| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre InternetaussetzerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
21.11.2013, 00:48
| #1 |
| |  Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Es passieren seit letzter Woche folgende Merkwürdigkeiten: Die Minianwendungen in der sidebar sind quasi nicht mehr erkennbar (und die Werte fuer CPU- und Speicherauslastung erscheinen mir mit 5% und 2% absolut zu niedrig), Google zeigte zeitweilig die Fehlermeldung 'we are sorry ... your computer or network may be sending automated queries', das Internet setzt immer wieder aus. Normalerweise bin ich im Internet nie als Admin unterwegs, ware aber letzte Woche wegen eines staendig fehlschlagenden JAVA-Updates mal als Admin angemeldet und habe Java upgedatet (die Probleme kamen allerdings daher dass der Updater immer wieder die 32-bit-Version installieren wollte). Ich glaube mich zu erinnern am Ende der Installation ein komisches kleines Fenster gesehen zu haben, das aber gleich wieder verschwand ... Auf jeden Fall habe ich irgendwie das Gefuehl dass etwas nicht stimmt ... Ach ja, das Programm Nvidia Geforce Experience zeigt mir jetzt ein Treiber-Update an das ich nur als eingeloggter Admin-Benutzer installieren kann, das hat es bisher noch nie getan und ueber den Nvidia-User 'Updateus' gibt es ja auch so einige Aussagen im Netz. Bin aber zuwenig Experte um das zu beurteilen. Auf jeden Fall vielen Dank im Voraus fuer jede etwaige Hilfe! Anbei die mir bekannten Logfiles: defogger_disable by jpshortstuff (23.02.10.1) Log created at 00:03 on 21/11/2013 (admin) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013 Ran by User (ATTENTION: The logged in user is not administrator) on AXXL on 21-11-2013 00:11:10 Running from G:\Eigene Dateien\Axel\SW\Malware Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Atheros Communications) D:\Programme\Bluetooth\BtvStack.exe (Atheros Commnucations) D:\Programme\Bluetooth\AthBtTray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe () C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe () D:\Programme\Steuer2013\taxaktuell.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe () D:\Programme\Marvell\tray\MarvellTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe (Microsoft Corporation) C:\Windows\system32\taskmgr.exe (Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Farbar) G:\Eigene Dateien\Axel\SW\Malware\FRST64er.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-02] (Realtek Semiconductor) HKLM\...\Run: [itype] - C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation) HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [AtherosBtStack] - D:\Programme\Bluetooth\BtvStack.exe [613536 2010-10-27] (Atheros Communications) HKLM\...\Run: [AthBtTray] - D:\Programme\Bluetooth\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [Userinit] - C:\Users\User\AppData\Roaming\appconf32.exe HKCU\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-04-05] () HKCU\...\Run: [TomTomHOME.exe] - D:\Programme\TomTom\\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] () HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation) HKLM-x32\...\Run: [MSUTray] - D:\Programme\Marvell\tray\MarvellTray.exe [1199144 2010-11-19] () HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (No File) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x10D0EB6A3929CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - D:\Programme\Bluetooth\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-04] (Avira Operations GmbH & Co. KG) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [918144 2010-11-03] () R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [915584 2010-12-02] () R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] () R2 AtherosSvc; D:\Programme\Bluetooth\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) S2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 Marvell Storage Management; D:\Programme\Marvell\svc\mvraidsvc.exe [345640 2010-11-25] (Marvell) R2 MBAMScheduler; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSUWebService; D:\Programme\Marvell\Apache2\bin\httpd.exe [24645 2010-09-02] (Apache Software Foundation) R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-07-12] () R2 TomTomHOMEService; D:\Programme\TomTom\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom) ==================== Drivers (Whitelisted) ==================== R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-07] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation) S1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [x] U3 pxldrpod; \??\C:\Users\admin\AppData\Local\Temp\pxldrpod.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2021-11-06 04:12 - 2021-11-06 04:12 - 00207872 _____ (TODO: <Company name>) C:\Windows\SysWOW64\MVTrim.dll 2013-11-21 00:10 - 2013-11-21 00:10 - 00000000 ____D C:\FRST 2013-11-21 00:03 - 2013-11-21 00:03 - 00000000 _____ C:\Users\admin\defogger_reenable 2013-11-21 00:02 - 2013-11-21 00:02 - 00000786 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-21 00:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-20 23:30 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files (x86)\ESET 2013-11-20 21:47 - 2013-11-20 21:47 - 105435909 _____ C:\Windows\SysWOW64\䪨궽轜ª 2013-11-19 10:55 - 2013-11-19 10:55 - 00000000 ____D C:\Windows\rescache 2013-11-17 22:56 - 2013-11-08 21:47 - 01064224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-11-17 22:56 - 2013-11-08 21:47 - 00955168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-11-17 22:56 - 2013-09-28 00:01 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-11-17 22:56 - 2013-09-28 00:01 - 00028960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-11-17 21:03 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE 2013-11-17 21:01 - 2013-11-17 21:03 - 00010277 _____ C:\Windows\IE11_main.log 2013-11-17 21:01 - 2013-11-17 21:01 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-17 21:00 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Works 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 2013-11-16 22:27 - 2013-11-16 22:27 - 00000000 ____D C:\Windows\PCHEALTH 2013-11-16 22:26 - 2013-11-16 22:26 - 00000000 ____D C:\Program Files\Microsoft Office 2013-11-16 21:51 - 2013-11-16 21:52 - 00000801 _____ C:\Users\User\Desktop\Leonard.lnk 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iTunes 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iPod 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-16 19:39 - 2013-11-16 22:17 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-11-14 17:25 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-14 17:25 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-14 17:24 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-14 17:24 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-14 17:24 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-14 17:24 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2013-11-14 17:24 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2013-11-14 17:24 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-14 17:24 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-14 17:24 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-14 17:24 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll 2013-11-14 17:24 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-11-14 17:24 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2013-11-14 17:24 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-14 17:24 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-14 17:24 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-14 17:24 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-14 17:24 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-14 17:24 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-14 17:24 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-14 17:24 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-14 17:24 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-14 17:24 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-14 17:24 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-14 17:24 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2013-11-14 17:24 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-14 17:24 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2013-11-14 17:24 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-11-14 17:24 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-14 17:24 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-11 22:35 - 2013-11-11 22:35 - 00172172 _____ C:\Users\User\Desktop\TRUNK_Postbeleg.xps 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\ProgramData\Oracle 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\Program Files\Java 2013-11-05 21:44 - 2013-11-13 00:03 - 00000000 ____D C:\Users\User\Desktop\LEOlender Weihnachten 2013-11-05 21:44 - 2013-11-05 22:17 - 00000000 ____D C:\Users\User\Desktop\Leo Fotoalbum 2013-10-23 22:27 - 2013-11-10 13:31 - 00193024 _____ C:\Users\User\Desktop\Häuschen_2013_10_23.ppt ==================== One Month Modified Files and Folders ======= 2021-11-06 04:12 - 2021-11-06 04:12 - 00207872 _____ (TODO: <Company name>) C:\Windows\SysWOW64\MVTrim.dll 2013-11-21 00:10 - 2013-11-21 00:10 - 00000000 ____D C:\FRST 2013-11-21 00:03 - 2013-11-21 00:03 - 00000000 _____ C:\Users\admin\defogger_reenable 2013-11-21 00:03 - 2011-11-04 19:44 - 00000000 ____D C:\Users\admin 2013-11-21 00:02 - 2013-11-21 00:02 - 00000786 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-20 23:30 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files (x86)\ESET 2013-11-20 21:55 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-20 21:55 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-20 21:54 - 2011-04-12 08:43 - 00696848 _____ C:\Windows\system32\perfh007.dat 2013-11-20 21:54 - 2011-04-12 08:43 - 00148144 _____ C:\Windows\system32\perfc007.dat 2013-11-20 21:54 - 2009-07-14 06:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-20 21:50 - 2011-11-05 02:00 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini 2013-11-20 21:47 - 2013-11-20 21:47 - 105435909 _____ C:\Windows\SysWOW64\䪨궽轜ª 2013-11-20 21:47 - 2013-07-03 01:02 - 00000000 ____D C:\ProgramData\NVIDIA 2013-11-20 21:47 - 2011-11-06 16:01 - 00110916 _____ C:\Windows\SysWOW64\mvaccelerator.log 2013-11-20 21:47 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-20 21:47 - 2009-07-14 05:51 - 00115727 _____ C:\Windows\setupact.log 2013-11-20 00:40 - 2011-11-04 19:44 - 01311080 _____ C:\Windows\WindowsUpdate.log 2013-11-19 10:55 - 2013-11-19 10:55 - 00000000 ____D C:\Windows\rescache 2013-11-17 22:56 - 2013-07-03 01:01 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2013-11-17 22:56 - 2011-11-04 20:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2013-11-17 22:56 - 2011-11-04 20:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2013-11-17 21:13 - 2011-11-04 19:58 - 00001425 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2013-11-17 21:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-11-17 21:03 - 2013-11-17 21:01 - 00010277 _____ C:\Windows\IE11_main.log 2013-11-17 21:01 - 2013-11-17 21:01 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-17 20:52 - 2011-11-13 15:29 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-11-17 20:51 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini 2013-11-17 12:28 - 2010-11-21 04:47 - 00087944 _____ C:\Windows\PFRO.log 2013-11-17 12:28 - 2009-07-14 05:45 - 00421224 _____ C:\Windows\system32\FNTCACHE.DAT 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Works 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 