| |
| |||||||
Log-Analyse und Auswertung: USB Stick zeigt Verknüpfungen an - Malware gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
03.12.2013, 15:35
| #1 |
| |  USB Stick zeigt Verknüpfungen an - Malware gefunden *** das Problem besteht auf meinem privaten Rechner, welchen ich momentan im Zivildienst für eine non-profit Organisation benütze, in der keine IT Abteilung vorhanden ist*** Hallo Ich habe vor einigen Tagen einen USB Stick eines Bekannten eingesteckt, auf welchem nur Verknüpfungen angezeigt werden. Die Daten sind noch auf dem Stick und über die entsprechenden Verknüpfungen abrufbar. In der Zwischenzeit habe ich zwecks Backup meinen eigenen USB Stick mit dem Rechner verwendet, nun zeigt dieser auch nur noch Verknüpfungen an. Da wurde ich stutzig und habe recherchiert, woran das Problem liegen könnte. Habe dieses Forum gefunden (vielen Dank!) und bisher die folgenden Schritte unternommen: - Scan mit Avira: keine Funde. - Scan mit Malwarebytes: 6 Funde Wie hier beschrieben die entsprechenden Daten entfernen lassen. Logfile: Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.28.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16736 ***** :: T410TIMON [Administrator] Schutz: Aktiviert 28.11.2013 19:08:03 mbam-log-2013-11-28 (19-08-03).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 613433 Laufzeit: 4 Stunde(n), 33 Minute(n), 38 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 2 HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {A6D59214-378C-11E1-902E-889FFAEC7872} -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {A6D59214-378C-11E1-902E-889FFAEC7872} -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\$Recycle.Bin\S-1-5-21-3092931146-3205444336-2170880425-1000\$RXN8YB2.exe (PUP.Optional.Softonic) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\*****\Documents\Lib\Winamp\winamp565_full_emusic-7plus_all.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) - den betroffenen USB Stick mit CCleaner Festplatten Wiper 1x komplett überschrieben und Daten wieder raufgespielt, nach 2x einstöpseln sind wieder nur Verknüpfungen sichtbar. - anschliessend defogger, frst und GMER Anleitungen befolgt, hier die Logfiles: defogger_disable by jpshortstuff (23.02.10.1) Log created at 15:21 on 03/12/2013 (*****) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2013 Ran by ***** (administrator) on T410TIMON on 03-12-2013 15:25:26 Running from C:\Users\*****\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Lenovo.) C:\Windows\System32\ibmpmsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (UPEK Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe (Lenovo.) C:\Windows\System32\TpShocks.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Windows\System32\wscript.exe (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe (Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Lenovo.) C:\Program Files (x86)\ThinkPad\Utilities\DzSvc64.exe (Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe () C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe () C:\Program Files (x86)\Lenovo\System Update\SUService.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (Acresso Software Inc.) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe () C:\Program Files (x86)\XAMPP\xampp-control.exe (Apache Software Foundation) C:\Program Files (x86)\XAMPP\apache\bin\httpd.exe () C:\Program Files (x86)\XAMPP\mysql\bin\mysqld.exe (Apache Software Foundation) C:\Program Files (x86)\XAMPP\apache\bin\httpd.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe () C:\Users\*****\Desktop\Defogger.exe (VideoLAN) C:\Program Files (x86)\VideoLAN\VLC\vlc.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-15] () HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2697512 2011-02-17] (Synaptics Incorporated) HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [54120 2011-05-30] (Lenovo Group Limited) HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [380776 2010-07-01] (Lenovo.) HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.) HKCU\...\Run: [Google Update] - C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-03-24] (Google Inc.) HKCU\...\Run: [AdobeBridge] - [x] HKCU\...\Run: [ciizgfaygg] - C:\Users\*****\AppData\Local\Temp\ciizgfaygg..vbs [70199 2013-07-27] () <===== ATTENTION HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2010-05-03] (Intel Corporation) HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [1543016 2011-02-04] (Lenovo Group Limited) HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.) HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.) HKLM-x32\...\Run: [AdobeCS4ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2012-11-13] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421736 2012-03-27] (Apple Inc.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707984 2013-10-10] (Cisco Systems, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) AppInit_DLLs: C:\Windows\System32\nvinitx.dll [239720 2011-08-12] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [200808 2011-08-12] (NVIDIA Corporation) Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs () Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEEE6D07BBF17CC01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO-x32: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Program Files (x86)\IDM\QUICKfind\PlugIns\IEHelp.dll (IDM) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\c36zwufd.