Windows 8: Rechnung.zip von vermeitlichen Telefonanbieter geöffnet und Antivir schlägt Alarm

prinzcharmin · 12.12.2013, 13:15

Hallo Trojanerboard!,

habe vor einer Stunde etwa eine Email geöffnet, indem sich eine 500€ Rechnung befand, was sich nach einem Telefonat mit dem Anbieter als Phishing-Mail herausstellte. Nun habe ich die Sorge dass mein PC befallen ist und bitte euch um Hilfe. Vielleicht sollte ich erwähnen, dass ich einen vorherigen PC-Zustand (1.Dezember) vor lauter Panik hergestellt hab, mit der Hoffnung, dass die Malware "verschwindet".

Vielen, vielen dank im voraus!

Anhang 62907

Anhang 62908

Anhang 62909

Anhang 62910

schrauber · 12.12.2013, 13:21

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

prinzcharmin · 12.12.2013, 13:31

Okay!

FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-12-2013
Ran by Muhammed (administrator) on MUHI-PC on 12-12-2013 12:53:01
Running from C:\Users\***\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
() C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Hi-Rez Studios) D:\Programme\HiPatchService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(National Instruments Corporation) C:\Windows\SysWOW64\lkads.exe
(National Instruments Corporation) D:\Labview\MAX\nimxs.exe
(National Instruments Corporation) D:\Labview\Shared\Security\nidmsrv.exe
(National Instruments Corporation) D:\Labview\Shared\nisvcloc\nisvcloc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(National Instruments, Inc.) C:\Windows\SysWOW64\lkcitdl.exe
(National Instruments Corporation) C:\Windows\SysWOW64\lktsrv.exe
(National Instruments Corporation) D:\Labview\Shared\mDNS Responder\nimdnsResponder.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(National Instruments Corporation) D:\Labview\Shared\NI Network Discovery\niDiscSvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(National Instruments Corporation) D:\Labview\Shared\NI WebServer\SystemWebServer.exe
(National Instruments Corporation) D:\Labview\Shared\Tagger\tagsrv.exe
(National Instruments Corporation) D:\Labview\Shared\NI WebServer\ApplicationWebServer.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATICDE.EXE
(National Instruments Corporation) D:\Labview\Shared\NI Error Reporting\nierserver.exe
(Dropbox, Inc.) C:\Users\Muhammed\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Muhammed\Downloads\Defogger.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13550152 2013-05-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1308232 2013-05-20] (Realtek Semiconductor)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [NIRegistrationWizard] - D:\Labview\Shared\RegistrationWizard\Bin\RegistrationWizard.exe [847000 2013-04-19] ()
HKCU\...\Run: [EPSON Stylus DX7400] - C:\Windows\Temp\E_S4D78.tmp [118 2013-11-13] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\aprp.exe [3187360 2013-04-26] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NI Update Service] - D:\Labview\Shared\Update Service\NIUpdateService.exe [857888 2013-05-28] (National Instruments)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [245872 2013-07-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-07-08] (NVIDIA Corporation)
Startup: C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Muhammed\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Winsock: Catalog5 08 D:\Labview\Shared\mDNS Responder\nimdnsNSP.dll [26512] (National Instruments Corporation)
Winsock: Catalog5-x64 08 C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll [28560] (National Instruments Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome: 
=======
CHR DefaultSearchKeyword: google.de
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}
CHR Extension: (Google Docs) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Google Search) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Google Wallet) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] ()
R2 HiPatchService; D:\Programme\HiPatchService.exe [9216 2013-10-25] (Hi-Rez Studios)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 LkCitadelServer; C:\Windows\SysWOW64\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)
R2 lkClassAds; C:\Windows\SysWOW64\lkads.exe [53544 2013-06-12] (National Instruments Corporation)
R2 lkTimeSync; C:\Windows\SysWOW64\lktsrv.exe [63792 2013-06-12] (National Instruments Corporation)
R2 mxssvr; D:\Labview\MAX\nimxs.exe [83768 2013-06-10] (National Instruments Corporation)
R2 NIApplicationWebServer; D:\Labview\Shared\NI WebServer\ApplicationWebServer.exe [57696 2013-06-08] (National Instruments Corporation)
S4 NIApplicationWebServer64; C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [81248 2013-06-08] (National Instruments Corporation)
R2 NIDomainService; D:\Labview\Shared\Security\nidmsrv.exe [380720 2013-06-12] (National Instruments Corporation)
S3 NILM License Manager; D:\Labview\Shared\License Manager\Bin\lmgrd.exe [1427688 2010-08-02] (Macrovision Corporation)
R2 nimDNSResponder; D:\Labview\Shared\mDNS Responder\nimdnsResponder.exe [260976 2013-05-11] (National Instruments Corporation)
R2 NINetworkDiscovery; D:\Labview\Shared\NI Network Discovery\niDiscSvc.exe [176512 2013-06-19] (National Instruments Corporation)
R2 NiSvcLoc; D:\Labview\Shared\niSvcLoc\nisvcloc.exe [90440 2013-06-07] (National Instruments Corporation)
R2 NISystemWebServer; D:\Labview\Shared\NI WebServer\SystemWebServer.exe [57680 2013-06-08] (National Instruments Corporation)
R2 NITaggerService; D:\Labview\Shared\Tagger\tagsrv.exe [687944 2013-06-15] (National Instruments Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-06-28] (ASUS Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [83160 2013-10-10] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
U0 msahci; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-12 12:53 - 2013-12-12 12:53 - 00014069 _____ C:\Users\Muhammed\Downloads\FRST.txt
2013-12-12 12:52 - 2013-12-12 12:52 - 01927106 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST64.exe
2013-12-12 12:52 - 2013-12-12 12:52 - 00000000 ____D C:\FRST
2013-12-12 12:51 - 2013-12-12 12:51 - 01060373 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST.exe