2013-11-16 22:28 - 2011-04-12 08:54 - 00000000 ____D C:\Windows\ShellNew 2013-11-16 22:27 - 2013-11-16 22:27 - 00000000 ____D C:\Windows\PCHEALTH 2013-11-16 22:27 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-11-16 22:26 - 2013-11-16 22:26 - 00000000 ____D C:\Program Files\Microsoft Office 2013-11-16 22:18 - 2011-11-13 20:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype 2013-11-16 22:17 - 2013-11-16 19:39 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-11-16 22:17 - 2011-11-13 20:14 - 00000000 ____D C:\ProgramData\Skype 2013-11-16 21:52 - 2013-11-16 21:51 - 00000801 _____ C:\Users\User\Desktop\Leonard.lnk 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iTunes 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iPod 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-14 18:22 - 2013-08-17 00:14 - 00000000 ____D C:\Windows\system32\MRT 2013-11-13 00:03 - 2013-11-05 21:44 - 00000000 ____D C:\Users\User\Desktop\LEOlender Weihnachten 2013-11-11 22:35 - 2013-11-11 22:35 - 00172172 _____ C:\Users\User\Desktop\TRUNK_Postbeleg.xps 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\ProgramData\Oracle 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\Program Files\Java 2013-11-10 13:41 - 2013-05-07 18:52 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-11-10 13:32 - 2012-04-04 21:16 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-11-10 13:32 - 2011-11-04 20:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-11-10 13:31 - 2013-10-23 22:27 - 00193024 _____ C:\Users\User\Desktop\Häuschen_2013_10_23.ppt 2013-11-09 14:15 - 2012-11-20 23:22 - 00014866 _____ C:\Users\User\Desktop\HäuschenAloha.xlsx 2013-11-08 21:47 - 2013-11-17 22:56 - 01064224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-11-08 21:47 - 2013-11-17 22:56 - 00955168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-11-07 16:00 - 2011-11-05 00:52 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-05 22:17 - 2013-11-05 21:44 - 00000000 ____D C:\Users\User\Desktop\Leo Fotoalbum 2013-10-30 17:44 - 2011-11-13 15:34 - 00000000 ____D C:\Users\User\AppData\Local\Microsoft Help Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ --- --- --- Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-11-2013 Ran by User at 2013-11-21 00:11:20 Running from G:\Eigene Dateien\Axel\SW\Malware Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 2007 Microsoft Office Suite Service Pack 3 (SP3) (x32) 3DMark (x32 Version: 1.1) 3DMark 11 (x32 Version: 1.0.5) 64 Bit HP CIO Components Installer (Version: 6.2.2) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117) Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8) Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18) Amazon MP3-Downloader 1.0.9 (x32) Apple Application Support (x32 Version: 2.3.6) Apple Mobile Device Support (Version: 7.0.0.117) Apple Software Update (x32 Version: 2.1.3.127) ASUS GPU Tweak (x32 Version: 2.3.9.2) ASUS PC Diagnostics (x32 Version: 1.1.2) Avira Free Antivirus (x32 Version: 13.0.0.4052) Battlefield 3™ (x32 Version: 1.6.0.0) Battlelog Web Plugins (x32 Version: 2.1.7) Battlestations Midway Screen Saver (x32) Bluetooth Win7 Suite (64) (Version: 7.2.0.40) Bonjour (Version: 3.0.0.10) Call of Duty: Black Ops II - Multiplayer (x32) Call of Duty: Black Ops II - Zombies (x32) Call of Duty: Black Ops II (x32) Call of Duty: Modern Warfare 3 - Multiplayer (x32) Crysis®3 (x32 Version: 1.0.0.0) DJ_SF_06_D1600_SW_Min (x32 Version: 140.0.690.000) dm-Fotowelt (x32 Version: 5.0.1) ESET Online Scanner v3 (x32) ESN Sonar (x32 Version: 0.70.4) Futuremark SystemInfo (x32 Version: 4.17.0) GeForce Experience NvStream Client Components (Version: 1.6.28) HP Deskjet D1600 Printer Driver 14.0 Rel. 6 (Version: 14.0) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Network Connections 16.5.2.0 (Version: 16.5.2.0) Intel(R) Rapid Storage Technology (x32 Version: 10.5.0.1026) Intel® Watchdog Timer Driver (Intel® WDT) (x32) Internet-TV für Windows Media Center (x32 Version: 4.2.2.0) iTunes (Version: 11.1.3.8) Java 7 Update 25 (x32 Version: 7.0.250) Java 7 Update 45 (64-bit) (Version: 7.0.450) Java Auto Updater (x32 Version: 2.1.9.5) JMicron JMB36X Driver (x32 Version: 1.17.58.2) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) marvell 91xx driver (x32 Version: 1.0.0.1051) Marvell Storage Utility V4 (x32 Version: 4.1.0.1909) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft IntelliPoint 8.2 (Version: 8.20.468.0) Microsoft IntelliType Pro 8.2 (Version: 8.20.469.0) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) n-tv plus (x32 Version: 7.4.3.0) NVIDIA 3D Vision Treiber 327.23 (Version: 327.23) NVIDIA GeForce Experience 1.7.1 (Version: 1.7.1) NVIDIA Grafiktreiber 327.23 (Version: 327.23) NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4) NVIDIA Install Application (Version: 2.1002.140.952) NVIDIA LED Visualizer 1.0 (Version: 1.0) NVIDIA PhysX (x32 Version: 9.13.0604) NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604) NVIDIA ShadowPlay 9.3.21 (Version: 9.3.21) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2723) NVIDIA Systemsteuerung 327.23 (Version: 327.23) NVIDIA Update 9.3.21 (Version: 9.3.21) NVIDIA Update Components (Version: 9.3.21) NVIDIA Virtual Audio 1.2.9 (Version: 1.2.9) Opera 12.16 (HKCU Version: 12.16.1860) Origin (x32 Version: 9.1.10.2728) Picasa 3 (x32 Version: 3.9) PlexTools Professional XL V3.16 (x32 Version: 3.16) PunkBuster Services (x32 Version: 0.991) QuickTime (x32 Version: 7.74.80.86) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6235) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0) Safari (x32 Version: 5.34.57.2) SHIELD Streaming (Version: 1.6.53) Skype™ 6.10 (x32 Version: 6.10.104) Steam (x32 Version: 1.0.0.0) System Requirements Lab (x32) t@x 2013 (x32 Version: 20.00.8137) TomTom HOME (x32 Version: 2.9.6) TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2) Toolbox (x32 Version: 140.0.428.000) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825642) 32-Bit Edition (x32) Update für Microsoft Office Excel 2007 Help (KB963678) (x32) Update für Microsoft Office Outlook 2007 Help (KB963677) (x32) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32) Update für Microsoft Office Word 2007 Help (KB963665) (x32) VirtualDJ Home FREE (x32 Version: 7.0.5) Windows Media Center Add-in for Silverlight (x32 Version: 4.7.3.0) WISO Steuer-Sparbuch 2012 (x32 Version: 19.00.7303) ==================== Restore Points ========================= Could not list Restore Points. Check WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= ==================== Loaded Modules (whitelisted) ============= ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (11/20/2013 11:30:43 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (11/20/2013 09:48:58 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/20/2013 09:47:07 PM) (Source: Apache Service) (User: ) Description: The Apache service named reported the following error: >>> httpd.exe: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName . Error: (11/19/2013 10:18:24 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/19/2013 10:16:33 AM) (Source: Apache Service) (User: ) Description: The Apache service named reported the following error: >>> httpd.exe: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName . Error: (11/18/2013 11:04:51 PM) (Source: Application Hang) (User: ) Description: Programm avscan.exe, Version 13.6.20.2100 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1130 Startzeit: 01cee4a9a1efb0b8 Endzeit: 53686 Anwendungspfad: C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe Berichts-ID: 47e4d48d-509d-11e3-afda-f46d04e3073b Error: (11/18/2013 10:50:31 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/18/2013 10:48:40 PM) (Source: Apache Service) (User: ) Description: The Apache service named reported the following error: >>> httpd.exe: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName . Error: (11/17/2013 10:35:13 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (11/17/2013 10:33:23 PM) (Source: NvStreamSvc) (User: ) Description: NvStreamSvcUnregistering VAD endpoint [0] System errors: ============= Error: (11/16/2013 10:35:32 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10. Error: (11/16/2013 10:35:32 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10. Error: (11/16/2013 10:35:32 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10. Error: (11/16/2013 10:35:32 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10. Error: (11/16/2013 10:35:31 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10. Error: (11/16/2013 10:28:38 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (11/16/2013 10:28:38 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht. Error: (11/16/2013 09:29:45 PM) (Source: volsnap) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (11/15/2013 11:55:33 PM) (Source: volsnap) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (11/14/2013 10:17:47 PM) (Source: volsnap) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 18% Total physical RAM: 16360.77 MB Available physical RAM: 13330.61 MB Total Pagefile: 32719.73 MB Available Pagefile: 29864.57 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:48.73 GB) (Free:12.27 GB) NTFS Drive d: () (Fixed) (Total:62.96 GB) (Free:14.14 GB) NTFS Drive f: (Bilder) (Fixed) (Total:298.09 GB) (Free:134.22 GB) NTFS Drive g: (Music) (Fixed) (Total:298.09 GB) (Free:33.11 GB) NTFS ==================== MBR & Partition Table ================== ==================== End Of Log ============================ GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-21 00:16:21
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 OCZ-VERT rev.2.15 111,79GB
Running: 7o4mebfe.exe; Driver: C:\Users\admin\AppData\Local\Temp\pxldrpod.sys
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [3196:2300] 000007fef4829688
---- EOF - GMER 2.1 ----
--- --- --- Code:
ATTFilter OTL logfile created on: 21.11.2013 00:33:05 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = G:\Eigene Dateien\Axel\SW\Malware
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
15,98 Gb Total Physical Memory | 13,35 Gb Available Physical Memory | 83,54% Memory free
31,95 Gb Paging File | 29,18 Gb Available in Paging File | 91,34% Paging File free
Paging file location(s): d:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,73 Gb Total Space | 12,15 Gb Free Space | 24,93% Space Free | Partition Type: NTFS
Drive D: | 62,96 Gb Total Space | 14,14 Gb Free Space | 22,46% Space Free | Partition Type: NTFS
Drive F: | 298,09 Gb Total Space | 134,22 Gb Free Space | 45,03% Space Free | Partition Type: NTFS
Drive G: | 298,09 Gb Total Space | 33,11 Gb Free Space | 11,11% Space Free | Partition Type: NTFS
Computer Name: AXXL | User Name: admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.11.20 23:52:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- G:\Eigene Dateien\Axel\SW\Malware\OTLer.exe
PRC - [2013.11.08 21:46:18 | 001,028,384 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
PRC - [2013.11.08 21:45:42 | 001,914,656 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2013.09.12 00:17:46 | 000,414,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2013.09.04 09:47:07 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.09.04 09:46:53 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.09.04 09:46:52 | 000,347,192 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.09.03 14:53:50 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.07.12 03:00:02 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2013.07.08 01:09:58 | 000,879,456 | ---- | M] (Opera Software) -- C:\Users\User\AppData\Local\Programs\Opera\opera.exe