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\*****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\*****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml Chrome: ======= CHR HomePage: hxxp://erichamiter.com CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Google Update) - C:\Users\*****\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Extension: (YouTube) - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Session Buddy) - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\edacconmaakjimmfgnblocblbcdcpbko\3.2.3_0 CHR Extension: ( "name": "Eric Hamiter") - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmplllfmgpkogegnjnkecmkdbeaeheop\1.0_0 CHR Extension: (Blocker) - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jphfnnacagbhfelldlccmiocmdodnlio\1.2_0 CHR Extension: (Google Wallet) - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0 CHR Extension: (Print Friendly & PDF) - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohlencieiipommannpdfcmfdpjjmeolj\2.3_0 CHR Extension: (Gmail) - C:\Users\TIMONK~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 CHR StartMenuInternet: Google Chrome - C:\Users\*****\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG) R3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [477032 2011-05-09] (Lenovo.) R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-06-26] () R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2010-08-31] (Lenovo Group Limited) S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1492280 2011-08-18] (Lenovo Group Limited) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107416 2013-12-03] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13840 2009-03-13] (UPEK Inc.) R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-30] (Lenovo Information Product(ShenZhen China) Inc.) S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-12-03 15:25 - 2013-12-03 15:25 - 00022343 _____ C:\Users\*****\Desktop\FRST.txt 2013-12-03 15:25 - 2013-12-03 15:25 - 00000000 ____D C:\FRST 2013-12-03 15:23 - 2013-12-03 15:24 - 01959434 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe 2013-12-03 15:21 - 2013-12-03 15:21 - 00000484 _____ C:\Users\*****\Desktop\defogger_disable.log 2013-12-03 15:21 - 2013-12-03 15:21 - 00000000 _____ C:\Users\*****\defogger_reenable 2013-12-03 15:19 - 2013-12-03 15:19 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe 2013-12-03 08:39 - 2013-12-03 08:39 - 00000000 ____D C:\Users\*****\Desktop\Traybackup 2013-11-29 10:40 - 2013-11-29 10:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-28 18:57 - 2013-11-28 18:57 - 00000000 ____D C:\Users\*****\AppData\Roaming\Malwarebytes 2013-11-28 18:56 - 2013-11-28 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-28 18:56 - 2013-11-28 18:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-28 18:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-27 21:46 - 2013-12-01 14:04 - 00000000 ____D C:\Users\*****\Desktop\Zukunft 2013-11-22 13:58 - 2013-11-22 13:58 - 00000077 _____ C:\Users\*****\Desktop\Alle Infos zum Film wir kamen um zu helfen. Dokumentarfilm Enwicklungszusammenarbeit Schweiz Ruanda. Regie Thomas Isler. Produktion und Vertrieb maximage Zürich - www.wirkamenumzuhelfen.ch.url 2013-11-19 18:12 - 2013-11-19 18:16 - 00000000 ____D C:\Users\*****\decrypt 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\ePUBeedrmremoval 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\AppData\Roaming\.Epubor 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\AppData\Roaming\.ePUBeedrmremoval 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\.ePUBeedrmremoval 2013-11-19 18:11 - 2013-11-19 18:11 - 00001187 _____ C:\Users\Public\Desktop\ePUBee DRM Removal.lnk 2013-11-19 18:11 - 2013-11-19 18:11 - 00000000 ____D C:\Program Files (x86)\ePUBee 2013-11-19 08:29 - 2013-11-19 08:29 - 00000000 ____D C:\ProgramData\Oracle 2013-11-19 08:29 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-11-19 08:29 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-11-19 08:29 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-11-19 08:29 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-11-19 08:27 - 2013-11-19 08:29 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log 2013-11-18 08:29 - 2013-11-18 08:29 - 00000173 _____ C:\Users\*****\Desktop\Lukas Bärfuss- Hundert Tage- Mach dein Kreuz, und fahr zur Hölle - Belletristik - FAZ.url 2013-11-17 20:27 - 2013-11-17 20:29 - 03183644 _____ C:\Users\*****\Downloads\Sprachmemo 010.m4a 2013-11-14 20:06 - 2013-11-14 20:43 - 00000000 ____D C:\Users\*****\Desktop\Couchsurfing 2013-11-14 10:53 - 2013-11-14 10:56 - 00000418 _____ C:\Users\*****\Desktop\style.css 2013-11-14 08:32 - 2013-10-12 10:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-14 08:32 - 2013-10-12 10:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-14 08:32 - 2013-10-12 10:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-14 08:32 - 2013-10-12 10:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-14 08:32 - 2013-10-12 10:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-14 08:32 - 2013-10-12 09:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-14 08:32 - 2013-10-12 09:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-14 08:32 - 2013-10-12 09:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-14 08:32 - 2013-10-12 08:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-14 08:32 - 2013-10-12 08:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-14 08:31 - 2013-10-12 10:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-14 08:31 - 2013-10-12 10:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-14 08:31 - 2013-10-12 09:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-14 08:31 - 2013-10-12 09:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-13 15:46 - 2013-11-13 16:47 - 00000000 ____D C:\Users\*****\Documents\EasyRotatorPreview 2013-11-13 15:42 - 2013-11-13 15:44 - 00000000 ____D C:\Users\*****\Desktop\wp home rotator 2013-11-13 15:40 - 2013-11-13 15:40 - 00000000 ____D C:\Users\*****\Documents\EasyRotatorWPContent 2013-11-13 15:35 - 2013-11-13 15:35 - 00000000 ____D C:\Users\*****\AppData\Roaming\com.dwuser.erwizard.EasyRotatorWizard 2013-11-13 15:34 - 2013-11-13 15:34 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia 2013-11-13 15:34 - 2013-11-13 15:34 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia 2013-11-13 15:34 - 2013-11-13 15:34 - 00000000 ____D C:\Program Files (x86)\EasyRotator 2013-11-13 14:07 - 