2013-12-12 12:51 - 2013-12-12 12:51 - 00000478 _____ C:\Users\Muhammed\Downloads\defogger_disable.log
2013-12-12 12:51 - 2013-12-12 12:51 - 00000000 _____ C:\Users\Muhammed\defogger_reenable
2013-12-12 12:50 - 2013-12-12 12:50 - 00050477 _____ C:\Users\Muhammed\Downloads\Defogger.exe
2013-12-12 12:06 - 2013-12-12 12:08 - 00000022 _____ C:\Users\Muhammed\Downloads\Rechnung.zip
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare.url
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare Beta.url
2013-12-04 14:24 - 2013-12-04 14:27 - 00000000 ____D C:\Program Files\OpenVPN
2013-11-24 16:11 - 2013-11-24 17:22 - 00004754 _____ C:\Users\Muhammed\Documents\Kaffeeautomat.ctl
2013-11-22 19:09 - 2013-11-22 19:09 - 00000201 _____ C:\Users\Muhammed\Desktop\Borderlands 2.url
2013-11-22 19:09 - 2013-11-22 19:09 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-11-22 18:58 - 2013-11-22 18:58 - 00000530 _____ C:\Users\Public\Desktop\Steam.lnk
2013-11-22 18:57 - 2013-11-22 18:57 - 01123608 _____ C:\Users\Muhammed\Downloads\SteamSetup.exe
2013-11-20 11:00 - 2013-11-20 11:00 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\JKI
2013-11-20 09:45 - 2013-11-20 09:45 - 00001011 _____ C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2013-11-20 09:45 - 2013-11-20 09:45 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\DVDVideoSoft
2013-11-20 09:41 - 2013-11-20 09:42 - 32206488 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Muhammed\Downloads\FreeYouTubeToMP3Converter_3.12.16.1030.exe
2013-11-18 15:41 - 2013-11-18 15:41 - 00281248 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-17 21:38 - 2013-12-04 13:13 - 00000133 _____ C:\Users\Muhammed\Desktop\Series.txt
2013-11-14 15:36 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2013-11-14 15:36 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 15:36 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2013-11-14 15:35 - 2013-09-13 23:36 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-11-14 15:35 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2013-11-14 15:35 - 2013-09-13 23:33 - 03279360 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-11-14 15:35 - 2013-09-13 23:33 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-11-14 15:35 - 2013-09-13 23:33 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-11-14 15:35 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2013-11-14 15:35 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2013-11-14 15:35 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2013-11-14 15:35 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-11-14 15:35 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys
2013-11-14 15:35 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2013-11-14 15:35 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2013-11-14 15:35 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2013-11-14 15:34 - 2013-09-14 02:15 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-11-14 15:34 - 2013-09-13 23:36 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-11-14 15:34 - 2013-09-13 23:36 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-11-14 15:34 - 2013-09-13 23:36 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-11-14 15:34 - 2013-09-13 23:34 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-11-14 15:34 - 2013-09-13 23:33 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-11-14 15:34 - 2013-09-13 23:33 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-11-14 15:34 - 2013-09-13 23:33 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-11-14 15:34 - 2013-09-13 23:33 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-11-14 15:34 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys
2013-11-14 15:34 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2013-11-14 15:34 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2013-11-14 15:34 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2013-11-14 15:33 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 15:33 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 15:33 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 15:33 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 15:33 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 15:33 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 15:33 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 15:33 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 15:33 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 15:33 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 15:33 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 15:33 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 15:33 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 15:33 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 15:33 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 15:33 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 15:33 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 15:33 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 15:33 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 15:33 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 15:33 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 15:33 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 15:33 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 15:33 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 15:33 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 15:33 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 15:33 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-14 15:33 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-13 13:36 - 2013-11-13 13:37 - 00000000 ____D C:\ProgramData\EPSON
2013-11-13 13:36 - 2013-11-13 13:36 - 11904000 _____ C:\Users\Muhammed\Downloads\epson375181eu.exe
2013-11-13 13:36 - 2007-12-07 02:08 - 00108032 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_ILMCDE.DLL
2013-11-13 13:36 - 2007-12-07 02:01 - 00081408 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_IBCBCDE.DLL
2013-11-13 13:36 - 2005-02-02 12:05 - 00008704 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2013-11-12 22:45 - 2013-12-12 12:36 - 00000000 ____D C:\Users\Muhammed\Downloads\openvpn-extern-Win8