PRC - [2013.07.02 10:19:30 | 000,093,072 | ---- | M] (TomTom) -- D:\Programme\TomTom\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2013.06.18 08:06:37 | 000,542,800 | ---- | M] () -- D:\Programme\Steuer2013\taxaktuell.exe
PRC - [2013.04.05 22:55:32 | 000,397,632 | ---- | M] () -- C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.01.17 10:24:10 | 000,055,296 | ---- | M] () -- C:\Windows\SysWOW64\ASGT.exe
PRC - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.04.30 00:32:50 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.12.02 10:15:14 | 000,915,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
PRC - [2010.11.25 08:08:42 | 000,345,640 | ---- | M] (Marvell) -- D:\Programme\Marvell\svc\mvraidsvc.exe
PRC - [2010.11.19 08:58:56 | 001,199,144 | ---- | M] () -- D:\Programme\Marvell\tray\MarvellTray.exe
PRC - [2010.11.17 09:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010.11.03 17:30:14 | 000,918,144 | ---- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
PRC - [2010.10.21 17:52:26 | 000,586,880 | ---- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
PRC - [2010.09.02 03:47:48 | 000,024,645 | ---- | M] (Apache Software Foundation) -- D:\Programme\Marvell\Apache2\bin\httpd.exe
========== Modules (No Company Name) ==========
MOD - [2013.11.03 23:07:18 | 016,233,864 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll
MOD - [2013.10.11 21:39:56 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll
MOD - [2013.10.11 21:39:47 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll
MOD - [2013.10.11 21:39:46 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll
MOD - [2013.09.13 13:58:24 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll
MOD - [2013.08.18 01:00:05 | 000,492,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\868b835c2e1cc3d300fa4ae89763b00d\IAStorUtil.ni.dll
MOD - [2013.08.17 22:58:16 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll
MOD - [2013.08.17 22:58:08 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll
MOD - [2013.08.17 22:58:06 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll
MOD - [2013.07.14 08:50:09 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\0700c2f087ac72d9e8aa1874bef26960\IAStorCommon.ni.dll
MOD - [2013.07.12 02:22:05 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll
MOD - [2013.06.18 08:07:41 | 003,031,120 | ---- | M] () -- D:\Programme\Steuer2013\wcore13.dll
MOD - [2013.06.18 08:07:30 | 008,932,432 | ---- | M] () -- D:\Programme\Steuer2013\wgui13.dll
MOD - [2013.06.18 08:07:05 | 006,766,160 | ---- | M] () -- D:\Programme\Steuer2013\wkont13.dll
MOD - [2013.06.18 08:07:01 | 004,157,520 | ---- | M] () -- D:\Programme\Steuer2013\wauff13.dll
MOD - [2013.06.18 08:07:01 | 000,321,104 | ---- | M] () -- D:\Programme\Steuer2013\rsguiwinapi48.dll
MOD - [2013.06.18 08:06:59 | 001,314,384 | ---- | M] () -- D:\Programme\Steuer2013\wfabu13.dll
MOD - [2013.06.18 08:06:59 | 000,308,816 | ---- | M] () -- D:\Programme\Steuer2013\rscorewinapi48.dll
MOD - [2013.06.18 08:06:58 | 002,191,952 | ---- | M] () -- D:\Programme\Steuer2013\wfvie13.dll
MOD - [2013.06.18 08:06:54 | 004,949,072 | ---- | M] () -- D:\Programme\Steuer2013\wbae113.dll
MOD - [2013.06.18 08:06:54 | 001,305,680 | ---- | M] () -- D:\Programme\Steuer2013\wwerb13.dll
MOD - [2013.06.18 08:06:54 | 001,226,320 | ---- | M] () -- D:\Programme\Steuer2013\whau213.dll
MOD - [2013.06.18 08:06:54 | 001,146,960 | ---- | M] () -- D:\Programme\Steuer2013\whau113.dll
MOD - [2013.06.18 08:06:53 | 001,245,184 | ---- | M] () -- D:\Programme\Steuer2013\wimp13.dll
MOD - [2013.06.18 08:06:51 | 001,565,264 | ---- | M] () -- D:\Programme\Steuer2013\wbae413.dll
MOD - [2013.06.18 08:06:50 | 001,748,560 | ---- | M] () -- D:\Programme\Steuer2013\wbae313.dll
MOD - [2013.06.18 08:06:49 | 001,368,144 | ---- | M] () -- D:\Programme\Steuer2013\wbae213.dll
MOD - [2013.06.18 08:06:48 | 001,608,272 | ---- | M] () -- D:\Programme\Steuer2013\wsteu13.dll
MOD - [2013.06.18 08:06:47 | 001,730,640 | ---- | M] () -- D:\Programme\Steuer2013\wreli13.dll
MOD - [2013.06.18 08:06:39 | 001,498,192 | ---- | M] () -- D:\Programme\Steuer2013\wmain13.dll
MOD - [2013.06.18 08:06:37 | 000,542,800 | ---- | M] () -- D:\Programme\Steuer2013\taxaktuell.exe
MOD - [2013.06.18 08:06:33 | 000,136,272 | ---- | M] () -- D:\Programme\Steuer2013\rsodbc48.dll
MOD - [2013.06.18 08:06:31 | 000,028,672 | ---- | M] () -- D:\Programme\Steuer2013\rsdcom48.dll
MOD - [2013.04.05 22:55:32 | 000,397,632 | ---- | M] () -- C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
MOD - [2013.03.15 15:09:38 | 001,041,408 | ---- | M] () -- D:\Programme\Steuer2013\clucene-core.dll
MOD - [2013.02.12 11:03:49 | 000,251,392 | ---- | M] () -- D:\Programme\Steuer2013\clucene-contribs-lib.dll
MOD - [2013.02.12 11:03:49 | 000,094,208 | ---- | M] () -- D:\Programme\Steuer2013\clucene-shared.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.04.12 08:43:06 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.25 04:41:36 | 002,328,064 | ---- | M] () -- C:\Windows\SysWOW64\MvAccelerator.dll
MOD - [2010.11.19 08:58:56 | 001,199,144 | ---- | M] () -- D:\Programme\Marvell\tray\MarvellTray.exe
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
========== Services (SafeList) ==========
SRV:64bit: - [2013.11.17 21:01:38 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2011.06.29 10:51:26 | 000,171,688 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R)
SRV - [2013.11.08 21:47:21 | 015,125,280 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
SRV - [2013.11.08 21:45:42 | 001,914,656 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013.10.09 03:19:14 | 000,565,672 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.09.12 00:17:46 | 000,414,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2013.09.05 10:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.09.04 09:47:07 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.09.04 09:46:56 | 000,815,160 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2013.09.04 09:46:53 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.09.03 14:53:50 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.07.12 03:00:02 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2013.07.02 10:19:30 | 000,093,072 | ---- | M] (TomTom) [Auto | Running] -- D:\Programme\TomTom\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013.02.17 11:18:06 | 000,137,336 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2012.01.17 10:24:10 | 000,055,296 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\ASGT.exe -- (ASGT)
SRV - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.12.02 10:15:14 | 000,915,584 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010.11.25 08:08:42 | 000,345,640 | ---- | M] (Marvell) [Auto | Running] -- D:\Programme\Marvell\svc\mvraidsvc.exe -- (Marvell Storage Management)
SRV - [2010.11.03 17:30:14 | 000,918,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc)
SRV - [2010.10.27 16:18:52 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto | Running] -- D:\Programme\Bluetooth\AdminService.exe -- (AtherosSvc)
SRV - [2010.10.21 17:52:26 | 000,586,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2010.09.02 03:47:48 | 000,024,645 | ---- | M] (Apache Software Foundation) [Auto | Running] -- D:\Programme\Marvell\Apache2\bin\httpd.exe -- (MSUWebService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2013.09.28 00:01:44 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:64bit: - [2013.09.17 21:22:42 | 000,196,384 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2013.09.04 09:47:11 | 000,132,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.09.04 09:47:11 | 000,105,344 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2013.08.07 02:30:10 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013.03.25 13:41:46 | 000,076,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2013.02.25 09:12:04 | 002,426,672 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
DRV:64bit: - [2012.12.13 13:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 15:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.08.10 16:40:58 | 000,023,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:64bit: - [2011.08.01 15:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.20 09:37:56 | 000,342,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:64bit: - [2011.04.26 11:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.10 13:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 13:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.11.22 08:09:06 | 000,303,408 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx)
DRV:64bit: - [2010.11.22 08:09:06 | 000,024,880 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91cons.sys -- (mv91cons)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.10.27 15:50:28 | 000,301,680 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2010.10.27 15:50:28 | 000,279,152 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2010.10.27 15:50:28 | 000,203,624 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2010.10.27 15:50:28 | 000,156,520 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2010.10.27 15:50:28 | 000,058,992 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2010.10.27 15:50:28 | 000,055,336 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AthDfu.sys -- (ATHDFU)
DRV:64bit: - [2010.10.27 15:50:28 | 000,038,248 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2010.10.27 15:50:28 | 000,031,080 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2010.10.19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.08.18 01:28:32 | 000,026,136 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ICCWDT.sys -- (ICCWDT)
DRV:64bit: - [2010.08.10 17:29:14 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.07.26 15:26:34 | 000,050,072 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:64bit: - [2008.07.26 15:25:48 | 000,790,424 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2008.07.26 15:22:34 | 002,624,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI)
DRV:64bit: - [2008.07.26 15:22:22 | 000,015,768 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3C F2 9B B2 27 A2 CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {361BBDD6-8498-4A25-B1A0-3CA8FF028A6B}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\..\SearchScopes\{361BBDD6-8498-4A25-B1A0-3CA8FF028A6B}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searcerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.7: C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Picasa\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - D:\Programme\Bluetooth\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AthBtTray] D:\Programme\Bluetooth\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] D:\Programme\Bluetooth\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Nvtmru] C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [MSUTray] D:\Programme\Marvell\tray\MarvellTray.exe ()
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKCU..\Run: [EADM] D:\Programme\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [Steam] D:\Programme\Steam\Steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - D:\Programme\Bluetooth\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files (x86)\Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([https] in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range2 ([*] in Local intranet)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AFF80821-4129-402D-A2BB-F529F3F4FEB3}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2021.11.06 04:12:38 | 000,207,872 | ---- | C] (TODO: <Company name>) -- C:\Windows\SysWow64\MVTrim.dll