2013-10-05 22:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-13 14:07 - 2013-10-05 21:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-13 14:07 - 2013-09-28 03:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-13 14:07 - 2013-09-25 04:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-13 14:07 - 2013-09-25 04:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-13 14:07 - 2013-09-25 04:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-13 14:07 - 2013-09-25 04:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-13 14:07 - 2013-09-25 04:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-13 14:07 - 2013-09-25 04:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-13 14:07 - 2013-09-25 04:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-13 14:07 - 2013-09-25 04:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-13 14:07 - 2013-09-25 03:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2013-11-13 14:07 - 2013-09-25 03:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-13 14:07 - 2013-09-25 03:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2013-11-13 14:07 - 2013-09-25 03:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-11-13 14:07 - 2013-09-25 03:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-13 14:07 - 2013-07-04 14:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-13 14:06 - 2013-10-12 04:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-13 14:06 - 2013-10-12 04:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-13 14:06 - 2013-10-12 04:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-13 14:06 - 2013-10-12 04:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2013-11-13 14:06 - 2013-10-12 04:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2013-11-13 14:06 - 2013-10-03 04:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-13 14:06 - 2013-10-03 04:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-13 13:32 - 2013-11-13 13:32 - 00000000 ____D C:\Program Files (x86)\SamsonSoft 2013-11-11 21:23 - 2013-11-11 21:23 - 00000069 _____ C:\Users\*****\Desktop\https---www.youtube.com-watch-v=mllXxyHTzfg.url 2013-11-10 18:55 - 2013-11-10 18:55 - 00000066 _____ C:\Users\*****\Desktop\Paul van Schalkwyk Photography (paulvansphoto) on Pinterest.url 2013-11-08 15:51 - 2013-11-08 15:51 - 00000051 _____ C:\Users\*****\Desktop\Atramenta.url 2013-11-08 11:40 - 2013-11-08 11:40 - 00000060 _____ C:\Users\*****\Desktop\I.LGraphic - About Me.url 2013-11-07 07:59 - 2013-11-07 07:59 - 00000064 _____ C:\Users\*****\Desktop\Video- Jimi Hendrix- Hear My Train A Comin' - Watch American Masters Online - PBS Video.url 2013-11-04 11:20 - 2013-11-04 11:20 - 00000121 _____ C:\Users\*****\Desktop\STARTSEITE - OUTFITTERY.url ==================== One Month Modified Files and Folders ======= 2013-12-03 15:25 - 2013-12-03 15:25 - 00022343 _____ C:\Users\*****\Desktop\FRST.txt 2013-12-03 15:25 - 2013-12-03 15:25 - 00000000 ____D C:\FRST 2013-12-03 15:24 - 2013-12-03 15:23 - 01959434 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe 2013-12-03 15:23 - 2011-03-29 20:14 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc 2013-12-03 15:21 - 2013-12-03 15:21 - 00000484 _____ C:\Users\*****\Desktop\defogger_disable.log 2013-12-03 15:21 - 2013-12-03 15:21 - 00000000 _____ C:\Users\*****\defogger_reenable 2013-12-03 15:21 - 2011-03-24 21:14 - 00000000 ____D C:\Users\***** 2013-12-03 15:19 - 2013-12-03 15:19 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe 2013-12-03 15:18 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing 2013-12-03 15:10 - 2013-11-01 09:38 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-12-03 14:45 - 2011-03-24 22:57 - 00001144 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3092931146-3205444336-2170880425-1000UA.job 2013-12-03 14:33 - 2011-03-25 04:07 - 01311452 _____ C:\Windows\WindowsUpdate.log 2013-12-03 14:31 - 2012-04-18 15:11 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox 2013-12-03 13:42 - 2013-03-20 12:12 - 00107416 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-12-03 10:00 - 2011-05-03 11:13 - 00003506 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest 2013-12-03 10:00 - 2011-05-03 11:13 - 00003448 _____ C:\Windows\System32\Tasks\PCDEventLauncher 2013-12-03 10:00 - 2011-05-03 11:13 - 00000466 _____ C:\Windows\Tasks\SystemToolsDailyTest.job 2013-12-03 09:13 - 2013-08-27 12:10 - 00000000 ____D C:\Users\*****\Documents\SIM Namibia 2013-12-03 09:00 - 2013-08-09 18:41 - 00000000 ____D C:\Users\*****\Documents\Lib 2013-12-03 08:45 - 2011-03-24 22:57 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3092931146-3205444336-2170880425-1000Core.job 2013-12-03 08:39 - 2013-12-03 08:39 - 00000000 ____D C:\Users\*****\Desktop\Traybackup 2013-12-02 22:58 - 2009-07-14 06:45 - 00015168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-12-02 22:58 - 2009-07-14 06:45 - 00015168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-12-02 22:50 - 2012-04-18 15:16 - 00000000 ___RD C:\Users\*****\Documents\Dropbox 2013-12-02 22:49 - 2013-10-30 00:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-12-02 22:49 - 2013-09-05 19:57 - 00006114 _____ C:\Windows\setupact.log 2013-12-02 22:49 - 2011-08-06 12:13 - 00065536 _____ C:\Windows\system32\Ikeext.etl 2013-12-02 22:49 - 2011-03-24 21:58 - 00000000 ____D C:\ProgramData\NVIDIA 2013-12-02 22:49 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-12-01 14:52 - 2011-03-30 20:46 - 00000000 ____D C:\Users\*****\Documents\UZH 2013-12-01 14:04 - 2013-11-27 21:46 - 00000000 ____D C:\Users\*****\Desktop\Zukunft 2013-11-29 10:40 - 2013-11-29 10:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-29 05:45 - 2013-11-02 22:57 - 00003952 _____ C:\Windows\PFRO.log 2013-11-28 18:57 - 2013-11-28 18:57 - 00000000 ____D C:\Users\*****\AppData\Roaming\Malwarebytes 2013-11-28 18:56 - 2013-11-28 18:56 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-28 18:56 - 2013-11-28 18:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-28 