==================== One Month Modified Files and Folders =======

2013-12-12 12:53 - 2013-12-12 12:53 - 00014069 _____ C:\Users\Muhammed\Downloads\FRST.txt
2013-12-12 12:52 - 2013-12-12 12:52 - 01927106 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST64.exe
2013-12-12 12:52 - 2013-12-12 12:52 - 00000000 ____D C:\FRST
2013-12-12 12:51 - 2013-12-12 12:51 - 01060373 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST.exe
2013-12-12 12:51 - 2013-12-12 12:51 - 00000478 _____ C:\Users\Muhammed\Downloads\defogger_disable.log
2013-12-12 12:51 - 2013-12-12 12:51 - 00000000 _____ C:\Users\Muhammed\defogger_reenable
2013-12-12 12:51 - 2013-11-02 15:59 - 00000000 ____D C:\Users\Muhammed
2013-12-12 12:50 - 2013-12-12 12:50 - 00050477 _____ C:\Users\Muhammed\Downloads\Defogger.exe
2013-12-12 12:48 - 2013-11-03 10:29 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Dropbox
2013-12-12 12:48 - 2013-11-02 16:02 - 00000062 _____ C:\Users\Muhammed\AppData\Roaming\sp_data.sys
2013-12-12 12:47 - 2013-11-03 10:31 - 00000000 ___RD C:\Users\Muhammed\Dropbox
2013-12-12 12:45 - 2013-11-02 16:07 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-12 12:44 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-12 12:44 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\servicing
2013-12-12 12:42 - 2012-07-26 10:45 - 00000000 ____D C:\Windows\ShellNew
2013-12-12 12:42 - 2012-07-26 10:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\SysWOW64\ras
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\ras
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\L2Schemas
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-12 12:42 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2013-12-12 12:42 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\Dism
2013-12-12 12:36 - 2013-11-12 22:45 - 00000000 ____D C:\Users\Muhammed\Downloads\openvpn-extern-Win8
2013-12-12 12:36 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2013-12-12 12:35 - 2013-11-02 16:13 - 00000000 ____D C:\ProgramData\PMB Files
2013-12-12 12:35 - 2013-10-08 09:28 - 00000000 ____D C:\ProgramData\P4G
2013-12-12 12:33 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\registration
2013-12-12 12:23 - 2013-10-08 09:15 - 01923909 _____ C:\Windows\WindowsUpdate.log
2013-12-12 12:08 - 2013-12-12 12:06 - 00000022 _____ C:\Users\Muhammed\Downloads\Rechnung.zip
2013-12-08 19:05 - 2013-11-02 18:01 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\TS3Client
2013-12-08 18:38 - 2013-11-02 16:13 - 00000000 ____D C:\Users\Muhammed\AppData\Local\PMB Files
2013-12-05 18:26 - 2013-04-26 00:16 - 00010851 _____ C:\Windows\DirectX.log
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare.url
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare Beta.url
2013-12-05 12:47 - 2012-08-02 14:24 - 00109544 _____ C:\Windows\PFRO.log
2013-12-04 14:27 - 2013-12-04 14:24 - 00000000 ____D C:\Program Files\OpenVPN
2013-12-04 13:13 - 2013-11-17 21:38 - 00000133 _____ C:\Users\Muhammed\Desktop\Series.txt
2013-12-01 16:17 - 2013-11-02 16:07 - 00001130 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-29 19:08 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-11-27 13:07 - 2012-08-03 00:02 - 00753134 _____ C:\Windows\system32\perfh007.dat
2013-11-27 13:07 - 2012-08-03 00:02 - 00155826 _____ C:\Windows\system32\perfc007.dat
2013-11-27 13:07 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-25 20:10 - 2013-11-02 18:35 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-25 20:10 - 2013-11-02 18:35 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-24 17:22 - 2013-11-24 16:11 - 00004754 _____ C:\Users\Muhammed\Documents\Kaffeeautomat.ctl
2013-11-24 16:04 - 2013-11-09 16:49 - 00000000 ____D C:\Users\Muhammed\Documents\LabVIEW Data
2013-11-22 21:05 - 2013-11-05 22:41 - 00000000 ____D C:\Users\Muhammed\Documents\My Games
2013-11-22 19:09 - 2013-11-22 19:09 - 00000201 _____ C:\Users\Muhammed\Desktop\Borderlands 2.url
2013-11-22 19:09 - 2013-11-22 19:09 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-11-22 18:58 - 2013-11-22 18:58 - 00000530 _____ C:\Users\Public\Desktop\Steam.lnk
2013-11-22 18:57 - 2013-11-22 18:57 - 01123608 _____ C:\Users\Muhammed\Downloads\SteamSetup.exe
2013-11-20 20:51 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-11-20 19:55 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-11-20 19:54 - 2012-07-26 08:21 - 00038305 _____ C:\Windows\setupact.log
2013-11-20 11:00 - 2013-11-20 11:00 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\JKI
2013-11-20 09:45 - 2013-11-20 09:45 - 00001011 _____ C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2013-11-20 09:45 - 2013-11-20 09:45 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\DVDVideoSoft
2013-11-20 09:42 - 2013-11-20 09:41 - 32206488 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Muhammed\Downloads\FreeYouTubeToMP3Converter_3.12.16.1030.exe
2013-11-18 15:41 - 2013-11-18 15:41 - 00281248 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-17 22:12 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2013-11-17 18:25 - 2013-11-02 21:55 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 18:24 - 2013-11-02 21:55 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-16 14:20 - 2013-11-02 16:08 - 00002137 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-13 13:37 - 2013-11-13 13:36 - 00000000 ____D C:\ProgramData\EPSON
2013-11-13 13:36 - 2013-11-13 13:36 - 11904000 _____ C:\Users\Muhammed\Downloads\epson375181eu.exe
2013-11-12 16:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-11-12 16:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Common Files\System
2013-11-12 16:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-11-12 16:47 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\system32\winrm
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\system32\slmgr
2013-11-12 16:46 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\en-GB
2013-11-12 16:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-11-12 16:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-11-12 16:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\SysWOW64\en-GB
2013-11-12 16:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\SysWOW64\Com
2013-11-12 16:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\migwiz
2013-11-12 16:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\en-GB
2013-11-12 16:46 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-12 16:46 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-11-12 16:46 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-11-12 16:46 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\Sysprep
2013-11-12 16:44 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\system32\WCN
2013-11-12 16:44 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\MUI
2013-11-12 16:43 - 2012-07-26 10:43 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-11-12 16:43 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SystemResetPlatform
2013-11-12 16:43 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\Com

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe


Some content of TEMP:
====================
C:\Users\Muhammed\AppData\Local\Temp\avgnt.exe
C:\Users\Muhammed\AppData\Local\Temp\COMAP.EXE
C:\Users\Muhammed\AppData\Local\Temp\swt-win32-3349.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-29 15:57

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Addition:

Code:

ATTFilter

==================== Memory info =========================== 

Percentage of memory in use: 23%
Total physical RAM: 8077.68 MB
Available physical RAM: 6169.18 MB
Total Pagefile: 9293.68 MB
Available Pagefile: 7229.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:219.96 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:398.07 GB) (Free:374.31 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 568814A2)

Partition: GPT Partition Type
==================== End Of Log ============================

Defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:51 on 12/12/2013 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

GMER:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-12 12:58:32
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003b ST750LM022_HN-M750MBB rev.2AR20002 698,64GB
Running: e5pxbgxv.exe; Driver: C:\Users\****\AppData\Local\Temp\pxloypod.sys


---- Disk sectors - GMER 2.1 ----

Disk  \Device\Harddisk0\DR0  unknown MBR code

---- EOF - GMER 2.1 ----

schrauber · 13.12.2013, 09:12

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

prinzcharmin · 13.12.2013, 10:49

Danke für die Antwort! Ich hatte möglichst alles deaktiviert, aber während ComboFix lief, kam ein Antivir-Popup, dass versucht wird die Registry zu bearbeiten. Ist das normal ?

Code:

ATTFilter

ComboFix 13-12-13.01 - Muhammed 13.12.2013  10:40:21.1.4 - x64
Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.8078.6331 [GMT 1:00]
ausgeführt von:: c:\users\Muhammed\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\SetStretch.VBS
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-11-13 bis 2013-12-13  ))))))))))))))))))))))))))))))
.
.
2013-12-13 09:43 . 2013-12-13 09:43	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-12-13 09:43 . 2013-12-13 09:43	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-12-12 13:38 . 2013-10-19 05:45	62976	----a-w-	c:\windows\system32\imagehlp.dll
2013-12-12 13:38 . 2013-10-19 04:04	59392	----a-w-	c:\windows\SysWow64\imagehlp.dll
2013-12-12 13:38 . 2013-12-12 13:38	--------	d-----w-	c:\program files\CCleaner
2013-12-12 13:38 . 2013-11-06 23:18	4036608	----a-w-	c:\windows\system32\win32k.sys
2013-12-12 13:37 . 2013-10-25 06:18	19271168	----a-w-	c:\windows\system32\mshtml.dll
2013-12-12 13:37 . 2013-10-25 06:17	15404032	----a-w-	c:\windows\system32\ieframe.dll
2013-12-12 13:37 . 2013-10-25 06:17	3959808	----a-w-	c:\windows\system32\jscript9.dll
2013-12-12 13:37 . 2013-10-25 04:43	2877952	----a-w-	c:\windows\SysWow64\jscript9.dll
2013-12-12 13:37 . 2013-10-25 06:19	1365504	----a-w-	c:\windows\system32\urlmon.dll
2013-12-12 13:37 . 2013-10-25 06:17	2648576	----a-w-	c:\windows\system32\iertutil.dll
2013-12-12 13:35 . 2013-10-08 22:27	3279872	----a-w-	c:\windows\system32\wuaueng.dll
2013-12-12 13:34 . 2013-10-10 09:24	143872	----a-w-	c:\windows\system32\wshom.ocx
2013-12-12 13:34 . 2013-10-10 09:22	222720	----a-w-	c:\windows\system32\scrobj.dll
2013-12-12 13:34 . 2013-10-10 09:22	194048	----a-w-	c:\windows\system32\scrrun.dll
2013-12-12 13:34 . 2013-10-10 09:32	115712	----a-w-	c:\windows\SysWow64\cscript.exe
2013-12-12 13:34 . 2013-10-10 09:30	162304	----a-w-	c:\windows\SysWow64\scrobj.dll
2013-12-12 13:34 . 2013-10-10 09:30	156160	----a-w-	c:\windows\SysWow64\scrrun.dll
2013-12-12 13:34 . 2013-10-10 09:23	146944	----a-w-	c:\windows\system32\cscript.exe
2013-12-12 13:34 . 2013-11-01 05:38	312320	----a-w-	c:\windows\system32\msieftp.dll
2013-12-12 13:34 . 2013-11-01 03:49	273408	----a-w-	c:\windows\SysWow64\msieftp.dll
2013-12-12 13:34 . 2013-11-23 06:43	420864	----a-w-	c:\windows\system32\WMPhoto.dll
2013-12-12 13:34 . 2013-11-23 05:05	368640	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2013-12-12 11:52 . 2013-12-12 11:52	--------	d-----w-	C:\FRST
2013-12-04 13:24 . 2013-12-04 13:27	--------	d-----w-	c:\program files\OpenVPN
2013-11-23 11:35 . 2013-11-23 11:35	280752	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10226.bin
2013-11-22 17:58 . 2013-12-12 11:35	--------	d-----w-	c:\program files (x86)\Common Files\Steam
2013-11-20 10:00 . 2013-11-20 10:00	--------	d-----w-	c:\users\Muhammed\AppData\Roaming\JKI
2013-11-20 08:45 . 2013-11-20 08:45	--------	d-----w-	c:\users\Muhammed\AppData\Roaming\DVDVideoSoft
2013-11-20 08:45 . 2013-11-20 08:45	--------	d-----w-	c:\program files (x86)\Common Files\DVDVideoSoft
2013-11-20 08:42 . 2013-11-20 08:42	--------	d-----w-	c:\users\Muhammed\AppData\Local\Programs
2013-11-14 14:36 . 2013-10-10 09:21	1160192	----a-w-	c:\windows\system32\IKEEXT.DLL
2013-11-14 14:36 . 2013-10-10 11:53	96600	----a-w-	c:\windows\system32\drivers\wfplwfs.sys
2013-11-14 14:36 . 2013-10-10 09:20	723968	----a-w-	c:\windows\system32\BFE.DLL
2013-11-14 14:35 . 2013-07-24 23:07	13661696	----a-w-	c:\windows\system32\Windows.UI.Xaml.dll
2013-11-14 14:35 . 2013-07-24 23:10	10799104	----a-w-	c:\windows\SysWow64\Windows.UI.Xaml.dll
2013-11-14 14:35 . 2013-08-30 05:20	1173504	----a-w-	c:\windows\system32\UIAutomationCore.dll
2013-11-14 14:35 . 2013-08-29 23:48	914432	----a-w-	c:\windows\SysWow64\UIAutomationCore.dll
2013-11-14 14:35 . 2013-09-13 22:33	328192	----a-w-	c:\windows\system32\ubpm.dll
2013-11-14 14:35 . 2013-08-10 06:30	151896	----a-w-	c:\windows\system32\drivers\tpm.sys
2013-11-14 14:35 . 2013-08-21 06:39	465240	----a-w-	c:\windows\system32\drivers\fvevol.sys
2013-11-14 14:35 . 2013-08-10 05:21	817152	----a-w-	c:\windows\system32\kerberos.dll
2013-11-14 14:35 . 2013-09-13 22:36	247296	----a-w-	c:\windows\SysWow64\ubpm.dll
2013-11-14 14:34 . 2013-08-30 05:43	61784	----a-w-	c:\windows\system32\drivers\crashdmp.sys
2013-11-14 14:34 . 2013-07-12 01:38	599040	----a-w-	c:\windows\system32\WSDApi.dll
2013-11-14 14:34 . 2013-07-12 01:30	485376	----a-w-	c:\windows\SysWow64\WSDApi.dll
2013-11-14 14:34 . 2013-08-10 03:58	656896	----a-w-	c:\windows\SysWow64\kerberos.dll
2013-11-14 14:33 . 2013-10-02 23:25	1300992	----a-w-	c:\windows\system32\gdi32.dll
2013-11-14 14:33 . 2013-10-01 22:22	1022976	----a-w-	c:\windows\SysWow64\gdi32.dll
2013-11-14 14:33 . 2013-10-01 23:37	1569280	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-11-14 14:33 . 2013-10-01 23:26	1890816	----a-w-	c:\windows\system32\crypt32.dll
2013-11-14 14:33 . 2013-09-04 03:11	576512	----a-w-	c:\windows\system32\drivers\afd.sys
2013-11-14 14:33 . 2013-08-23 07:22	2062848	----a-w-	c:\windows\system32\d3d11.dll
2013-11-14 14:33 . 2013-08-23 01:44	1711616	----a-w-	c:\windows\SysWow64\d3d11.dll
2013-11-14 14:33 . 2013-09-23 22:30	419328	----a-w-	c:\windows\system32\schannel.dll
2013-11-14 14:33 . 2013-09-23 22:30	323072	----a-w-	c:\windows\SysWow64\schannel.dll
2013-11-14 14:33 . 2013-10-01 23:37	2035712	----a-w-	c:\windows\SysWow64\authui.dll
2013-11-14 14:33 . 2013-10-01 23:26	2304512	----a-w-	c:\windows\system32\authui.dll
2013-11-13 12:36 . 2007-12-07 01:08	108032	----a-w-	c:\windows\system32\E_ILMCDE.DLL
2013-11-13 12:36 . 2007-12-07 01:01	81408	----a-w-	c:\windows\system32\E_IBCBCDE.DLL
2013-11-13 12:36 . 2005-02-02 11:05	8704	----a-w-	c:\windows\system32\E_GCINST.DLL
2013-11-13 12:36 . 2013-11-13 12:37	--------	d-----w-	c:\programdata\EPSON
2013-11-13 12:33 . 2013-11-13 12:33	--------	d-----w-	c:\users\Muhammed\AppData\Local\ElevatedDiagnostics