[2013.11.21 00:10:59 | 000,000,000 | ---D | C] -- C:\FRST
[2013.11.21 00:02:28 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Malwarebytes
[2013.11.21 00:02:16 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.11.21 00:02:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.11.21 00:02:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.11.20 23:30:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013.11.19 10:55:06 | 000,000,000 | ---D | C] -- C:\Windows\rescache
[2013.11.17 20:59:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2013.11.17 20:59:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2013.11.16 22:28:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013.11.16 22:28:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works
[2013.11.16 22:28:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio
[2013.11.16 22:28:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2013.11.16 22:27:47 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013.11.16 22:26:38 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2013.11.16 21:29:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.11.16 21:29:12 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.11.16 21:29:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.11.16 21:29:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.11.16 21:29:12 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.11.16 19:39:11 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2013.11.16 19:39:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.11.16 19:39:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.11.10 13:41:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
[2013.11.10 13:41:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2013.11.10 13:41:31 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2021.11.06 04:12:38 | 000,207,872 | ---- | M] (TODO: <Company name>) -- C:\Windows\SysWow64\MVTrim.dll
[2013.11.21 00:26:45 | 000,021,856 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.11.21 00:26:45 | 000,021,856 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.11.21 00:26:00 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.11.21 00:26:00 | 000,696,848 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.11.21 00:26:00 | 000,652,166 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.11.21 00:26:00 | 000,148,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.11.21 00:26:00 | 000,121,098 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.11.21 00:20:08 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2013.11.21 00:19:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.11.21 00:03:54 | 000,000,000 | ---- | M] () -- C:\Users\admin\defogger_reenable
[2013.11.21 00:02:16 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.11.17 21:01:39 | 000,016,284 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.11.17 21:01:39 | 000,016,284 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.11.17 12:28:40 | 000,421,224 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.11.21 00:03:54 | 000,000,000 | ---- | C] () -- C:\Users\admin\defogger_reenable
[2013.11.21 00:02:16 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.11.17 21:01:39 | 000,016,284 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.11.17 21:01:39 | 000,016,284 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.07.12 00:51:30 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.07.12 00:51:29 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2013.07.07 23:32:27 | 000,000,022 | ---- | C] () -- C:\Windows\GPU-Z.INI
[2013.07.03 01:03:02 | 001,590,370 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.04 22:21:07 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2012.02.01 23:51:41 | 000,000,684 | ---- | C] () -- C:\Windows\wiso.ini
[2012.01.17 10:24:10 | 000,055,296 | ---- | C] () -- C:\Windows\SysWow64\ASGT.exe
========== ZeroAccess Check ==========
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.02.02 22:09:42 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Buhl Data Service
[2013.07.30 18:53:28 | 000,000,000 | ---D | M] -- C:\Users\admin\AppData\Roaming\Origin
========== Purity Check ==========
========== Files - Unicode (All) ==========
[2013.09.08 22:13:09 | 096,566,691 | ---- | M] ()(C:\Windows\SysWow64\???¡) -- C:\Windows\SysWow64\悔ᘴ轜¡
[2013.09.08 22:13:09 | 096,566,691 | ---- | C] ()(C:\Windows\SysWow64\???¡) -- C:\Windows\SysWow64\悔ᘴ轜¡
< End of report >
Geändert von axxl (21.11.2013 um 00:59 Uhr) Grund: extra.log von OTL vergessen ... |
|
21.11.2013, 08:25
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer hi,
__________________Scan mit Combofix
__________________ |
|
21.11.2013, 18:31
| #3 |
| | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Hallo schrauber,
__________________anbei der Combofix-Log. Bin dann leider erstmal bis Sonntag abend nicht an meinem Rechner. Gruss Axel Combofix Logfile: Code:
ATTFilter ComboFix 13-11-19.01 - admin 21.11.2013 18:21:11.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16361.13643 [GMT 1:00]
ausgeführt von:: c:\users\User\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\FlashPlayerApp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-21 bis 2013-11-21 ))))))))))))))))))))))))))))))
.
.
2021-11-06 03:12 . 2021-11-06 03:12 207872 ----a-w- c:\windows\SysWow64\MVTrim.dll
2013-11-21 17:14 . 2013-11-21 17:14 -------- d-----w- c:\users\User\AppData\Roaming\Malwarebytes
2013-11-20 23:10 . 2013-11-20 23:10 -------- d-----w- C:\FRST
2013-11-20 23:02 . 2013-11-20 23:02 -------- d-----w- c:\users\admin\AppData\Roaming\Malwarebytes
2013-11-20 23:02 . 2013-11-20 23:02 -------- d-----w- c:\programdata\Malwarebytes
2013-11-20 23:02 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-11-20 22:30 . 2013-11-20 22:30 -------- d-----w- c:\program files (x86)\ESET
2013-11-19 18:48 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8A811230-1EFB-4BF4-AA5B-16E6810BF0C6}\mpengine.dll
2013-11-19 09:55 . 2013-11-19 09:55 -------- d-----w- c:\windows\rescache
2013-11-17 21:56 . 2013-11-08 20:47 1064224 ----a-w- c:\windows\system32\nvspcap64.dll
2013-11-17 21:56 . 2013-11-08 20:47 955168 ----a-w- c:\windows\SysWow64\nvspcap.dll
2013-11-17 21:56 . 2013-09-27 23:01 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2013-11-17 21:56 . 2013-09-27 23:01 28960 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2013-11-17 20:03 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-11-17 20:00 . 2013-09-04 12:11 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-11-17 20:00 . 2013-09-04 12:11 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-11-17 20:00 . 2013-09-04 12:11 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-11-17 20:00 . 2013-09-04 12:11 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-11-17 20:00 . 2013-09-04 12:12 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-11-17 20:00 . 2013-09-04 12:11 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-11-17 20:00 . 2013-09-04 12:11 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-11-17 19:59 . 2013-11-17 19:59 -------- d-----w- c:\program files (x86)\Microsoft
2013-11-16 21:28 . 2013-11-16 21:28 -------- d-----w- c:\program files (x86)\Microsoft Works
2013-11-16 21:27 . 2013-11-16 21:27 -------- d-----w- c:\windows\PCHEALTH
2013-11-16 21:26 . 2013-11-16 21:26 -------- d-----w- c:\program files\Microsoft Office
2013-11-16 20:29 . 2013-11-16 20:29 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-16 20:29 . 2013-11-16 20:29 -------- d-----w- c:\program files\iTunes
2013-11-16 20:29 . 2013-11-16 20:29 -------- d-----w- c:\program files (x86)\iTunes
2013-11-16 20:29 . 2013-11-16 20:29 -------- d-----w- c:\program files\iPod
2013-11-16 18:39 . 2013-11-16 21:17 -------- d-----r- c:\program files (x86)\Skype
2013-11-16 18:39 . 2013-11-16 18:39 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-11-14 16:25 . 2013-10-05 20:25 1474048 ----a-w- c:\windows\system32\crypt32.dll
2013-11-14 16:25 . 2013-10-05 19:57 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-11-10 12:41 . 2013-11-10 12:41 -------- d-----w- c:\programdata\Oracle
2013-11-10 12:41 . 2013-11-10 12:41 -------- d-----w- c:\program files\Java
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-10 12:41 . 2013-05-07 17:52 312744 ----a-w- c:\windows\system32\javaws.exe
2013-11-10 12:41 . 2013-05-07 17:52 189352 ----a-w- c:\windows\system32\javaw.exe
2013-11-10 12:41 . 2013-05-07 17:52 189352 ----a-w- c:\windows\system32\java.exe
2013-11-10 12:41 . 2013-05-07 17:52 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-11-10 12:32 . 2011-11-04 19:24 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-07 15:00 . 2011-11-04 23:52 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-09-27 23:01 . 2013-07-30 17:34 29984 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-09-17 20:22 . 2013-07-03 00:01 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-09-17 20:22 . 2013-07-03 00:01 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-09-17 20:22 . 2013-09-17 20:22 13628208 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-09-17 20:22 . 2013-07-03 00:01 15901448 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-09-17 20:22 . 2013-09-17 20:22 1222824 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2013-09-17 20:22 . 2013-07-03 00:01 1412832 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-09-17 20:22 . 2013-09-17 20:22 7648000 ----a-w- c:\windows\system32\nvopencl.dll
2013-09-17 20:22 . 2013-09-17 20:22 6329552 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-09-17 20:22 . 2013-09-17 20:22 29337376 ----a-w- c:\windows\system32\nvoglv64.dll
2013-09-17 20:22 . 2013-09-17 20:22 317472 ----a-w- c:\windows\system32\nvoglshim64.dll
2013-09-17 20:22 . 2013-09-17 20:22 266984 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2013-09-17 20:22 . 2013-09-17 20:22 22102304 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-09-17 20:22 . 2013-09-17 20:22 11274528 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-09-17 20:22 . 2013-09-17 20:22 603424 ----a-w- c:\windows\system32\NvIFR64.dll
2013-09-17 20:22 . 2013-09-17 20:22 515360 ----a-w- c:\windows\SysWow64\NvIFR.dll
2013-09-17 20:22 . 2013-09-17 20:22 168616 ----a-w- c:\windows\system32\nvinitx.dll
2013-09-17 20:22 . 2013-09-17 20:22 141336 ----a-w- c:\windows\SysWow64\nvinit.dll
2013-09-17 20:22 . 2013-09-17 20:22 681760 ----a-w- c:\windows\system32\NvFBC64.dll
2013-09-17 20:22 . 2013-09-17 20:22 586016 ----a-w- c:\windows\SysWow64\NvFBC.dll
2013-09-17 20:22 . 2013-09-17 20:22 458528 ----a-w- c:\windows\system32\nvEncodeAPI64.dll
2013-09-17 20:22 . 2013-09-17 20:22 388384 ----a-w- c:\windows\SysWow64\nvEncodeAPI.dll
2013-09-17 20:22 . 2013-09-17 20:22 31520 ----a-w- c:\windows\system32\nvhdap64.dll
2013-09-17 20:22 . 2013-09-17 20:22 196384 ----a-w- c:\windows\system32\drivers\nvhda64v.sys
2013-09-17 20:22 . 2013-09-17 20:22 1884448 ----a-w- c:\windows\system32\nvdispco6432723.dll
2013-09-17 20:22 . 2013-09-17 20:22 15703688 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-09-17 20:22 . 2013-09-17 20:22 1511712 ----a-w- c:\windows\system32\nvdispgenco6432723.dll
2013-09-17 20:22 . 2013-09-17 20:22 1510176 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2013-09-17 20:22 . 2013-09-17 20:22 2970400 ----a-w- c:\windows\system32\nvcuvid.dll
2013-09-17 20:22 . 2013-09-17 20:22 2789152 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-09-17 20:22 . 2013-09-17 20:22 12947360 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-09-17 20:22 . 2013-09-17 20:22 9281032 ----a-w- c:\windows\system32\nvcuda.dll