13:32 - 2009-07-14 19:58 - 00697082 _____ C:\Windows\system32\perfh007.dat 2013-11-28 13:32 - 2009-07-14 19:58 - 00148346 _____ C:\Windows\system32\perfc007.dat 2013-11-28 13:32 - 2009-07-14 07:13 - 01613340 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-27 14:35 - 2011-03-24 21:14 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-11-25 22:14 - 2013-05-09 12:08 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-11-25 22:14 - 2013-03-20 12:12 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-11-25 22:14 - 2013-03-20 12:12 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2013-11-22 13:58 - 2013-11-22 13:58 - 00000077 _____ C:\Users\*****\Desktop\Alle Infos zum Film wir kamen um zu helfen. Dokumentarfilm Enwicklungszusammenarbeit Schweiz Ruanda. Regie Thomas Isler. Produktion und Vertrieb maximage Zürich - www.wirkamenumzuhelfen.ch.url 2013-11-20 09:17 - 2012-05-11 14:29 - 00000000 ____D C:\Users\*****\Desktop\neue Musik 2013-11-19 18:16 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\decrypt 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\ePUBeedrmremoval 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\AppData\Roaming\.Epubor 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\AppData\Roaming\.ePUBeedrmremoval 2013-11-19 18:12 - 2013-11-19 18:12 - 00000000 ____D C:\Users\*****\.ePUBeedrmremoval 2013-11-19 18:11 - 2013-11-19 18:11 - 00001187 _____ C:\Users\Public\Desktop\ePUBee DRM Removal.lnk 2013-11-19 18:11 - 2013-11-19 18:11 - 00000000 ____D C:\Program Files (x86)\ePUBee 2013-11-19 17:10 - 2013-08-29 12:32 - 00000000 ____D C:\Users\*****\Documents\My Digital Editions 2013-11-19 08:29 - 2013-11-19 08:29 - 00000000 ____D C:\ProgramData\Oracle 2013-11-19 08:29 - 2013-11-19 08:27 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log 2013-11-19 08:29 - 2011-04-06 19:22 - 00000000 ____D C:\Program Files (x86)\Java 2013-11-19 08:16 - 2013-11-01 10:50 - 00001534 _____ C:\ProgramData\ss.ini 2013-11-18 08:29 - 2013-11-18 08:29 - 00000173 _____ C:\Users\*****\Desktop\Lukas Bärfuss- Hundert Tage- Mach dein Kreuz, und fahr zur Hölle - Belletristik - FAZ.url 2013-11-17 20:41 - 2012-11-28 23:24 - 00000000 ____D C:\Users\*****\AppData\Roaming\Audacity 2013-11-17 20:29 - 2013-11-17 20:27 - 03183644 _____ C:\Users\*****\Downloads\Sprachmemo 010.m4a 2013-11-15 09:49 - 2011-03-29 21:24 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype 2013-11-14 23:33 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-11-14 20:43 - 2013-11-14 20:06 - 00000000 ____D C:\Users\*****\Desktop\Couchsurfing 2013-11-14 17:39 - 2011-10-10 22:26 - 00000000 ____D C:\ProgramData\Cisco 2013-11-14 17:39 - 2011-03-24 22:00 - 00000000 ____D C:\Program Files (x86)\Cisco 2013-11-14 10:56 - 2013-11-14 10:53 - 00000418 _____ C:\Users\*****\Desktop\style.css 2013-11-14 08:40 - 2011-05-03 11:13 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job 2013-11-14 08:31 - 2013-07-22 08:10 - 00000000 ____D C:\Windows\system32\MRT 2013-11-14 08:31 - 2011-03-29 20:36 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-11-14 08:29 - 2011-04-06 18:51 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-13 16:47 - 2013-11-13 15:46 - 00000000 ____D C:\Users\*****\Documents\EasyRotatorPreview 2013-11-13 15:44 - 2013-11-13 15:42 - 00000000 ____D C:\Users\*****\Desktop\wp home rotator 2013-11-13 15:40 - 2013-11-13 15:40 - 00000000 ____D C:\Users\*****\Documents\EasyRotatorWPContent 2013-11-13 15:35 - 2013-11-13 15:35 - 00000000 ____D C:\Users\*****\AppData\Roaming\com.dwuser.erwizard.EasyRotatorWizard 2013-11-13 15:34 - 2013-11-13 15:34 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia 2013-11-13 15:34 - 2013-11-13 15:34 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia 2013-11-13 15:34 - 2013-11-13 15:34 - 00000000 ____D C:\Program Files (x86)\EasyRotator 2013-11-13 15:34 - 2011-03-29 21:08 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-11-13 15:27 - 2011-03-29 21:11 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe 2013-11-13 13:32 - 2013-11-13 13:32 - 00000000 ____D C:\Program Files (x86)\SamsonSoft 2013-11-12 13:43 - 2011-03-29 21:24 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-11-12 13:43 - 2011-03-29 21:24 - 00000000 ____D C:\ProgramData\Skype 2013-11-11 21:23 - 2013-11-11 21:23 - 00000069 _____ C:\Users\*****\Desktop\https---www.youtube.com-watch-v=mllXxyHTzfg.url 2013-11-10 18:55 - 2013-11-10 18:55 - 00000066 _____ C:\Users\*****\Desktop\Paul van Schalkwyk Photography (paulvansphoto) on Pinterest.url 2013-11-08 15:51 - 2013-11-08 15:51 - 00000051 _____ C:\Users\*****\Desktop\Atramenta.url 2013-11-08 11:40 - 2013-11-08 11:40 - 00000060 _____ C:\Users\*****\Desktop\I.LGraphic - About Me.url 2013-11-07 11:18 - 2013-11-01 09:38 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-11-07 11:18 - 2012-03-31 11:50 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-11-07 11:18 - 2011-06-30 19:28 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-11-07 07:59 - 2013-11-07 07:59 - 00000064 _____ C:\Users\*****\Desktop\Video- Jimi Hendrix- Hear My Train A Comin' - Watch American Masters Online - PBS Video.url 2013-11-07 07:56 - 2011-05-03 11:13 - 00004244 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask 2013-11-04 11:20 - 2013-11-04 11:20 - 00000121 _____ C:\Users\*****\Desktop\STARTSEITE - OUTFITTERY.url 2013-11-04 08:57 - 2013-11-02 22:56 - 00109013 _____ C:\Users\*****\Desktop\dire_straits_brothers_in_arms.gpx Files to move or delete: ==================== C:\Users\*****\AppData\Local\Temp\ciizgfaygg..vbs Some content of TEMP: ==================== C:\Users\*****\AppData\Local\Temp\avgnt.exe C:\Users\*****\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\*****\AppData\Local\Temp\muzaf1.dll C:\Users\*****\AppData\Local\Temp\muzapp.dll C:\Users\*****\AppData\Local\Temp\muzapp.exe C:\Users\*****\AppData\Local\Temp\muzwmts.dll C:\Users\*****\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-01 