogonHoursAction] 2
HKU\Beschränkter Zugriff\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\clean\...\Policies\system: [LogonHoursAction] 2
HKU\clean\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\Gast\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Gast\...\Policies\system: [LogonHoursAction] 2
HKU\Gast\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\TIMAdmin\...\Policies\system: [LogonHoursAction] 2
HKU\TIMAdmin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\TIMstandart\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\System32\spool\drivers\x64\3\E_IATIIJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\TIMstandart\...\Run: [Facebook Update] - C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-10-08] (Facebook Inc.)
HKU\TIMstandart\...\Policies\system: [LogonHoursAction] 2
HKU\TIMstandart\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1410&r=273605105106l0393z1i5w4801r336
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com/bin/srldetect_intel_4.5.15.0.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\rip7h9xf.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Neuer Ordner\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)
==================== Drivers (Whitelisted) ====================
U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
S3 int15.sys; C:\Windows\System32\OEM\Factory\int15.sys [17952 2008-03-28] (Acer, Inc.)
S1 mbmiodrvr; C:\Windows\syswow64\mbmiodrvr.sys [4608 2004-04-10] (cansoft@livewiredev.com)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U5 TMUSB; C:\Windows\System32\DRIVERS\TMUSB64.SYS [63096 2012-12-05] (Seiko Epson Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-24 11:57 - 2013-11-24 11:57 - 01958396 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2013-11-24 11:49 - 2013-11-24 11:49 - 00000839 _____ C:\Users\Administrator\Desktop\JRT.txt
2013-11-24 11:35 - 2013-11-24 11:35 - 00000000 ____D C:\Windows\ERUNT
2013-11-24 11:29 - 2013-11-24 11:31 - 01034531 _____ (Thisisu) C:\Users\Administrator\Downloads\JRT.exe
2013-11-24 11:14 - 2013-11-24 11:20 - 00000000 ____D C:\AdwCleaner
2013-11-24 11:12 - 2013-11-24 11:12 - 01091882 _____ C:\Users\Administrator\Downloads\adwcleaner(1).exe
2013-11-24 11:12 - 2013-11-24 11:12 - 01091882 _____ C:\Users\Administrator\Desktop\adwcleaner.exe
2013-11-22 19:54 - 2013-11-22 19:54 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\LibreOffice
2013-11-22 19:09 - 2013-11-22 20:27 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-22 19:09 - 2013-11-22 20:08 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-22 19:08 - 2013-11-22 20:27 - 00000000 ____D C:\Users\Administrator\Desktop\mbar
2013-11-22 19:08 - 2013-11-22 19:08 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-22 19:06 - 2013-11-22 19:06 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Administrator\Desktop\mbar-1.07.0.1007.exe
2013-11-22 06:35 - 2013-11-22 06:35 - 00020300 _____ C:\ComboFix.txt
2013-11-22 06:13 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-22 06:13 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-22 06:13 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-22 06:13 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-22 06:13 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-22 06:13 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-22 06:13 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-22 06:13 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-22 06:12 - 2013-11-22 06:35 - 00000000 ____D C:\Qoobox
2013-11-22 06:12 - 2013-11-22 06:32 - 00000000 ____D C:\Windows\erdnt
2013-11-22 05:39 - 2013-11-22 05:39 - 05146522 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe
2013-11-21 21:25 - 2013-11-21 21:25 - 00017116 _____ C:\Users\Administrator\Desktop\Gmer.txt
2013-11-21 21:10 - 2013-11-21 21:10 - 00377856 _____ C:\Users\Administrator\Downloads\gmer_2.1.19163.exe
2013-11-21 20:59 - 2013-11-21 21:10 - 00012424 _____ C:\Users\Administrator\Downloads\Addition.txt
2013-11-21 20:58 - 2013-11-24 11:58 - 00010628 _____ C:\Users\Administrator\Downloads\FRST.txt
2013-11-21 20:09 - 2013-11-21 21:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-21 20:09 - 2013-11-21 20:32 - 00012343 _____ C:\Users\Administrator\Desktop\Addition.txt
2013-11-21 20:06 - 2013-11-21 20:09 - 00025219 _____ C:\Users\Administrator\Desktop\FRST.txt
2013-11-21 20:06 - 2013-11-21 20:06 - 00000000 ____D C:\FRST
2013-11-21 19:57 - 2013-11-21 19:57 - 00000488 _____ C:\Users\Administrator\Desktop\defogger_disable.log