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-13 09:34 . 2013-11-02 15:02	62	----a-w-	c:\users\Muhammed\AppData\Roaming\sp_data.sys
2013-12-12 12:09 . 2013-11-02 17:35	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-12-12 12:09 . 2013-11-02 17:35	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-12-12 12:09 . 2013-11-02 17:35	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-12-04 00:53 . 2013-11-05 08:32	78304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-04 00:53 . 2013-11-05 08:32	694240	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-17 17:24 . 2013-11-02 20:55	82896128	----a-w-	c:\windows\system32\MRT.exe
2013-11-02 15:02 . 2013-11-02 15:02	50784	----a-w-	c:\programdata\Microsoft\windowsfiltering\Sqm\Manifest\Sqm3.bin
2013-11-02 15:02 . 2013-11-02 15:02	17536	----a-w-	c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin
2013-11-02 14:59 . 2012-07-26 08:13	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-10-10 18:14 . 2013-11-02 17:35	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-10-08 08:28 . 2013-10-08 08:28	29480	----a-w-	c:\windows\SysWow64\msxml3a.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-11-02 15:17	222832	----a-w-	c:\users\Muhammed\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-11-02 15:17	222832	----a-w-	c:\users\Muhammed\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-11-02 15:17	222832	----a-w-	c:\users\Muhammed\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Muhammed\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Muhammed\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Muhammed\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NIRegistrationWizard"="d:\labview\Shared\RegistrationWizard\Bin\RegistrationWizard.exe" [2013-04-19 847000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2013-04-25 3187360]
"ASUSWebStorage"="c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe" [2012-12-19 3576784]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-03-28 91432]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-12 684600]
"NI Update Service"="d:\labview\Shared\Update Service\NIUpdateService.exe" [2013-05-28 857888]
.
c:\users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Muhammed\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-11-1 29769432]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
NI Error Reporting.lnk - d:\labview\Shared\NI Error Reporting\nierserver.exe [2013-6-7 663896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]
@=""
.
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
R4 NIApplicationWebServer64;NI Application Web Server (64-bit);c:\program files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe;c:\program files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe;c:\program files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [x]
S2 Asus WebStorage Windows Service;Asus WebStorage Windows Service;c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe;c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NIApplicationWebServer;NI Application Web Server;d:\labview\Shared\NI WebServer\ApplicationWebServer.exe;d:\labview\Shared\NI WebServer\ApplicationWebServer.exe [x]
S2 nimDNSResponder;NI mDNS Responder Service;d:\labview\Shared\mDNS Responder\nimdnsResponder.exe;d:\labview\Shared\mDNS Responder\nimdnsResponder.exe [x]
S2 NINetworkDiscovery;NI Network Discovery;d:\labview\Shared\NI Network Discovery\niDiscSvc.exe;d:\labview\Shared\NI Network Discovery\niDiscSvc.exe [x]
S2 NISystemWebServer;NI System Web Server;d:\labview\Shared\NI WebServer\SystemWebServer.exe;d:\labview\Shared\NI WebServer\SystemWebServer.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]
S3 ATP;ASUS Input Device;c:\windows\System32\drivers\AsusTP.sys;c:\windows\SYSNATIVE\drivers\AsusTP.sys [x]
S3 HIDSwitch;ASUS Wireless Radio Control;c:\windows\System32\drivers\AsHIDSwitch64.sys;c:\windows\SYSNATIVE\drivers\AsHIDSwitch64.sys [x]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RSBASTOR;Realtek PCIE CardReader Driver - BA;c:\windows\system32\DRIVERS\RtsBaStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsBaStor.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-11-16 13:18	1210320	----a-w-	c:\program files (x86)\Google\Chrome\Application\31.0.1650.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-02 15:07]
.
2013-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-02 15:07]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-11-02 15:17	261744	----a-w-	c:\users\Muhammed\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-11-02 15:17	261744	----a-w-	c:\users\Muhammed\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-11-02 15:17	261744	----a-w-	c:\users\Muhammed\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2012-09-27 07:15	1472512	----a-w-	c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2012-09-27 07:15	1472512	----a-w-	c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!AsusWSShellExt_U]
@="{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}"
[HKEY_CLASSES_ROOT\CLSID\{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}]
2012-09-27 07:15	1472512	----a-w-	c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Muhammed\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Muhammed\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Muhammed\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Muhammed\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-13 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-13 399984]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-05-30 13550152]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2013-05-20 1308232]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://asus13.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2013-12-13  10:45:27
ComboFix-quarantined-files.txt  2013-12-13 09:45
.
Vor Suchlauf: 10 Verzeichnis(se), 235.464.265.728 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 235.205.345.280 Bytes frei
.
- - End Of File - - 29B441CA5F2F7900FE1C41BEFCFFE19E