2013-09-17 20:22 . 2013-09-17 20:22 7720576 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-09-17 20:22 . 2013-09-17 20:22 2367264 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-09-17 20:22 . 2013-09-17 20:22 2007328 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-09-17 20:22 . 2013-09-17 20:22 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-09-17 20:22 . 2013-09-17 20:22 25256224 ----a-w- c:\windows\system32\nvcompiler.dll
2013-09-17 20:22 . 2013-07-03 00:01 2986672 ----a-w- c:\windows\system32\nvapi64.dll
2013-09-17 20:22 . 2013-07-03 00:01 2630304 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-09-12 07:25 . 2013-07-03 00:01 6599968 ----a-w- c:\windows\system32\nvcpl.dll
2013-09-12 07:25 . 2013-07-03 00:01 3452192 ----a-w- c:\windows\system32\nvsvc64.dll
2013-09-12 07:25 . 2013-07-03 00:01 920864 ----a-w- c:\windows\system32\nvvsvc.exe
2013-09-12 07:25 . 2013-07-03 00:01 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-09-12 07:25 . 2013-07-03 00:01 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-09-12 07:25 . 2013-07-03 00:01 219424 ----a-w- c:\windows\system32\nvmctray.dll
2013-09-11 23:17 . 2013-09-11 23:17 571168 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-09-11 22:06 . 2013-07-03 00:01 3361114 ----a-w- c:\windows\system32\nvcoproc.bin
2013-09-08 02:30 . 2013-10-11 13:10 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-11 13:10 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-11 13:10 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-09-04 08:47 . 2013-08-07 01:36 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-04 08:47 . 2013-08-07 01:34 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-04 08:47 . 2013-08-07 01:34 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-03 12:35 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-08-29 02:17 . 2013-10-11 13:10 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-29 02:16 . 2013-10-11 13:10 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-08-29 02:16 . 2013-10-11 13:10 243712 ----a-w- c:\windows\system32\wow64.dll
2013-08-29 02:16 . 2013-10-11 13:10 859648 ----a-w- c:\windows\system32\tdh.dll
2013-08-29 02:13 . 2013-10-11 13:10 878080 ----a-w- c:\windows\system32\advapi32.dll
2013-08-29 01:51 . 2013-10-11 13:10 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-08-29 01:51 . 2013-10-11 13:10 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-08-29 01:50 . 2013-10-11 13:10 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-08-29 01:50 . 2013-10-11 13:10 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-08-29 01:50 . 2013-10-11 13:10 619520 ----a-w- c:\windows\SysWow64\tdh.dll
2013-08-29 01:48 . 2013-10-11 13:10 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
2013-08-29 01:48 . 2013-10-11 13:10 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-08-29 00:49 . 2013-10-11 13:10 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-08-29 00:49 . 2013-10-11 13:10 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-08-29 00:49 . 2013-10-11 13:10 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-08-29 00:49 . 2013-10-11 13:10 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-08-28 01:21 . 2013-10-11 13:10 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-08-28 01:12 . 2013-10-11 13:10 461312 ----a-w- c:\windows\system32\scavengeui.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\programme\Steam\Steam.exe" [2013-10-09 1813928]
"EADM"="d:\programme\Origin\Origin.exe" [2013-10-18 3561816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2010-01-19 43632]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]
"MSUTray"="d:\programme\Marvell\tray\MarvellTray.exe" [2010-11-19 1199144]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-04 347192]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-01 152392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
" Malwarebytes Anti-Malware "="d:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2013-04-04 532040]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
t@x aktuell.lnk - d:\programme\Steuer2013\taxaktuell.exe [2013-6-7 542800]
WISO Mein Steuer-Sparbuch heute.lnk - d:\programme\Steuer2012\mshaktuell.exe [2012-2-1 1380464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 ASGT;ASGT;c:\windows\SysWOW64\ASGT.exe;c:\windows\SysWOW64\ASGT.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 mv91cons;Marvell 91xx Config Device Driver;c:\windows\system32\DRIVERS\mv91cons.sys;c:\windows\SYSNATIVE\DRIVERS\mv91cons.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys;c:\windows\SYSNATIVE\DRIVERS\mv91xx.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [x]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [x]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [x]
S2 AtherosSvc;AtherosSvc;d:\programme\Bluetooth\adminservice.exe;d:\programme\Bluetooth\adminservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 Marvell Storage Management;Marvell Storage Management Service;d:\programme\Marvell\svc\mvraidsvc.exe;d:\programme\Marvell\svc\mvraidsvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 MSUWebService;MSU Web Service;d:\programme\Marvell\Apache2\bin\httpd.exe;d:\programme\Marvell\Apache2\bin\httpd.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;d:\programme\TomTom\TomTom HOME 2\TomTomHOMEService.exe;d:\programme\TomTom\TomTom HOME 2\TomTomHOMEService.exe [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);c:\windows\system32\DRIVERS\ICCWDT.sys;c:\windows\SYSNATIVE\DRIVERS\ICCWDT.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys;c:\windows\SYSNATIVE\drivers\LVUSBS64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-02 11545192]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"AtherosBtStack"="d:\programme\Bluetooth\BtvStack.exe" [2010-10-27 613536]
"AthBtTray"="d:\programme\Bluetooth\AthBtTray.exe" [2010-10-27 379040]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-08 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-11-08 1064224]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PlexTools Professional XL.lnk - d:\programme\PTPXL.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-11-21 18:24:18
ComboFix-quarantined-files.txt 2013-11-21 17:24
.
Vor Suchlauf: 9 Verzeichnis(se), 13.031.530.496 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 14.834.270.208 Bytes frei
.
- - End Of File - - 68415EF980B15D7496F5F442CE8618AC
|
|
22.11.2013, 13:38
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.11.2013, 23:07
| #5 |
| | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Hallo schrauber, schon mal ganz vielen Dank fuer Deine Muehe! Leider ergab sich heute folgendes Bild noch bevor ich Dein Programm abarbeiten konnte: Avira hat sich zunaechst gemeldet dass alles aktuell waere. Danach lief 2 min spaeter doch ein Update das ewig brauchte bis es losging und es endete mit einer Meldung dass ein Neustart noetig wird. Danach gab es einen Bluescreen (hatte ich unter Windows 7 ueberhaupt noch nie), nach dem erneuten hochfahren kam die Meldung von Avira CCPLG.XML: 0,1 und seitdem ist Avira nicht mehr aktiv (habe noch nicht neu installiert). So weit so schlecht. Wuerde gern wissen ob ich Avira schnellstmoeglich wieder installieren kann oder macht das aktuell keinen Sinn? Anbei nun erstmal die logs der Taetigkeiten aus Deinem letzten post: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.25.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16428 admin :: AXXL [Administrator] Schutz: Deaktiviert 25.11.2013 22:21:38 mbam-log-2013-11-25 (22-21-38).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 255153 Laufzeit: 1 Minute(n), 6 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.013 - Bericht erstellt am 25/11/2013 um 22:29:37
# Updated 24/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : admin - AXXL
# Gestartet von : G:\Eigene Dateien\Axel\SW\Malware\adwcleaner.exe
# Option : Suchen
***** [ Dienste ] *****
Dienst Gefunden : WsysSvc
***** [ Dateien / Ordner ] *****
Ordner Gefunden C:\ProgramData\eSafe
Ordner Gefunden C:\Users\admin\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
***** [ Verknüpfungen ] *****
Verknüpfung Gefunden : C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk ( hxxp://aartemis.com/?type=sc&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F )
Verknüpfung Gefunden : C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk ( hxxp://aartemis.com/?type=sc&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F )
Verknüpfung Gefunden : C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk ( hxxp://aartemis.com/?type=sc&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F )
***** [ Registrierungsdatenbank ] *****
Daten Gefunden : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - "C:\Program Files (x86)\Internet Explorer\iexplore.exe" hxxp://aartemis.com/?type=sc&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Daten Gefunden : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\SAFARI.EXE\shell\open\command [(Default)] - "C:\Program Files (x86)\Safari\Safari.exe" hxxp://aartemis.com/?type=sc&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Schlüssel Gefunden : HKCU\Software\InstallCore
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : [x64] HKCU\Software\InstallCore
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKLM\Software\aartemisSoftware
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\Software\eSafeSecControl
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl
Schlüssel Gefunden : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://aartemis.com/?type=hp&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://aartemis.com/?type=hp&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.aartemis.com/web/?type=ds&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F&q={searchTerms}
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://aartemis.com/?type=hp&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://aartemis.com/?type=hp&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.aartemis.com/web/?type=ds&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.aartemis.com/web/?type=ds&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://aartemis.com/?type=hp&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://aartemis.com/?type=hp&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.aartemis.com/web/?type=ds&ts=1385414855&from=cor&uid=OCZ-VERTEX3_OCZ-6H592CDSB203Y79F&q={searchTerms}
*************************
AdwCleaner[R0].txt - [4787 octets] - [25/11/2013 22:29:37]
########## EOF - \AdwCleaner\AdwCleaner[R0].txt - [4847 octets] ##########
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.013 - Bericht erstellt am 25/11/2013 um 22:30:32
# Updated 24/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : admin - AXXL
# Gestartet von : G:\Eigene Dateien\Axel\SW\Malware\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : WsysSvc
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\Users\admin\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\SAFARI.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKLM\Software\aartemisSoftware
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
*************************
AdwCleaner[R0].txt - [4953 octets] - [25/11/2013 22:29:37]
AdwCleaner[S0].txt - [3214 octets] - [25/11/2013 22:30:32]
########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [3274 octets] ##########
JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by admin on 25.11.2013 at 22:42:17,05
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.11.2013 at 22:42:17,10