2013-11-21 19:57 - 2013-11-21 19:57 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-11-21 19:56 - 2013-11-21 19:56 - 00050477 _____ C:\Users\Administrator\Downloads\Defogger.exe
2013-11-21 19:55 - 2013-11-21 19:55 - 00007605 _____ C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2013-11-18 06:10 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-18 06:09 - 2013-11-18 06:09 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-18 06:09 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-18 06:09 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-18 06:09 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-17 21:22 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 21:22 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-17 21:22 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 21:22 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-17 21:22 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-17 21:22 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-17 21:22 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-17 21:22 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 21:22 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-17 21:22 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-17 21:22 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-17 21:21 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 21:21 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 21:21 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 21:21 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-17 21:21 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-17 18:53 - 2013-11-17 19:01 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-17 18:44 - 2013-11-17 18:53 - 10264904 _____ (SurfRight B.V.) C:\Users\TIMstandart\Downloads\hitmanpro_x64.exe
2013-11-17 18:40 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-17 18:40 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-17 18:40 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-17 18:40 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-17 18:40 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-17 18:40 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-17 18:40 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-17 18:40 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-17 18:40 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-17 18:40 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-17 18:40 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-17 18:40 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-17 18:40 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-17 18:40 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-17 18:39 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-17 18:39 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-17 18:38 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-17 18:38 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-17 18:38 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-17 18:38 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-17 18:38 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-17 18:38 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-17 18:38 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-17 18:37 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-17 18:37 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-17 18:37 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-17 18:37 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-17 18:37 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-17 18:37 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-17 18:37 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-15 13:47 - 2013-11-15 13:47 - 00000193 _____ C:\Windows\WORDPAD.INI
==================== One Month Modified Files and Folders =======
2013-11-24 11:58 - 2013-11-21 20:58 - 00010628 _____ C:\Users\Administrator\Downloads\FRST.txt
2013-11-24 11:57 - 2013-11-24 11:57 - 01958396 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2013-11-24 11:57 - 2008-01-02 17:34 - 01498005 _____ C:\Windows\WindowsUpdate.log
2013-11-24 11:54 - 2010-11-17 12:21 - 00000442 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-11-24 11:49 - 2013-11-24 11:49 - 00000839 _____ C:\Users\Administrator\Desktop\JRT.txt
2013-11-24 11:49 - 2013-07-18 20:28 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-24 11:35 - 2013-11-24 11:35 - 00000000 ____D C:\Windows\ERUNT
2013-11-24 11:31 - 2013-11-24 11:29 - 01034531 _____ (Thisisu) C:\Users\Administrator\Downloads\JRT.exe