11:43 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-12-2013 Ran by ***** at 2013-12-03 15:26:19 Running from C:\Users\*****\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== Update for Microsoft Office 2007 (KB2508958) (x32) Adobe Acrobat 9 Pro - English, Français, Deutsch (x32 Version: 9.5.5) Adobe Acrobat 9.5.5 - CPSID_83708 (x32) Adobe AIR (x32 Version: 3.9.0.1210) Adobe Anchor Service CS4 (x32 Version: 2.0) Adobe Anchor Service x64 CS4 (Version: 2.0) Adobe Bridge CS4 (x32 Version: 3) Adobe CMaps CS4 (x32 Version: 2.0) Adobe CMaps x64 CS4 (Version: 2.0) Adobe Color - Photoshop Specific CS4 (x32 Version: 2.0) Adobe Color EU Recommended Settings CS4 (x32 Version: 2.0) Adobe Color JA Extra Settings CS4 (x32 Version: 2.0) Adobe Color NA Extra Settings CS4 (x32 Version: 2.0) Adobe Color Video Profiles CS CS4 (x32 Version: 2.0) Adobe Creative Suite 4 Design Standard (x32 Version: 4.0) Adobe CSI CS4 (x32 Version: 1) Adobe CSI CS4 x64 (Version: 1) Adobe Default Language CS4 (x32 Version: 2.0) Adobe Digital Editions 2.0 (x32 Version: 2.0.1) Adobe Drive CS4 (x32 Version: 1) Adobe Drive CS4 x64 (Version: 1) Adobe ExtendScript Toolkit CS4 (x32 Version: 3.0.0) Adobe Extension Manager CS4 (x32 Version: 2.0) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117) Adobe Fonts All (x32 Version: 2.0) Adobe Fonts All x64 (Version: 2.0) Adobe InDesign CS4 (x32 Version: 6.0) Adobe InDesign CS4 Application Feature Set Files (Roman) (x32 Version: 6.0) Adobe InDesign CS4 Common Base Files (x32 Version: 6.0) Adobe InDesign CS4 Icon Handler (x32 Version: 6.0) Adobe InDesign CS4 Icon Handler x64 (Version: 6.0) Adobe Linguistics CS4 (x32 Version: 4.0.0) Adobe Linguistics CS4 x64 (Version: 4.0.0) Adobe Media Player (x32 Version: 0.0.0) Adobe Media Player (x32 Version: 1.1) Adobe Output Module (x32 Version: 2.0) Adobe PDF Library Files CS4 (x32 Version: 9.0) Adobe PDF Library Files x64 CS4 (Version: 9.0) Adobe Photoshop CS4 (64 Bit) (Version: 11.0) Adobe Photoshop CS4 (x32 Version: 11.0) Adobe Photoshop CS4 Support (x32 Version: 11.0) Adobe Reader X (10.1.3) - Deutsch (x32 Version: 10.1.3) Adobe Search for Help (x32 Version: 1.0) Adobe Service Manager Extension (x32 Version: 1.0) Adobe Setup (x32 Version: 2.0) Adobe SGM CS4 (x32 Version: 3.0) Adobe SING CS4 (x32 Version: 2.0) Adobe Type Support CS4 (x32 Version: 9.0) Adobe Type Support x64 CS4 (Version: 9.0) Adobe Update Manager CS4 (x32 Version: 6.0.0) Adobe WinSoft Linguistics Plugin (x32 Version: 1.1) Adobe WinSoft Linguistics Plugin x64 (Version: 1.1) Adobe XMP Panels CS4 (x32 Version: 2.0) AdobeColorCommonSetCMYK (x32 Version: 2.0) AdobeColorCommonSetRGB (x32 Version: 2.0) Anzeige am Bildschirm (Version: 6.60.03) Apple Application Support (x32 Version: 2.1.7) Apple Mobile Device Support (Version: 5.1.1.4) Apple Software Update (x32 Version: 2.1.3.127) Audacity 2.0.2 (x32 Version: 2.0.2) Avira Free Antivirus (x32 Version: 14.0.1.759) BitTorrent (x32 Version: 7.6.0) Bonjour (Version: 3.0.0.10) CCleaner (Version: 4.05) Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072) Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072) Citavi (x32 Version: 3.3.0.0) Conexant 20585 SmartAudio HD (Version: 4.95.48.50) Connect (x32 Version: 1.0.0.1) Dienstprogramm "ThinkPad UltraNav" (x32 Version: 2.13.0) DigiTech JamManager (x32 Version: 1.1.1.3) Dropbox (HKCU Version: 2.0.22) DVD Decrypter (Remove Only) (x32) EasyRotator Wizard (x32 Version: 1.0.132) ePUBee DRM Removal (x32 Version: 3.0.2.0) FileZilla Client 3.5.0 (x32 Version: 3.5.0) FreeRIP MP3 Converter 4.4.1 (x32 Version: 4.4.1) Google Chrome (HKCU Version: 31.0.1650.57) Guitar Pro 6 (x32) Hamster Free Video Converter (x32 Version: 2.0.1.26) IBM SPSS Statistics 19 (Version: 19.0.0) InfraRecorder 0.53 (x64 edition) (Version: 0.53.00.00) Integrated Camera Driver Installer Package Ver.1.1.0.42 (x32 Version: 1.1.0.42) Intel PROSet Wireless Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Management Engine Components (x32 Version: 6.0.0.1179) Intel(R) Network Connections Drivers (Version: 14.8) Intel(R) Processor Graphics (x32 Version: 8.15.10.2401) Intel(R) PROSet/Wireless WiFi-Software (Version: 13.04.0000) IsoBuster 2.8.5 (x32 Version: 2.8.5) iTunes (Version: 10.6.1.7) Java 7 Update 45 (x32 Version: 7.0.450) Java Auto Updater (x32 Version: 2.1.9.8) Java(TM) 6 Update 31 (x32 Version: 6.0.310) JavaFX 2.1.1 (x32 Version: 2.1.1) JDownloader 0.9 (x32 Version: 0.9) KeePass Password Safe 1.22 (x32 Version: 1.22) kuler (x32 Version: 2.0) LAME v3.99.3 (for Windows) (x32) Lenovo Auto Scroll Utility (Version: 1.11) Lenovo Patch Utility (x32 Version: 1.0.1.1) Lenovo Patch Utility 64 bit (Version: 1.2.0.1) Lenovo System Interface Driver (Version: 1.05) Lenovo System Update (x32 Version: 5.02.0018) Lenovo ThinkVantage Toolbox (Version: 6.0.5849.23) Logitech Unifying-Software 2.00 (Version: 2.00.43) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Medal of Honor (TM) (x32 Version: 1.0.0.0) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 25.0.1 (x86 en-US) (x32 Version: 25.0.1) Mozilla Maintenance Service (x32 Version: 25.0.1) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) NVIDIA 3D Vision Treiber 275.93 (Version: 275.93) NVIDIA Display Control Panel (Version: 6.14.12.5738) NVIDIA Grafiktreiber 275.93 (Version: 275.93) NVIDIA HD-Audiotreiber 1.2.23.3 (Version: 1.2.23.3) NVIDIA Install Application (Version: 2.275.82.0) NVIDIA Optimus 1.3.12 (Version: 1.3.12) NVIDIA PhysX (x32 Version: 9.12.0213) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.7593) NVIDIA Systemsteuerung 275.93 (Version: 275.93) NVIDIA Update Components (Version: 1.3.12) NVIDIA Updatus (x32 Version: 1.0.3) Oxford Collocations Dictionary (x32) PDF Settings CS4 (x32 Version: 9.0) Photoshop Camera Raw (x32 Version: 5.0) Photoshop Camera Raw_x64 (Version: 5.0) QUICKfind server v1.1 (x32) QuickTime (x32 Version: 7.71.80.42) Rescue and Recovery (x32 Version: 