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ach ja, das frische FRST noch: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-11-2013 01 Ran by User (ATTENTION: The logged in user is not administrator) on AXXL on 25-11-2013 23:03:56 Running from C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RDIEXG60 Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Atheros Communications) D:\Programme\Bluetooth\BtvStack.exe (Atheros Commnucations) D:\Programme\Bluetooth\AthBtTray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe () C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe () D:\Programme\Steuer2013\taxaktuell.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe () D:\Programme\Marvell\tray\MarvellTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Opera Software) C:\Users\User\AppData\Local\Programs\Opera\opera.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe (Farbar) G:\Eigene Dateien\Axel\SW\Malware\FRST64er.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-02] (Realtek Semiconductor) HKLM\...\Run: [itype] - C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation) HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [AtherosBtStack] - D:\Programme\Bluetooth\BtvStack.exe [613536 2010-10-27] (Atheros Communications) HKLM\...\Run: [AthBtTray] - D:\Programme\Bluetooth\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [Userinit] - C:\Users\User\AppData\Roaming\appconf32.exe HKCU\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-04-05] () HKCU\...\Run: [TomTomHOME.exe] - D:\Programme\TomTom\\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom) MountPoints2: {4a089735-0f50-11e3-92c8-f46d04e3073b} - H:\LaunchU3.exe -a HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] () HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation) HKLM-x32\...\Run: [MSUTray] - D:\Programme\Marvell\tray\MarvellTray.exe [1199144 2010-11-19] () HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x10D0EB6A3929CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - D:\Programme\Bluetooth\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-25] (Avira Operations GmbH & Co. KG) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [918144 2010-11-03] () R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [915584 2010-12-02] () R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] () R2 AtherosSvc; D:\Programme\Bluetooth\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 Marvell Storage Management; D:\Programme\Marvell\svc\mvraidsvc.exe [345640 2010-11-25] (Marvell) R2 MBAMScheduler; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSUWebService; D:\Programme\Marvell\Apache2\bin\httpd.exe [24645 2010-09-02] (Apache Software Foundation) R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-07-12] () R2 TomTomHOMEService; D:\Programme\TomTom\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom) ==================== Drivers (Whitelisted) ==================== R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation) S1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2021-11-06 04:12 - 2021-11-06 04:12 - 00207872 _____ (TODO: <Company name>) C:\Windows\SysWOW64\MVTrim.dll 2013-11-25 22:29 - 2013-11-25 22:30 - 00000000 ____D C:\AdwCleaner 2013-11-25 22:27 - 2013-11-25 22:27 - 00000000 ____D C:\Users\admin\AppData\Roaming\aartemis 2013-11-25 22:12 - 2013-11-25 22:12 - 705512019 ____N C:\Windows\MEMORY.DMP 2013-11-25 22:12 - 2013-11-25 22:12 - 00000000 ____D C:\Windows\Minidump 2013-11-21 18:24 - 2013-11-21 18:24 - 00026394 _____ C:\ComboFix.txt 2013-11-21 18:20 - 2013-11-21 18:24 - 00000000 ____D C:\Qoobox 2013-11-21 18:20 - 2013-11-21 18:23 - 00000000 ____D C:\Windows\erdnt 2013-11-21 18:20 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe 2013-11-21 18:20 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe 2013-11-21 18:20 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe 2013-11-21 18:16 - 2013-11-21 18:19 - 05146522 ____R (Swearware) C:\Users\User\Desktop\ComboFix.exe 2013-11-21 18:14 - 2013-11-21 18:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes 2013-11-21 00:10 - 2013-11-21 00:10 - 00000000 ____D C:\FRST 2013-11-21 00:03 - 2013-11-21 00:03 - 00000000 _____ C:\Users\admin\defogger_reenable 2013-11-21 00:02 - 2013-11-21 00:02 - 00000786 _____ C:\Users\User\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-21 00:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-20 23:30 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files (x86)\ESET 2013-11-19 10:55 - 2013-11-19 10:55 - 00000000 ____D C:\Windows\rescache 2013-11-17 22:56 - 2013-11-08 21:47 - 01064224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-11-17 22:56 - 2013-11-08 21:47 - 00955168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-11-17 22:56 - 2013-09-28 00:01 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-11-17 22:56 - 2013-09-28 00:01 - 00028960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-11-17 21:03 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE 2013-11-17 21:01 - 2013-11-17 21:03 - 00010277 _____ C:\Windows\IE11_main.log 2013-11-17 21:01 - 2013-11-17 21:01 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-17 21:00 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Works 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 2013-11-16 22:27 - 2013-11-16 22:27 - 00000000 ____D C:\Windows\PCHEALTH 2013-11-16 22:26 - 2013-11-16 22:26 - 00000000 ____D C:\Program Files\Microsoft Office 2013-11-16 21:51 - 2013-11-16 21:52 - 00000801 _____ C:\Users\User\Desktop\Leonard.lnk 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iTunes 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iPod 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-16 19:39 - 2013-11-16 22:17 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-11-14 17:25 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-14 17:25 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-14 17:24 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-14 17:24 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-14 17:24 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-14 17:24 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2013-11-14 17:24 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2013-11-14 17:24 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-14 17:24 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-14 17:24 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-14 17:24 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll 2013-11-14 17:24 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-11-14 17:24 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2013-11-14 17:24 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-14 17:24 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-14 17:24 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-14 17:24 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-14 17:24 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-14 17:24 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-14 17:24 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-14 17:24 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-14 17:24 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-14 17:24 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-14 17:24 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-14 17:24 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2013-11-14 17:24 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-14 17:24 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2013-11-14 17:24 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-11-14 17:24 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-14 17:24 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-11 22:35 - 2013-11-11 22:35 - 00172172 _____ C:\Users\User\Desktop\TRUNK_Postbeleg.xps 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\ProgramData\Oracle 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\Program Files\Java 2013-11-05 21:44 - 2013-11-13 00:03 - 00000000 ____D C:\Users\User\Desktop\LEOlender Weihnachten 2013-11-05 21:44 - 2013-11-05 22:17 - 00000000 ____D C:\Users\User\Desktop\Leo Fotoalbum ==================== One Month Modified Files and Folders ======= 2021-11-06 04:12 - 2021-11-06 04:12 - 00207872 _____ (TODO: <Company name>) C:\Windows\SysWOW64\MVTrim.dll 2013-11-25 22:46 - 2011-04-12 08:43 - 00696848 _____ C:\Windows\system32\perfh007.dat 2013-11-25 22:46 - 2011-04-12 08:43 - 00148144 _____ C:\Windows\system32\perfc007.dat 2013-11-25 22:46 - 2009-07-14 06:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-25 22:46 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-25 22:46 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-25 22:39 - 2013-07-03 01:02 - 00000000 ____D C:\ProgramData\NVIDIA 2013-11-25 22:39 - 2011-11-06 16:01 - 00112320 _____ C:\Windows\SysWOW64\mvaccelerator.log 2013-11-25 22:39 - 2011-11-05 02:00 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini 2013-11-25 22:39 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-25 22:39 - 2009-07-14 05:51 - 00117351 _____ C:\Windows\setupact.log 2013-11-25 22:38 - 2011-11-04 19:44 - 01400181 _____ C:\Windows\WindowsUpdate.log 2013-11-25 22:30 - 2013-11-25 22:29 - 00000000 ____D C:\AdwCleaner 2013-11-25 22:27 - 2013-11-25 22:27 - 00000000 ____D C:\Users\admin\AppData\Roaming\aartemis 2013-11-25 22:12 - 2013-11-25 22:12 - 705512019 ____N C:\Windows\MEMORY.DMP 2013-11-25 22:12 - 2013-11-25 22:12 - 00000000 ____D C:\Windows\Minidump 2013-11-25 22:11 - 2013-08-07 02:36 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-11-25 22:11 - 2013-08-07 02:34 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-11-25 22:11 - 2013-08-07 02:34 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-11-25 22:11 - 2013-08-07 02:34 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2013-11-21 18:26 - 2010-11-21 04:47 - 00088502 _____ C:\Windows\PFRO.log 2013-11-21 18:24 - 2013-11-21 18:24 - 00026394 _____ C:\ComboFix.txt 2013-11-21 18:24 - 2013-11-21 18:20 - 00000000 ____D C:\Qoobox 2013-11-21 18:24 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default 2013-11-21 18:23 - 2013-11-21 18:20 - 00000000 ____D C:\Windows\erdnt 2013-11-21 18:23 - 2011-11-04 19:58 - 00000000 ___RD C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-11-21 18:23 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini 2013-11-21 18:19 - 2013-11-21 18:16 - 05146522 ____R (Swearware) C:\Users\User\Desktop\ComboFix.exe 2013-11-21 18:14 - 2013-11-21 18:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes 2013-11-21 00:10 - 2013-11-21 00:10 - 00000000 ____D C:\FRST 2013-11-21 00:03 - 2013-11-21 00:03 - 00000000 _____ C:\Users\admin\defogger_reenable 2013-11-21 00:03 - 2011-11-04 19:44 - 00000000 ____D C:\Users\admin 2013-11-21 00:02 - 2013-11-21 00:02 - 00000786 _____ C:\Users\User\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-20 23:30 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files (x86)\ESET 2013-11-19 10:55 - 2013-11-19 10:55 - 00000000 ____D C:\Windows\rescache 2013-11-17 22:56 - 2013-07-03 01:01 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2013-11-17 22:56 - 2011-11-04 20:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2013-11-17 22:56 - 2011-11-04 20:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2013-11-17 21:13 - 2011-11-04 19:58 - 00001425 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2013-11-17 21:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-11-17 21:03 - 2013-11-17 21:01 - 00010277 _____ C:\Windows\IE11_main.log 2013-11-17 21:01 - 