Gruß!

schrauber · 13.12.2013, 20:24

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

prinzcharmin · 14.12.2013, 22:09

Ich hoffe, ich führe die Programme stets nach Plan aus.

Danke!
Gruß!

Malwarebytes:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.12.14.05

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16750
********** [Administrator]

14.12.2013 21:32:36
mbam-log-2013-12-14 (21-32-36).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 237049
Laufzeit: 3 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Adw-Cleaner:

Code:

ATTFilter

# AdwCleaner v3.015 - Bericht erstellt am 14/12/2013 um 21:41:46
# Updated 10/12/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : **************
# Gestartet von : C:\Users\Muhammed\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [951 octets] - [14/12/2013 21:40:51]
AdwCleaner[S0].txt - [873 octets] - [14/12/2013 21:41:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [932 octets] ##########

JRT:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 8 x64
Ran by Muhammed on 14.12.2013 at 21:50:13,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.12.2013 at 21:53:29,37
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-12-2013 01
Ran by Muhammed (administrator) on **** on 14-12-2013 21:55:18
Running from C:\Users\Muhammed\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
() C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Hi-Rez Studios) D:\Programme\HiPatchService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(National Instruments Corporation) C:\Windows\SysWOW64\lkads.exe
(National Instruments Corporation) D:\Labview\MAX\nimxs.exe
(National Instruments Corporation) D:\Labview\Shared\Security\nidmsrv.exe
(National Instruments Corporation) D:\Labview\Shared\nisvcloc\nisvcloc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(National Instruments, Inc.) C:\Windows\SysWOW64\lkcitdl.exe
(National Instruments Corporation) C:\Windows\SysWOW64\lktsrv.exe
(National Instruments Corporation) D:\Labview\Shared\mDNS Responder\nimdnsResponder.exe
(National Instruments Corporation) D:\Labview\Shared\NI WebServer\SystemWebServer.exe
(National Instruments Corporation) D:\Labview\Shared\NI Network Discovery\niDiscSvc.exe
(National Instruments Corporation) D:\Labview\Shared\Tagger\tagsrv.exe
(National Instruments Corporation) D:\Labview\Shared\NI WebServer\ApplicationWebServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(National Instruments Corporation) D:\Labview\Shared\NI Error Reporting\nierserver.exe
(Dropbox, Inc.) C:\Users\Muhammed\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13550152 2013-05-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1308232 2013-05-20] (Realtek Semiconductor)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [NIRegistrationWizard] - D:\Labview\Shared\RegistrationWizard\Bin\RegistrationWizard.exe [847000 2013-04-19] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\aprp.exe [3187360 2013-04-26] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NI Update Service] - D:\Labview\Shared\Update Service\NIUpdateService.exe [857888 2013-05-28] (National Instruments)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [245872 2013-07-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-07-08] (NVIDIA Corporation)
Startup: C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Muhammed\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Winsock: Catalog5 08 D:\Labview\Shared\mDNS Responder\nimdnsNSP.dll [26512] (National Instruments Corporation)
Winsock: Catalog5-x64 08 C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll [28560] (National Instruments Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome: 
=======
CHR DefaultSearchKeyword: google.de
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}
CHR Extension: (Google Docs) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Google Search) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Google Wallet) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] ()
R2 HiPatchService; D:\Programme\HiPatchService.exe [9216 2013-10-25] (Hi-Rez Studios)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 LkCitadelServer; C:\Windows\SysWOW64\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)
R2 lkClassAds; C:\Windows\SysWOW64\lkads.exe [53544 2013-06-12] (National Instruments Corporation)
R2 lkTimeSync; C:\Windows\SysWOW64\lktsrv.exe [63792 2013-06-12] (National Instruments Corporation)
R2 mxssvr; D:\Labview\MAX\nimxs.exe [83768 2013-06-10] (National Instruments Corporation)
R2 NIApplicationWebServer; D:\Labview\Shared\NI WebServer\ApplicationWebServer.exe [57696 2013-06-08] (National Instruments Corporation)
S4 NIApplicationWebServer64; C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [81248 2013-06-08] (National Instruments Corporation)
R2 NIDomainService; D:\Labview\Shared\Security\nidmsrv.exe [380720 2013-06-12] (National Instruments Corporation)
S3 NILM License Manager; D:\Labview\Shared\License Manager\Bin\lmgrd.exe [1427688 2010-08-02] (Macrovision Corporation)
R2 nimDNSResponder; D:\Labview\Shared\mDNS Responder\nimdnsResponder.exe [260976 2013-05-11] (National Instruments Corporation)
R2 NINetworkDiscovery; D:\Labview\Shared\NI Network Discovery\niDiscSvc.exe [176512 2013-06-19] (National Instruments Corporation)
R2 NiSvcLoc; D:\Labview\Shared\niSvcLoc\nisvcloc.exe [90440 2013-06-07] (National Instruments Corporation)
R2 NISystemWebServer; D:\Labview\Shared\NI WebServer\SystemWebServer.exe [57680 2013-06-08] (National Instruments Corporation)
R2 NITaggerService; D:\Labview\Shared\Tagger\tagsrv.exe [687944 2013-06-15] (National Instruments Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-06-28] (ASUS Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-12] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-04-26] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U0 msahci; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-14 21:55 - 2013-12-14 21:55 - 00000000 ____D C:\Users\Muhammed\Downloads\FRST-OlderVersion
2013-12-14 21:53 - 2013-12-14 21:53 - 00000685 _____ C:\Users\Muhammed\Desktop\JRT.txt
2013-12-14 21:50 - 2013-12-14 21:50 - 00000000 ____D C:\Windows\ERUNT
2013-12-14 21:48 - 2013-12-14 21:48 - 01034531 _____ (Thisisu) C:\Users\Muhammed\Downloads\JRT.exe
2013-12-14 21:45 - 2013-12-14 21:45 - 00001007 _____ C:\Users\Muhammed\Desktop\AdwCleaner[S0].txt
2013-12-14 21:40 - 2013-12-14 21:41 - 00000000 ____D C:\AdwCleaner
2013-12-14 21:39 - 2013-12-14 21:39 - 01226802 _____ C:\Users\Muhammed\Downloads\adwcleaner.exe
2013-12-14 21:29 - 2013-12-14 21:29 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-14 21:29 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-14 21:28 - 2013-12-14 21:28 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Muhammed\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-14 21:24 - 2013-12-14 21:24 - 00281248 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-14 21:24 - 2013-12-14 21:24 - 00000558 _____ C:\Windows\PFRO.log
2013-12-13 10:45 - 2013-12-13 10:45 - 00022797 _____ C:\ComboFix.txt
2013-12-13 10:39 - 2013-12-13 10:45 - 00000000 ____D C:\Qoobox
2013-12-13 10:39 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-13 10:39 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-13 10:39 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-13 10:38 - 2013-12-13 10:44 - 00000000 ____D C:\Windows\erdnt
2013-12-13 10:36 - 2013-12-13 10:37 - 05154339 ____R (Swearware) C:\Users\Muhammed\Desktop\ComboFix.exe
2013-12-12 17:07 - 2013-12-12 17:07 - 00000472 _____ C:\Users\Muhammed\Desktop\LERNEN!!!!!!!.txt
2013-12-12 14:38 - 2013-12-12 14:38 - 00002778 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-12-12 14:38 - 2013-12-12 14:38 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-12 14:38 - 2013-12-12 14:38 - 00000000 ____D C:\Program Files\CCleaner