4.50.0025.00) RICOH R5U230 Media Driver ver.2.06.02.02 (x32 Version: 2.06.02.02) SAMSUNG USB Driver for Mobile Phones (Version: 1.3.2250.0) Secure Download Manager (x32 Version: 3.1.10) Skype Click to Call (x32 Version: 6.3.11079) Skype™ 6.10 (x32 Version: 6.10.104) Suite Shared Configuration CS4 (x32 Version: 1.0) ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.2.1.2900) ThinkPad Energie-Manager (x32 Version: 3.45) ThinkPad FullScreen Magnifier (Version: 2.40) ThinkPad Power Management Driver (Version: 1.64.00.00) ThinkPad UltraNav Driver (Version: 15.2.14.0) ThinkVantage Communications Utility (Version: 1.44) ThinkVantage Fingerprint Software (Version: 5.9.3.6264) ThinkVantage System für aktiven Festplattenschutz (Version: 1.72) Total Commander 64-bit (Remove or Repair) (Version: 8.0) TrueCrypt (x32 Version: 7.1a) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825642) 32-Bit Edition (x32) VLC media player 2.0.8 (x32 Version: 2.0.8) Vyzor G-System (x32 Version: Vyzor G-System 2.00) Winamp (x32 Version: 5.65 ) Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1) Windows Driver Package - Broadcom (BTHUSB) Bluetooth (04/08/2010 6.3.5.430) (Version: 04/08/2010 6.3.5.430) Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800) Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8) WinRAR 4.01 (64-Bit) (Version: 4.01.0) XAMPP (x32 Version: 1.8.2-2) ==================== Restore Points ========================= 21-11-2013 07:38:23 Geplanter Prüfpunkt 28-11-2013 15:03:30 Geplanter Prüfpunkt 28-11-2013 19:08:01 Windows Modules Installer ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0E7B416B-F265-470F-8C70-83B27B368130} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3092931146-3205444336-2170880425-1000Core => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-24] (Google Inc.) Task: {184BF99A-2FAB-45B2-B1AB-71223DF58C3E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd) Task: {2F565E29-7C73-4C48-8C28-5E87D8CDB4BC} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2013-06-26] () Task: {3B7FF92E-43BF-4AA0-93C4-456DBA7FEFB0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-07] (Adobe Systems Incorporated) Task: {420A6B39-5B2A-478C-B4FA-6A4BE2C14B95} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {4C9A70F7-7A2D-46C7-B6D5-A39F88A5415C} - System32\Tasks\TVT\LaunchRnR => %RR%\rrcmd.exe Task: {500707F6-15D6-4CFC-987E-BC0FDEB59AD5} - System32\Tasks\TVT\UpdateRnR => %TVTCOMMON%\Scheduler\tvtsetsched.exe Task: {516DEB03-B616-4B95-9D0A-C4C073927AD3} - System32\Tasks\{A3BCC678-47D6-448D-879A-DF51D9B950AB} => Chrome.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/abandoninstall?page=tsProgressBar Task: {51D17913-376E-45B3-80E5-DD1B1CFA5C38} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.) Task: {60C0B67D-2980-4F53-A80F-03A2618D7282} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.) Task: {75A7717E-BFE1-4330-979F-E3D79FC073EF} - System32\Tasks\{872910DD-CF88-4554-941D-CCDEAA7B99A9} => Chrome.exe hxxp://ui.skype.com/ui/0/5.5.0.113/en/abandoninstall?page=tsPlugin&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;ienotdefaultbrowser2 Task: {961FFB61-05AE-4B73-9E72-E0F09A02ACA7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3092931146-3205444336-2170880425-1000UA => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-24] (Google Inc.) Task: {BDF10414-4D51-43A0-BB11-3F6534C8A2C7} - System32\Tasks\TVT\ChangePWD => %RR%\rrcmd.exe Task: {ED47BC87-C683-468A-81B6-AA06FA87727C} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-06-27] (PC-Doctor, Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3092931146-3205444336-2170880425-1000Core.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3092931146-3205444336-2170880425-1000UA.job => C:\Users\*****\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe ==================== Loaded Modules (whitelisted) ============= 2010-08-05 18:45 - 2010-08-05 18:45 - 00173344 ____N () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll 2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 ____N () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll 2011-03-24 21:53 - 2011-02-04 04:45 - 00054272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL 2011-08-06 11:18 - 2011-05-28 22:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll 2011-03-24 21:52 - 2011-02-17 20:22 - 00057640 ____N () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll 2012-03-31 13:51 - 2011-05-21 09:32 - 00094208 ____N () C:\Windows\System32\IccLibDll_x64.dll 2013-08-22 00:27 - 2013-08-22 00:27 - 00039424 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll 2013-10-10 23:48 - 2013-10-10 23:48 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll 2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 ____N () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 ____N () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\*****\AppData\Roaming\Dropbox\bin\libcef.dll 2013-10-03 08:07 - 2009-02-27 16:39 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.deu 2012-03-31 13:54 - 2011-08-12 23:18 - 00004096 ____N () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll 2011-05-22 19:21 - 2011-05-22 19:21 - 00093696 ____N () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll 2013-11-15 03:59 - 2013-11-14 13:28 - 00702416 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\libglesv2.dll 2013-11-15 03:59 - 2013-11-14 13:28 - 00099792 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\libegl.dll 2013-11-15 03:59 - 2013-11-14 13:29 - 04055504 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll 2013-11-15 03:59 - 2013-11-14 13:29 - 00399312 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll 2013-11-15 03:59 - 2013-11-14 13:28 - 01619408 _____ () C:\Users\*****\AppData\Local\Google\Chrome\Application\31.0.1650.57\ffmpegsumo.dll 2012-10-17 19:31 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll 2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL 2012-09-02 09:41 - 