2013-11-17 21:01 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-17 20:52 - 2011-11-13 15:29 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-11-17 20:51 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini 2013-11-17 12:28 - 2009-07-14 05:45 - 00421224 _____ C:\Windows\system32\FNTCACHE.DAT 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Works 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 2013-11-16 22:28 - 2011-04-12 08:54 - 00000000 ____D C:\Windows\ShellNew 2013-11-16 22:27 - 2013-11-16 22:27 - 00000000 ____D C:\Windows\PCHEALTH 2013-11-16 22:27 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-11-16 22:26 - 2013-11-16 22:26 - 00000000 ____D C:\Program Files\Microsoft Office 2013-11-16 22:18 - 2011-11-13 20:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype 2013-11-16 22:17 - 2013-11-16 19:39 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-11-16 22:17 - 2011-11-13 20:14 - 00000000 ____D C:\ProgramData\Skype 2013-11-16 21:52 - 2013-11-16 21:51 - 00000801 _____ C:\Users\User\Desktop\Leonard.lnk 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iTunes 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iPod 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-14 18:22 - 2013-08-17 00:14 - 00000000 ____D C:\Windows\system32\MRT 2013-11-13 00:03 - 2013-11-05 21:44 - 00000000 ____D C:\Users\User\Desktop\LEOlender Weihnachten 2013-11-11 22:35 - 2013-11-11 22:35 - 00172172 _____ C:\Users\User\Desktop\TRUNK_Postbeleg.xps 2013-11-11 05:50 - 2010-11-21 04:27 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\ProgramData\Oracle 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\Program Files\Java 2013-11-10 13:41 - 2013-05-07 18:52 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-11-10 13:32 - 2011-11-04 20:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-11-10 13:31 - 2013-10-23 22:27 - 00193024 _____ C:\Users\User\Desktop\Häuschen_2013_10_23.ppt 2013-11-09 14:15 - 2012-11-20 23:22 - 00014866 _____ C:\Users\User\Desktop\HäuschenAloha.xlsx 2013-11-08 21:47 - 2013-11-17 22:56 - 01064224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-11-08 21:47 - 2013-11-17 22:56 - 00955168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-11-07 16:00 - 2011-11-05 00:52 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-05 22:17 - 2013-11-05 21:44 - 00000000 ____D C:\Users\User\Desktop\Leo Fotoalbum 2013-10-30 17:44 - 2011-11-13 15:34 - 00000000 ____D C:\Users\User\AppData\Local\Microsoft Help Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ --- --- --- |
|
26.11.2013, 12:45
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre InternetaussetzerESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer |
|
27.11.2013, 02:20
| #7 |
| | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Hallo schrauber, anbei die Resultate, es scheint nix weiter gefunden worden zu sein. Allerdings ist natuerlich Avira immer noch zerschossen und die sidebar auch. Werde jetzt mal versuchen die neu zu installieren. Gruss axxl Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=de3219cc88181e498d6fc6f9f87228fc
# engine=15964
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-20 10:55:14
# local_time=2013-11-20 11:55:14 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 11255 155655819 3558 0
# compatibility_mode=5893 16776573 100 94 101204 136617964 0 0
# scanned=12787
# found=0
# cleaned=0
# scan_time=1326
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=de3219cc88181e498d6fc6f9f87228fc
# engine=16039
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-27 12:58:42
# local_time=2013-11-27 01:58:42 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775166 100 94 103628 156181627 0 0
# compatibility_mode=5893 16776573 100 94 19092 137143772 0 0
# scanned=194998
# found=0
# cleaned=0
# scan_time=3405
Code:
ATTFilter Results of screen317's Security Check version 0.99.76 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Java version out of Date! Adobe Flash Player 11.9.900.117 Adobe Reader 10.1.8 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Malwarebytes' Anti-Malware mbamscheduler.exe Axel SW Malware SecurityCheck.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-11-2013 01 Ran by User (ATTENTION: The logged in user is not administrator) on AXXL on 27-11-2013 02:17:04 Running from G:\Eigene Dateien\Axel\SW\Malware Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Atheros Communications) D:\Programme\Bluetooth\BtvStack.exe (Atheros Commnucations) D:\Programme\Bluetooth\AthBtTray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe () C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe () D:\Programme\Steuer2013\taxaktuell.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe () D:\Programme\Marvell\tray\MarvellTray.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe (Opera Software) C:\Users\User\AppData\Local\Programs\Opera\opera.exe (Farbar) G:\Eigene Dateien\Axel\SW\Malware\FRST64er.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-02] (Realtek Semiconductor) HKLM\...\Run: [itype] - C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation) HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [AtherosBtStack] - D:\Programme\Bluetooth\BtvStack.exe [613536 2010-10-27] (Atheros Communications) HKLM\...\Run: [AthBtTray] - D:\Programme\Bluetooth\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKCU\...\Run: [Userinit] - C:\Users\User\AppData\Roaming\appconf32.exe HKCU\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\User\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [397632 2013-04-05] () HKCU\...\Run: [TomTomHOME.exe] - D:\Programme\TomTom\\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom) MountPoints2: {4a089735-0f50-11e3-92c8-f46d04e3073b} - H:\LaunchU3.exe -a HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] () HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation) HKLM-x32\...\Run: [MSUTray] - D:\Programme\Marvell\tray\MarvellTray.exe [1199144 2010-11-19] () HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x10D0EB6A3929CE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - D:\Programme\Bluetooth\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-25] (Avira Operations GmbH & Co. KG) R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [918144 2010-11-03] () R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [915584 2010-12-02] () R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] () R2 AtherosSvc; D:\Programme\Bluetooth\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 Marvell Storage Management; D:\Programme\Marvell\svc\mvraidsvc.exe [345640 2010-11-25] (Marvell) R2 MBAMScheduler; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSUWebService; D:\Programme\Marvell\Apache2\bin\httpd.exe [24645 2010-09-02] (Apache Software Foundation) R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15125280 2013-11-08] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-07-12] () R2 TomTomHOMEService; D:\Programme\TomTom\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom) ==================== Drivers (Whitelisted) ==================== R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation) S1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2021-11-06 04:12 - 2021-11-06 04:12 - 00207872 _____ (TODO: <Company name>) C:\Windows\SysWOW64\MVTrim.dll 2013-11-27 02:10 - 2013-11-27 02:10 - 00001499 _____ C:\Users\User\Desktop\eset.txt 2013-11-25 23:10 - 2013-11-25 23:10 - 01958474 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2013-11-25 22:29 - 2013-11-25 22:30 - 00000000 ____D C:\AdwCleaner 2013-11-25 22:27 - 2013-11-25 22:27 - 00000000 ____D C:\Users\admin\AppData\Roaming\aartemis 2013-11-25 22:12 - 2013-11-25 22:12 - 705512019 ____N C:\Windows\MEMORY.DMP 2013-11-25 22:12 - 2013-11-25 22:12 - 00000000 ____D C:\Windows\Minidump 2013-11-21 18:24 - 2013-11-21 18:24 - 00026394 _____ C:\ComboFix.txt 2013-11-21 18:20 - 2013-11-21 18:24 - 00000000 ____D C:\Qoobox 2013-11-21 18:20 - 2013-11-21 18:23 - 00000000 ____D C:\Windows\erdnt 2013-11-21 18:20 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe 2013-11-21 18:20 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe 2013-11-21 18:20 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe 2013-11-21 18:20 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe 2013-11-21 18:16 - 2013-11-21 18:19 - 05146522 ____R (Swearware) C:\Users\User\Desktop\ComboFix.exe 2013-11-21 18:14 - 2013-11-21 18:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes 2013-11-21 00:10 - 2013-11-21 00:10 - 00000000 ____D C:\FRST 2013-11-21 00:03 - 2013-11-21 00:03 - 00000000 _____ C:\Users\admin\defogger_reenable 2013-11-21 00:02 - 2013-11-21 00:02 - 00000786 _____ C:\Users\User\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-21 00:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-19 10:55 - 2013-11-19 10:55 - 00000000 ____D C:\Windows\rescache 2013-11-17 22:56 - 2013-11-08 21:47 - 01064224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-11-17 22:56 - 2013-11-08 21:47 - 00955168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-11-17 22:56 - 2013-09-28 00:01 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2013-11-17 22:56 - 2013-09-28 00:01 - 00028960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2013-11-17 21:03 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE 2013-11-17 21:01 - 2013-11-17 21:03 - 00010277 _____ C:\Windows\IE11_main.log 2013-11-17 21:01 - 2013-11-17 21:01 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-17 21:00 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-11-17 21:00 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Works 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 2013-11-16 22:27 - 2013-11-16 22:27 - 00000000 ____D C:\Windows\PCHEALTH 2013-11-16 22:26 - 2013-11-16 22:26 - 00000000 ____D C:\Program Files\Microsoft Office 2013-11-16 21:51 - 2013-11-16 21:52 - 00000801 _____ C:\Users\User\Desktop\Leonard.lnk 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iTunes 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iPod 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-16 19:39 - 2013-11-16 22:17 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-11-14 17:25 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-14 17:25 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-14 17:24 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-14 17:24 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-14 17:24 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-14 17:24 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2013-11-14 17:24 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2013-11-14 17:24 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-14 17:24 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-14 17:24 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-14 17:24 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll 2013-11-14 17:24 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-11-14 17:24 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2013-11-14 17:24 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-14 17:24 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-14 17:24 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-14 17:24 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-14 17:24 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-14 17:24 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-14 17:24 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-14 17:24 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-14 17:24 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-14 