2013-11-24 11:31 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-24 11:31 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-24 11:25 - 2010-06-05 03:53 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-24 11:23 - 2013-03-06 21:26 - 00010084 _____ C:\Windows\setupact.log
2013-11-24 11:23 - 2009-08-20 06:48 - 01145366 _____ C:\Windows\PFRO.log
2013-11-24 11:23 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-24 11:20 - 2013-11-24 11:14 - 00000000 ____D C:\AdwCleaner
2013-11-24 11:12 - 2013-11-24 11:12 - 01091882 _____ C:\Users\Administrator\Downloads\adwcleaner(1).exe
2013-11-24 11:12 - 2013-11-24 11:12 - 01091882 _____ C:\Users\Administrator\Desktop\adwcleaner.exe
2013-11-24 11:03 - 2010-06-05 03:53 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-24 10:33 - 2013-10-08 15:28 - 00000952 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005UA.job
2013-11-24 10:08 - 2013-10-08 15:28 - 00000930 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005Core.job
2013-11-22 20:27 - 2013-11-22 19:09 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-22 20:27 - 2013-11-22 19:08 - 00000000 ____D C:\Users\Administrator\Desktop\mbar
2013-11-22 20:08 - 2013-11-22 19:09 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-22 19:54 - 2013-11-22 19:54 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\LibreOffice
2013-11-22 19:08 - 2013-11-22 19:08 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-22 19:06 - 2013-11-22 19:06 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Administrator\Desktop\mbar-1.07.0.1007.exe
2013-11-22 06:35 - 2013-11-22 06:35 - 00020300 _____ C:\ComboFix.txt
2013-11-22 06:35 - 2013-11-22 06:12 - 00000000 ____D C:\Qoobox
2013-11-22 06:35 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-11-22 06:32 - 2013-11-22 06:12 - 00000000 ____D C:\Windows\erdnt
2013-11-22 06:32 - 2012-09-27 08:43 - 00000000 ___RD C:\Users\Beschränkter Zugriff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-22 06:30 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-22 05:59 - 2013-07-16 20:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-22 05:39 - 2013-11-22 05:39 - 05146522 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe
2013-11-21 22:46 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-21 21:26 - 2013-11-21 20:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-21 21:25 - 2013-11-21 21:25 - 00017116 _____ C:\Users\Administrator\Desktop\Gmer.txt
2013-11-21 21:10 - 2013-11-21 21:10 - 00377856 _____ C:\Users\Administrator\Downloads\gmer_2.1.19163.exe
2013-11-21 21:10 - 2013-11-21 20:59 - 00012424 _____ C:\Users\Administrator\Downloads\Addition.txt
2013-11-21 20:32 - 2013-11-21 20:09 - 00012343 _____ C:\Users\Administrator\Desktop\Addition.txt
2013-11-21 20:09 - 2013-11-21 20:06 - 00025219 _____ C:\Users\Administrator\Desktop\FRST.txt
2013-11-21 20:06 - 2013-11-21 20:06 - 00000000 ____D C:\FRST
2013-11-21 19:57 - 2013-11-21 19:57 - 00000488 _____ C:\Users\Administrator\Desktop\defogger_disable.log
2013-11-21 19:57 - 2013-11-21 19:57 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-11-21 19:57 - 2013-07-15 18:36 - 00000000 ____D C:\Users\Administrator
2013-11-21 19:56 - 2013-11-21 19:56 - 00050477 _____ C:\Users\Administrator\Downloads\Defogger.exe
2013-11-21 19:55 - 2013-11-21 19:55 - 00007605 _____ C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2013-11-18 06:16 - 2013-07-20 13:58 - 00001340 __RSH C:\Users\TIMstandart\ntuser.pol
2013-11-18 06:16 - 2013-07-20 13:57 - 00000000 ____D C:\Users\TIMstandart
2013-11-18 06:15 - 2013-07-15 18:36 - 00000680 __RSH C:\Users\Administrator\ntuser.pol
2013-11-18 06:11 - 2013-09-22 08:16 - 00000000 ____D C:\ProgramData\Oracle
2013-11-18 06:09 - 2013-11-18 06:09 - 00004278 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-18 06:09 - 2010-09-24 10:37 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-17 21:20 - 2013-07-17 18:09 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 21:17 - 2011-05-26 07:40 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-17 19:01 - 2013-11-17 18:53 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-17 18:53 - 2013-11-17 18:44 - 10264904 _____ (SurfRight B.V.) C:\Users\TIMstandart\Downloads\hitmanpro_x64.exe
2013-11-15 13:50 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-15 13:50 - 2008-01-03 02:26 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-11-15 13:50 - 2008-01-03 02:26 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-11-15 13:49 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-15 13:47 - 2013-11-15 13:47 - 00000193 _____ C:\Windows\WORDPAD.INI