2012-01-03 22:51 - 08671232 _____ () c:\program files (x86)\adobe\acrobat 9.0\acrobat\exlang32.deu 2013-10-03 08:07 - 2009-02-27 16:40 - 01712128 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\plug_ins\Annots.DEU 2013-10-03 08:07 - 2009-02-27 12:52 - 00258048 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\sqlite.dll 2013-10-03 08:08 - 2009-10-03 02:48 - 00106496 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\plug_ins\EScript.DEU 2013-10-03 08:07 - 2009-10-03 02:45 - 00012288 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\plug_ins\Updater.DEU 2013-10-03 08:07 - 2012-01-03 21:54 - 00053248 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\plug_ins\weblink.DEU 2013-10-03 08:07 - 2009-02-27 16:42 - 00147456 _____ () C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\plug_ins\WebPDF.DEU 2013-09-13 10:41 - 2012-12-24 13:49 - 00111616 _____ () c:\program files (x86)\xampp\apache\bin\pcre.dll 2013-09-13 10:41 - 2012-12-24 13:49 - 00111616 _____ () C:\program files (x86)\xampp\apache\bin\pcre.dll 2013-11-29 10:40 - 2013-11-29 10:40 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2011-08-12 05:20 - 2011-08-12 05:20 - 00247400 ____N () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll 2013-11-01 09:38 - 2013-11-01 09:38 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00144896 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll 2013-07-31 00:22 - 2013-07-31 00:22 - 02376192 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00282112 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00084992 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libaout_directx_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00086528 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00114688 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirectx_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00071680 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\mmxext\libmemcpymmxext_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00224768 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00134656 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00293888 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00081408 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00079360 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00469504 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_httplive_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00693760 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_dash_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00074240 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00120320 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00071168 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_record_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00143360 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 01405440 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00335872 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 01285120 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00087552 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00072704 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 11387904 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00080384 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libes_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00229888 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00387584 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00122880 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libavi_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00072704 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00108032 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libasf_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00181248 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00080384 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 01759232 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00072192 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00078336 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00079360 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00083968 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00078336 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00085504 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00093696 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00074240 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00077312 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00084480 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00082944 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00076288 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00123392 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00076800 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00221696 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00074240 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 01338880 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00086016 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00076288 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00393728 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00279552 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00968704 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00340480 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libopus_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00218112 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstofloat32_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00107520 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tofloat32_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00164864 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libmpgatofixed32_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 01551872 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00072192 