17:24 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-14 17:24 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-14 17:24 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2013-11-14 17:24 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-14 17:24 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2013-11-14 17:24 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-11-14 17:24 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-14 17:24 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-11 22:35 - 2013-11-11 22:35 - 00172172 _____ C:\Users\User\Desktop\TRUNK_Postbeleg.xps 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\ProgramData\Oracle 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\Program Files\Java 2013-11-05 21:44 - 2013-11-13 00:03 - 00000000 ____D C:\Users\User\Desktop\LEOlender Weihnachten 2013-11-05 21:44 - 2013-11-05 22:17 - 00000000 ____D C:\Users\User\Desktop\Leo Fotoalbum ==================== One Month Modified Files and Folders ======= 2021-11-06 04:12 - 2021-11-06 04:12 - 00207872 _____ (TODO: <Company name>) C:\Windows\SysWOW64\MVTrim.dll 2013-11-27 02:10 - 2013-11-27 02:10 - 00001499 _____ C:\Users\User\Desktop\eset.txt 2013-11-27 00:59 - 2011-11-04 19:44 - 01454659 _____ C:\Windows\WindowsUpdate.log 2013-11-27 00:53 - 2012-11-20 23:22 - 00015304 _____ C:\Users\User\Desktop\HäuschenAloha.xlsx 2013-11-26 23:25 - 2011-04-12 08:43 - 00696848 _____ C:\Windows\system32\perfh007.dat 2013-11-26 23:25 - 2011-04-12 08:43 - 00148144 _____ C:\Windows\system32\perfc007.dat 2013-11-26 23:25 - 2009-07-14 06:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-26 23:01 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-26 23:01 - 2009-07-14 05:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-26 22:54 - 2013-07-03 01:02 - 00000000 ____D C:\ProgramData\NVIDIA 2013-11-26 22:54 - 2011-11-06 16:01 - 00113100 _____ C:\Windows\SysWOW64\mvaccelerator.log 2013-11-26 22:54 - 2011-11-05 02:00 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini 2013-11-26 22:54 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-26 22:54 - 2009-07-14 05:51 - 00118527 _____ C:\Windows\setupact.log 2013-11-25 23:10 - 2013-11-25 23:10 - 01958474 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2013-11-25 22:30 - 2013-11-25 22:29 - 00000000 ____D C:\AdwCleaner 2013-11-25 22:27 - 2013-11-25 22:27 - 00000000 ____D C:\Users\admin\AppData\Roaming\aartemis 2013-11-25 22:12 - 2013-11-25 22:12 - 705512019 ____N C:\Windows\MEMORY.DMP 2013-11-25 22:12 - 2013-11-25 22:12 - 00000000 ____D C:\Windows\Minidump 2013-11-25 22:11 - 2013-08-07 02:36 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-11-25 22:11 - 2013-08-07 02:34 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-11-25 22:11 - 2013-08-07 02:34 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-11-25 22:11 - 2013-08-07 02:34 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2013-11-21 18:26 - 2010-11-21 04:47 - 00088502 _____ C:\Windows\PFRO.log 2013-11-21 18:24 - 2013-11-21 18:24 - 00026394 _____ C:\ComboFix.txt 2013-11-21 18:24 - 2013-11-21 18:20 - 00000000 ____D C:\Qoobox 2013-11-21 18:24 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default 2013-11-21 18:23 - 2013-11-21 18:20 - 00000000 ____D C:\Windows\erdnt 2013-11-21 18:23 - 2011-11-04 19:58 - 00000000 ___RD C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-11-21 18:23 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini 2013-11-21 18:19 - 2013-11-21 18:16 - 05146522 ____R (Swearware) C:\Users\User\Desktop\ComboFix.exe 2013-11-21 18:14 - 2013-11-21 18:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes 2013-11-21 00:10 - 2013-11-21 00:10 - 00000000 ____D C:\FRST 2013-11-21 00:03 - 2013-11-21 00:03 - 00000000 _____ C:\Users\admin\defogger_reenable 2013-11-21 00:03 - 2011-11-04 19:44 - 00000000 ____D C:\Users\admin 2013-11-21 00:02 - 2013-11-21 00:02 - 00000786 _____ C:\Users\User\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes 2013-11-21 00:02 - 2013-11-21 00:02 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-19 10:55 - 2013-11-19 10:55 - 00000000 ____D C:\Windows\rescache 2013-11-17 22:56 - 2013-07-03 01:01 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2013-11-17 22:56 - 2011-11-04 20:40 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2013-11-17 22:56 - 2011-11-04 20:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2013-11-17 21:13 - 2011-11-04 19:58 - 00001425 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2013-11-17 21:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-11-17 21:03 - 2013-11-17 21:01 - 00010277 _____ C:\Windows\IE11_main.log 2013-11-17 21:01 - 2013-11-17 21:01 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-17 21:01 - 2013-11-17 21:01 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-17 21:01 - 2013-11-17 21:01 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-17 21:01 - 2013-11-17 21:01 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-11-17 21:01 - 2013-11-17 21:01 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-11-17 21:01 - 2013-11-17 21:01 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-11-17 21:01 - 2013-11-17 21:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2013-11-17 21:01 - 2013-11-17 21:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-17 20:52 - 2011-11-13 15:29 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-11-17 20:51 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini 2013-11-17 12:28 - 2009-07-14 05:45 - 00421224 _____ C:\Windows\system32\FNTCACHE.DAT 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Works 2013-11-16 22:28 - 2013-11-16 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 2013-11-16 22:28 - 2011-04-12 08:54 - 00000000 ____D C:\Windows\ShellNew 2013-11-16 22:27 - 2013-11-16 22:27 - 00000000 ____D C:\Windows\PCHEALTH 2013-11-16 22:27 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-11-16 22:26 - 2013-11-16 22:26 - 00000000 ____D C:\Program Files\Microsoft Office 2013-11-16 22:18 - 2011-11-13 20:14 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype 2013-11-16 22:17 - 2013-11-16 19:39 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-11-16 22:17 - 2011-11-13 20:14 - 00000000 ____D C:\ProgramData\Skype 2013-11-16 21:52 - 2013-11-16 21:51 - 00000801 _____ C:\Users\User\Desktop\Leonard.lnk 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iTunes 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files\iPod 2013-11-16 21:29 - 2013-11-16 21:29 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-14 18:22 - 2013-08-17 00:14 - 00000000 ____D C:\Windows\system32\MRT 2013-11-13 00:03 - 2013-11-05 21:44 - 00000000 ____D C:\Users\User\Desktop\LEOlender Weihnachten 2013-11-11 22:35 - 2013-11-11 22:35 - 00172172 _____ C:\Users\User\Desktop\TRUNK_Postbeleg.xps 2013-11-11 05:50 - 2010-11-21 04:27 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\ProgramData\Oracle 2013-11-10 13:41 - 2013-11-10 13:41 - 00000000 ____D C:\Program Files\Java 2013-11-10 13:41 - 2013-05-07 18:52 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-11-10 13:41 - 2013-05-07 18:52 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-11-10 13:32 - 2011-11-04 20:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-11-10 13:31 - 2013-10-23 22:27 - 00193024 _____ C:\Users\User\Desktop\Häuschen_2013_10_23.ppt 2013-11-08 21:47 - 2013-11-17 22:56 - 01064224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2013-11-08 21:47 - 2013-11-17 22:56 - 00955168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2013-11-07 16:00 - 2011-11-05 00:52 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-05 22:17 - 2013-11-05 21:44 - 00000000 ____D C:\Users\User\Desktop\Leo Fotoalbum 2013-10-30 17:44 - 2011-11-13 15:34 - 00000000 ____D C:\Users\User\AppData\Local\Microsoft Help Some content of TEMP: ==================== C:\Users\User\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ |
|
27.11.2013, 12:47
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Java und Adobe updaten. Teile mir bitte mit ob die Neuinstallation half.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.11.2013, 01:19
| #9 |
| | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Hallo schrauber, Adobe update kann ich sicher noch machen (bin aber erst morgen abend wieder an meinem Rechner), mit dem Java-Update habe ich ein Problem, die 64-Bit Version konnte ich updaten wenn ich sie gezielt ausgewaehlt habe, aber die 32-Bit-Version schlaegt immer fehl (deswegen hatte ich mich ja auch mal kurz als admin angemeldet was ich sonst nie tue). Meine Frage daher zunaechst: welche Java-Version wird denn verwendet, wenn ich Windows 7 64-Bit benutze aber der Browser (Opera) als 32 Bit laeuft? Sollte ich die 32-Bit Version erstmal deinstallieren solange ich sie nicht updaten kann? Gibt es einen geeigneten kostenlosen 64-Bit Browser den ich alternativ verwenden kann? Nun das noch groessere Problem: AVIRA liess sich beim ersten Mal nicht installieren (Bluescreen mit Memory dump), beim 2. Mal klappte es zwar aber ich kann weder den Echtzeit-Scanner einschalten noch ein Update fahren. Vor dem 2. Versuch hatte ich wie auf der AVIRA-Seite angegeben einen dort verfuegbaren Registry-Cleaner (fuer AVIRA-Eintraege) verwendet, der konnte aber 6 der gefundenen AVIRA-Eintraege nicht loeschen. Soll ich mich an den Support von AVIRA wenden? Gibt es eine vielleicht bessere Alternative statt AVIRA (auch wenn sie was kostet) die ich probieren sollte? Noch eine Frage die sich mir derzeit aufdraengt: Gibt es irgendwo VERTRAUENSWUERDIGEN (evtl. auch kostenpflichtigen) Support der sich gegebenenfalls remote auf meinen Rechner einloggt und das Problem loesen kann, ich bin eigentlich zu viel beschaeftigt um da staendig am Ball zu bleiben. Oder empfiehlt sich nur ein lokaler Dienst vor Ort der live an meinem Rechner sitzen kann? Eventuell handelt es sich ja auch nicht um verbreitete Malware/Trojaner (wie anhand der eher harmlosen Scans auch naheliegt) sondern um einen gezielteren Angriff, evtl. ist jemand in mein WiFi eingedrungen? Ich schaetze Deinen bisherigen Support sehr, bin aber auf Grund der Langwierigkeit auch gern bereit fuer weitere Aktivitaeten etwas zu bezahlen wenn ich dann nicht selbst immer alles am Rechner durchfuehren muss (habe allerdings keine Ahnung ob Ihr sowas anbietet oder ob ich mich dann an jemand anderen wenden sollte?). Eine Alternative ist natuerlich immer noch eine Neuinstallation (Betriebssystem und Programme liegen auf der SSD, Daten auf 2 HDD's), aber solange man nicht weiss um welches Problem es sich handelt besteht wahrscheinlich immer ein hohes Risiko dass das Problem postwendend wiederkommt sobald man anschliessend die jetzigen Daten-Harddisks mit Fotos, Music etc. anschliesst? Auf jeden Fall schonmal vielen Dank im voraus fuer weitere Hilfestellungen! Gruss axxl |
|
30.11.2013, 13:44
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer Es gibt keine speziellen 64bit Browser. Deinstalliere Java komplett und installier es neu. Das sollte klappen. Ich empfehle immer Emsisoft, die haben auch ne Testversion
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Sidebar korrupt, Google beklagt temporär 'automated queries', temporäre Internetaussetzer |
| antivir, antivirus, avira, computer, desktop, diagnostics, downloader, email, error, excel, farbar recovery scan tool, firefox, flash player, google, home, installation, intranet, java-update, launch, monitor.exe, mp3, object, plug-in, programm, realtek, registry, richtlinie, secur, security, sidebar, software, svchost.exe, system, updateus, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