Files to move or delete:
====================
C:\ProgramData\3fl9.pad
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-21 22:19
==================== End Of Log ============================
ADDITION Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-11-2013 03
Ran by Administrator at 2013-11-24 11:59:14
Running from C:\Users\Administrator\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Acer Crystal Eye webcam Ver:1.1.95.714 (x32 Version: 1.1.95.714)
Acer ePower Management (x32 Version: 4.05.3002)
Acer eRecovery Management (x32 Version: 4.05.3003)
Acer GameZone Console (x32 Version: 5.1.0.2)
Acer GridVista (x32 Version: 3.01.0730)
Acer Registration (x32 Version: 1.02.3004)
Acer ScreenSaver (x32 Version: 1.05.0804)
Acer Updater (x32 Version: 1.01.3014)
Acer VCM (x32 Version: 4.05.3000)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.22.87)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.4.144)
Alcor Micro USB Card Reader (x32 Version: 1.2.17.05001)
Alice Greenfingers (x32)
Amazonia (x32)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.5)
Avira Free Antivirus (x32 Version: 14.0.0.383)
Bonjour (Version: 3.0.0.10)
Choice Guard (x32 Version: 1.2.87.0)
CyberLink PowerDVD 8 (x32 Version: 8.1.2815o.50)
Dairy Dash (x32)
DivX-Setup (x32 Version: 1.0.2.23)
Download Navigator (x32 Version: 3.3.0)
Druckerdeinstallation für EPSON XP-402 403 405 406 Series
eBay Worldwide (x32 Version: 2.1.0703)
EpsonNet Config V4 (x32 Version: 4.1.1)
eSobi v2 (x32 Version: 2.0.4.000274)
Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)
Free Audio CD Burner version 1.3 (x32)
Free YouTube to MP3 Converter version 3.5 (x32)
Google Update Helper (x32 Version: 1.3.21.165)
Granny In Paradise (x32)
Heroes of Hellas (x32)
iCloud (Version: 3.0.2.163)
Identity Card (x32 Version: 1.00.3001)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.1892)
Intel® Matrix Storage Manager
iTunes (Version: 11.0.4.4)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 24 (x32 Version: 6.0.240)
Junk Mail filter update (x32 Version: 14.0.8064.206)
Launch Manager (x32 Version: 3.0.02)
LibreOffice 4.0.4.2 (x32 Version: 4.0.4.2)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Merriam Websters Spell Jam (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Motherboard Monitor 5 (x32 Version: 5)
Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
Mozilla Thunderbird (3.1.2) (x32 Version: 3.1.2 (de))
MSVCRT (x32 Version: 14.0.1468.721)
MyWinLocker (x32 Version: 3.1.72.0)
Network Guide L355 Series (x32)
Pflanzen gegen Zombies (x32)
Qualcomm Gobi Images (x32 Version: 1.0.24)
QuickTime (x32 Version: 7.74.80.86)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6873)
Star Defender 4 (x32)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 13.2.2.0)
System Requirements Lab for Intel (x32 Version: 4.5.15.0)
Ultra Defragmenter (x32 Version: 6.0.2)
Uninstall 1.0.0.1 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0)
VLC media player 2.0.7 (x32 Version: 2.0.7)
VoiceOver Kit (x32 Version: 1.42.128.0)
Welcome Center (x32 Version: 1.00.3005)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8064.0206)
Windows Live Essentials (x32 Version: 14.0.8064.206)
Windows Live Fotogalerie (x32 Version: 14.0.8064.206)
Windows Live Mail (x32 Version: 14.0.8064.0206)
Windows Live Messenger (x32 Version: 14.0.8064.0206)
Windows Live Sync (x32 Version: 14.0.8064.206)
Windows Live Writer (x32 Version: 14.0.8064.0206)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
==================== Restore Points =========================
23-10-2013 12:18:48 Windows Update
04-11-2013 17:03:14 Windows Update
11-11-2013 20:10:02 Windows Update
17-11-2013 17:28:15 Windows Update
17-11-2013 20:16:46 Windows Update
18-11-2013 05:07:36 Installed Java 7 Update 45
21-11-2013 19:05:23 Windows Update
22-11-2013 18:31:50 Malwarebytes Anti-Rootkit Restore Point
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-11-22 06:30 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {014F4AD7-6D70-444B-9807-AD497753D194} - System32\Tasks\{E9C03329-E2EF-468E-BFB7-4E0CBC23E7AD} => C:\Program Files (x86)\Skype\\Phone\Skype.exe
Task: {05797F1F-22C9-4F9C-A0A9-44E3933F7DA4} - System32\Tasks\{983E774A-5C88-4FF5-93A7-727170418C6D} => Firefox.exe hxxp://ui.skype.com/ui/0/5.0.0.156.259/de/eula?source=lightinstaller
Task: {0E00BAC2-5F8C-4B17-9612-18E9EFF762A1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005UA => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-08] (Facebook Inc.)