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libconverter_fixed_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00070144 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tospdif_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00073216 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00071680 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstospdif_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00071680 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00070656 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00082432 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00069632 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat32_mixer_plugin.dll 2013-07-31 00:21 - 2013-07-31 00:21 - 00076288 _____ () C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64 Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64 Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Cisco Systems Service: vpnva Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (12/03/2013 02:57:11 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: xampp-control.exe, Version: 3.2.1.0, Zeitstempel: 0x51b8f805 Name des fehlerhaften Moduls: xampp-control.exe, Version: 3.2.1.0, Zeitstempel: 0x51b8f805 Ausnahmecode: 0xc0000005 Fehleroffset: 0x001aa712 ID des fehlerhaften Prozesses: 0x1180 Startzeit der fehlerhaften Anwendung: 0xxampp-control.exe0 Pfad der fehlerhaften Anwendung: xampp-control.exe1 Pfad des fehlerhaften Moduls: xampp-control.exe2 Berichtskennung: xampp-control.exe3 Error: (12/02/2013 07:50:33 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 54783745 Error: (12/02/2013 07:50:33 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 54783745 Error: (12/02/2013 07:50:33 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (12/02/2013 07:50:32 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 54782747 Error: (12/02/2013 07:50:32 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 54782747 Error: (12/02/2013 07:50:32 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (12/02/2013 07:50:31 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 54781733 Error: (12/02/2013 07:50:31 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 54781733 Error: (12/02/2013 07:50:31 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second System errors: ============= Error: (12/03/2013 03:02:15 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden. Error: (12/03/2013 03:02:11 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden. Error: (12/03/2013 08:37:58 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error: (11/29/2013 02:18:06 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden. Error: (11/29/2013 02:18:05 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden. Error: (11/29/2013 02:18:02 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden. Error: (11/29/2013 06:03:45 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden. Error: (11/29/2013 06:03:45 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden. Error: (11/29/2013 06:03:44 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden. Error: (11/29/2013 06:03:44 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden. Microsoft Office Sessions: ========================= Error: (04/18/2013 01:40:00 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 19847 seconds with 5760 seconds of active time. This session ended with a crash. Error: (09/19/2012 05:38:18 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 23618 seconds with 6960 seconds of active time. This session ended with a crash. Error: (05/31/2012 06:40:24 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9660 seconds with 2700 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Percentage of memory in use: 48% Total physical RAM: 7987.67 MB Available physical RAM: 4091.55 MB Total Pagefile: 15973.53 MB Available Pagefile: 11396.79 MB Total Virtual: 8192 MB Available Virtual: 8191.79 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:465.66 GB) (Free:27.12 GB) NTFS Drive e: () (Removable) (Total:15.11 GB) (Free:15.11 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: DB79B4FF) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 15 GB) (Disk ID: 00000000) Partition 1: (Active) - (Size=15 GB) - (Type=0C) ==================== End Of Log ============================ GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-12-03 15:47:36 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 HITACHI_HTS725050A9A364 rev.PC4ZC70F 465.76GB Running: gmer_2.1.19163.exe; Driver: C:\Users\TIMONK~1\AppData\Local\Temp\fxrdypog.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800033a2000 63 bytes [00, 00, 15, 02, 46, 69, 6C, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 608 fffff800033a2040 1 byte [0E] ---- User code sections - GMER 2.1 ---- .text C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe[4252] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000076631465 2 bytes [63, 76] .text C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe[4252] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000766314bb 2 bytes [63, 76] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076631465 2 bytes [63, 76] .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000766314bb 2 bytes [63, 76] .text ... * 2 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\889ffaec7872 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\889ffaec7872 (not active ControlSet) ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- Vielen Dank für die Hilfe! Minsen |
| Themen zu USB Stick zeigt Verknüpfungen an - Malware gefunden |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivir, antivirus, avira, bildschirm, browser, converter, entfernen, festplatte, flash player, google, homepage, logfile, malware gefunden, object, plug-in, programm, pup.optional.opencandy, pup.optional.softonic, pup.optional.sweetim.a, pwmtr64v.dll, registry, security, software, svchost.exe, thomas |
Baum-Darstellung