Task: {64AAAF77-2283-490B-A64A-FA5F7C4BC0DE} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-07-09] (Acer)
Task: {92F7B44E-6D8D-4838-916F-3651F6338766} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005Core => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-08] (Facebook Inc.)
Task: {9314AB6A-2654-4D7C-9DE2-6E03A9BBEDF9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05] (Google Inc.)
Task: {A57D4420-A396-4FC6-A1AC-7630B4264A41} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {CD73BF22-F837-4137-9DDF-1352815F15DD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F837F008-44D0-4BC3-AD99-66DD4F33AB0C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-05] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005Core.job => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4200865707-2185321332-2637488627-1005UA.job => C:\Users\TIMstandart\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-11-01 23:26 - 2011-11-01 23:26 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-11-01 23:26 - 2011-11-01 23:26 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-11-21 20:09 - 2013-11-21 20:10 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-10-10 14:49 - 2013-10-10 14:49 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:0B9176C0
AlternateDataStreams: C:\ProgramData\Temp:1D32EC29
AlternateDataStreams: C:\ProgramData\Temp:4D066AD2
AlternateDataStreams: C:\ProgramData\Temp:5D7E5A8F
AlternateDataStreams: C:\ProgramData\Temp:93DE1838
AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D
AlternateDataStreams: C:\ProgramData\Temp:E3C56885
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Error: (11/24/2013 11:54:05 AM) (Source: ipnathlp) (User: )
Description: 192.168.2.114192.168.137.0255.255.255.0
Error: (11/24/2013 11:53:43 AM) (Source: ipnathlp) (User: )
Description: 0
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-11-24 11:22:59.484
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-24 11:22:59.032
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-22 06:29:27.602
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-22 06:29:27.134
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-22 05:59:17.297
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-22 05:59:16.845
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-21 19:49:51.720
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-21 19:49:51.252
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-18 05:50:22.751
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-11-18 05:50:22.299
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\mbmiodrvr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 81%
Total physical RAM: 954.92 MB
Available physical RAM: 171.97 MB
Total Pagefile: 1978.92 MB
Available Pagefile: 908.25 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:136.95 GB) (Free:97.1 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 40F9D8FC)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=137 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Geändert von an-ny (24.11.2013 um 12:03 Uhr) |
|
24.11.2013, 15:37
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | ZeuS/ZBot Abuse Sicherheitswarnung Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\ProgramData\3fl9.pad
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={2362DC32-D0E8-42CC-9A51-591180EB4266}
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={2362DC32-D0E8-42CC-9A51-591180EB4266}
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.11.2013, 16:21
| #15 |
| | ZeuS/ZBot Abuse Sicherheitswarnung Fixlog Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-11-2013
Ran by Administrator at 2013-11-24 16:16:46 Run:1
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\ProgramData\3fl9.pad
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={2362DC32-D0E8-42CC-9A51-591180EB4266}
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={2362DC32-D0E8-42CC-9A51-591180EB4266}
*****************
C:\ProgramData\3fl9.pad => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe => Moved successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} => Key not found.
HKCR\Wow6432Node\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847} => Key not found.
==== End of Fixlog ====
|
|
| Themen zu ZeuS/ZBot Abuse Sicherheitswarnung |
| 32 bit, abuse, adblock, adobe, antivirus, avira, bonjour, branding, browser, converter, defender, desktop, device driver, dvdvideosoft ltd., error, farbar recovery scan tool, fehler, firefox, flash player, google, home, homepage, launch, minidump, mozilla, mp3, netzwerk, officejet, plug-in, registry, richtlinie, savefrom.net, scan, security, sketchup, software, symantec, system, telekom, usb, wildtangent games, zeus/zbot |
WARNUNG an die MITLESER: 
Linear-Darstellung