2013-12-12 14:38 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 14:38 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 14:38 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 14:37 - 2013-12-12 14:37 - 03541544 _____ (Piriform Ltd) C:\Users\Muhammed\Downloads\ccsetup408_slim.exe
2013-12-12 14:37 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-12 14:37 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 14:37 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 14:37 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 14:37 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 14:37 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-12 14:37 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-12 14:37 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-12 14:37 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-12 14:36 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 14:36 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-12 14:36 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 14:36 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-12 14:36 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-12 14:36 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-12 14:36 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-12 14:36 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-12 14:36 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-12 14:36 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-12 14:35 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-12 14:35 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-12-12 14:35 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-12-12 14:35 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-12-12 14:35 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-12-12 14:35 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-12 14:35 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-12 14:35 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2013-12-12 14:35 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2013-12-12 14:35 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2013-12-12 14:35 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-12-12 14:35 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-12-12 14:35 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-12-12 14:35 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2013-12-12 14:35 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2013-12-12 14:35 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2013-12-12 14:35 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2013-12-12 14:34 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 14:34 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 14:34 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 14:34 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 14:34 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 14:34 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2013-12-12 14:34 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 14:34 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 14:34 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 14:34 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2013-12-12 14:34 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 12:58 - 2013-12-12 13:05 - 00000375 _____ C:\Users\Muhammed\Downloads\gmer.log
2013-12-12 12:55 - 2013-12-12 12:55 - 00377856 _____ C:\Users\Muhammed\Downloads\e5pxbgxv.exe
2013-12-12 12:53 - 2013-12-14 21:55 - 00013808 _____ C:\Users\Muhammed\Downloads\FRST.txt
2013-12-12 12:53 - 2013-12-12 12:54 - 00000803 _____ C:\Users\Muhammed\Downloads\Addition.txt
2013-12-12 12:52 - 2013-12-14 21:55 - 01927796 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST64.exe
2013-12-12 12:52 - 2013-12-14 21:55 - 00000000 ____D C:\FRST
2013-12-12 12:51 - 2013-12-12 13:04 - 00000474 _____ C:\Users\Muhammed\Downloads\defogger_disable.log
2013-12-12 12:51 - 2013-12-12 12:51 - 00000000 _____ C:\Users\Muhammed\defogger_reenable
2013-12-12 12:50 - 2013-12-12 12:50 - 00050477 _____ C:\Users\Muhammed\Downloads\Defogger.exe
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare.url
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare Beta.url
2013-12-04 14:24 - 2013-12-04 14:27 - 00000000 ____D C:\Program Files\OpenVPN
2013-11-24 16:11 - 2013-11-24 17:22 - 00004754 _____ C:\Users\Muhammed\Documents\Kaffeeautomat.ctl
2013-11-22 19:09 - 2013-11-22 19:09 - 00000201 _____ C:\Users\Muhammed\Desktop\Borderlands 2.url
2013-11-22 19:09 - 2013-11-22 19:09 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-11-22 18:58 - 2013-11-22 18:58 - 00000530 _____ C:\Users\Public\Desktop\Steam.lnk
2013-11-22 18:57 - 2013-11-22 18:57 - 01123608 _____ C:\Users\Muhammed\Downloads\SteamSetup.exe
2013-11-20 11:00 - 2013-11-20 11:00 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\JKI
2013-11-20 09:45 - 2013-11-20 09:45 - 00001011 _____ C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2013-11-20 09:45 - 2013-11-20 09:45 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\DVDVideoSoft
2013-11-20 09:41 - 2013-11-20 09:42 - 32206488 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Muhammed\Downloads\FreeYouTubeToMP3Converter_3.12.16.1030.exe
2013-11-17 21:38 - 2013-12-04 13:13 - 00000133 _____ C:\Users\Muhammed\Desktop\Series.txt
2013-11-14 15:36 - 2013-10-10 12:53 - 00096600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2013-11-14 15:36 - 2013-10-10 10:21 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 15:36 - 2013-10-10 10:20 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2013-11-14 15:35 - 2013-09-13 23:36 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2013-11-14 15:35 - 2013-09-13 23:33 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2013-11-14 15:35 - 2013-08-30 06:20 - 01173504 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2013-11-14 15:35 - 2013-08-30 00:48 - 00914432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2013-11-14 15:35 - 2013-08-21 07:39 - 00465240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-11-14 15:35 - 2013-08-10 07:30 - 00151896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys
2013-11-14 15:35 - 2013-08-10 06:21 - 00817152 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2013-11-14 15:35 - 2013-07-25 00:10 - 10799104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2013-11-14 15:35 - 2013-07-25 00:07 - 13661696 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2013-11-14 15:34 - 2013-08-30 06:43 - 00061784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys
2013-11-14 15:34 - 2013-08-10 04:58 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2013-11-14 15:34 - 2013-07-12 02:38 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2013-11-14 15:34 - 2013-07-12 02:30 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2013-11-14 15:33 - 2013-10-03 00:25 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 15:33 - 2013-10-02 00:37 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 15:33 - 2013-10-02 00:37 - 01569280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 15:33 - 2013-10-02 00:26 - 02304512 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 15:33 - 2013-10-02 00:26 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 15:33 - 2013-10-01 23:22 - 01022976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 15:33 - 2013-09-23 23:30 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 15:33 - 2013-09-23 23:30 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 15:33 - 2013-09-04 04:11 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 15:33 - 2013-08-23 08:22 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-14 15:33 - 2013-08-23 02:44 - 01711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll

==================== One Month Modified Files and Folders =======

2013-12-14 21:55 - 2013-12-14 21:55 - 00000000 ____D C:\Users\Muhammed\Downloads\FRST-OlderVersion
2013-12-14 21:55 - 2013-12-12 12:53 - 00013808 _____ C:\Users\Muhammed\Downloads\FRST.txt
2013-12-14 21:55 - 2013-12-12 12:52 - 01927796 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST64.exe
2013-12-14 21:55 - 2013-12-12 12:52 - 00000000 ____D C:\FRST
2013-12-14 21:55 - 2013-10-08 09:15 - 01294697 _____ C:\Windows\WindowsUpdate.log
2013-12-14 21:53 - 2013-12-14 21:53 - 00000685 _____ C:\Users\Muhammed\Desktop\JRT.txt
2013-12-14 21:50 - 2013-12-14 21:50 - 00000000 ____D C:\Windows\ERUNT
2013-12-14 21:48 - 2013-12-14 21:48 - 01034531 _____ (Thisisu) C:\Users\Muhammed\Downloads\JRT.exe
2013-12-14 21:47 - 2013-11-03 10:31 - 00000000 ___RD C:\Users\Muhammed\Dropbox
2013-12-14 21:47 - 2013-11-03 10:29 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Dropbox
2013-12-14 21:45 - 2013-12-14 21:45 - 00001007 _____ C:\Users\Muhammed\Desktop\AdwCleaner[S0].txt
2013-12-14 21:43 - 2013-11-02 16:07 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-14 21:43 - 2013-11-02 16:02 - 00000062 _____ C:\Users\Muhammed\AppData\Roaming\sp_data.sys
2013-12-14 21:43 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-14 21:41 - 2013-12-14 21:40 - 00000000 ____D C:\AdwCleaner
2013-12-14 21:39 - 2013-12-14 21:39 - 01226802 _____ C:\Users\Muhammed\Downloads\adwcleaner.exe
2013-12-14 21:29 - 2013-12-14 21:29 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-14 21:28 - 2013-12-14 21:28 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Muhammed\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-14 21:24 - 2013-12-14 21:24 - 00281248 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-14 21:24 - 2013-12-14 21:24 - 00000558 _____ C:\Windows\PFRO.log
2013-12-13 14:22 - 2013-11-02 16:07 - 00001130 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-13 14:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2013-12-13 11:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-12-13 11:23 - 2013-11-02 16:08 - 00002137 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-13 11:17 - 2013-11-02 16:07 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-13 11:17 - 2013-11-02 16:07 - 00003866 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-13 10:45 - 2013-12-13 10:45 - 00022797 _____ C:\ComboFix.txt
2013-12-13 10:45 - 2013-12-13 10:39 - 00000000 ____D C:\Qoobox
2013-12-13 10:45 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default
2013-12-13 10:44 - 2013-12-13 10:38 - 00000000 ____D C:\Windows\erdnt
2013-12-13 10:44 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini
2013-12-13 10:40 - 2012-08-03 00:02 - 00753134 _____ C:\Windows\system32\perfh007.dat
2013-12-13 10:40 - 2012-08-03 00:02 - 00155826 _____ C:\Windows\system32\perfc007.dat
2013-12-13 10:40 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-13 10:37 - 2013-12-13 10:36 - 05154339 ____R (Swearware) C:\Users\Muhammed\Desktop\ComboFix.exe
2013-12-12 18:18 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-12-12 18:17 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2013-12-12 17:07 - 2013-12-12 17:07 - 00000472 _____ C:\Users\Muhammed\Desktop\LERNEN!!!!!!!.txt
2013-12-12 15:23 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2013-12-12 14:40 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-12-12 14:38 - 2013-12-12 14:38 - 00002778 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-12-12 14:38 - 2013-12-12 14:38 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-12 14:38 - 2013-12-12 14:38 - 00000000 ____D C:\Program Files\CCleaner
2013-12-12 14:38 - 2012-08-02 23:24 - 00000000 ____D C:\Windows\Panther
2013-12-12 14:37 - 2013-12-12 14:37 - 03541544 _____ (Piriform Ltd) C:\Users\Muhammed\Downloads\ccsetup408_slim.exe
2013-12-12 13:09 - 2013-11-02 18:35 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-12 13:09 - 2013-11-02 18:35 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-12 13:09 - 2013-11-02 18:35 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-12 13:05 - 2013-12-12 12:58 - 00000375 _____ C:\Users\Muhammed\Downloads\gmer.log
2013-12-12 13:04 - 2013-12-12 12:51 - 00000474 _____ C:\Users\Muhammed\Downloads\defogger_disable.log
2013-12-12 12:55 - 2013-12-12 12:55 - 00377856 _____ C:\Users\Muhammed\Downloads\e5pxbgxv.exe
2013-12-12 12:54 - 2013-12-12 12:53 - 00000803 _____ C:\Users\Muhammed\Downloads\Addition.txt
2013-12-12 12:51 - 2013-12-12 12:51 - 00000000 _____ C:\Users\Muhammed\defogger_reenable
2013-12-12 12:51 - 2013-11-02 15:59 - 00000000 ____D C:\Users\Muhammed
2013-12-12 12:50 - 2013-12-12 12:50 - 00050477 _____ C:\Users\Muhammed\Downloads\Defogger.exe
2013-12-12 12:44 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\servicing
2013-12-12 12:42 - 2012-07-26 10:45 - 00000000 ____D C:\Windows\ShellNew
2013-12-12 12:42 - 2012-07-26 10:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\SysWOW64\ras
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\ras
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\L2Schemas
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-12 12:42 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\Dism
2013-12-12 12:36 - 2013-11-12 22:45 - 00000000 ____D C:\Users\Muhammed\Downloads\openvpn-extern-Win8
2013-12-12 12:35 - 2013-11-02 16:13 - 00000000 ____D C:\ProgramData\PMB Files
2013-12-12 12:35 - 2013-10-08 09:28 - 00000000 ____D C:\ProgramData\P4G
2013-12-12 12:33 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\registration
2013-12-08 19:05 - 2013-11-02 18:01 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\TS3Client
2013-12-08 18:38 - 2013-11-02 16:13 - 00000000 ____D C:\Users\Muhammed\AppData\Local\PMB Files
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare.url
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare Beta.url
2013-12-04 14:27 - 2013-12-04 14:24 - 00000000 ____D C:\Program Files\OpenVPN
2013-12-04 13:13 - 2013-11-17 21:38 - 00000133 _____ C:\Users\Muhammed\Desktop\Series.txt
2013-12-04 01:53 - 2013-11-05 09:32 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:53 - 2013-11-05 09:32 - 00078304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-24 17:22 - 2013-11-24 16:11 - 00004754 _____ C:\Users\Muhammed\Documents\Kaffeeautomat.ctl
2013-11-24 16:04 - 2013-11-09 16:49 - 00000000 ____D C:\Users\Muhammed\Documents\LabVIEW Data
2013-11-23 07:43 - 2013-12-12 14:34 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-23 06:05 - 2013-12-12 14:34 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-22 21:05 - 2013-11-05 22:41 - 00000000 ____D C:\Users\Muhammed\Documents\My Games
2013-11-22 19:09 - 2013-11-22 19:09 - 00000201 _____ C:\Users\Muhammed\Desktop\Borderlands 2.url
2013-11-22 19:09 - 2013-11-22 19:09 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-11-22 18:58 - 2013-11-22 18:58 - 00000530 _____ C:\Users\Public\Desktop\Steam.lnk
2013-11-22 18:57 - 2013-11-22 18:57 - 01123608 _____ C:\Users\Muhammed\Downloads\SteamSetup.exe
2013-11-20 11:00 - 2013-11-20 11:00 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\JKI
2013-11-20 09:45 - 2013-11-20 09:45 - 00001011 _____ C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2013-11-20 09:45 - 2013-11-20 09:45 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\DVDVideoSoft
2013-11-20 09:42 - 2013-11-20 09:41 - 32206488 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Muhammed\Downloads\FreeYouTubeToMP3Converter_3.12.16.1030.exe
2013-11-17 22:12 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2013-11-17 18:25 - 2013-11-02 21:55 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 18:24 - 2013-11-02 21:55 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe


Some content of TEMP:
====================
C:\Users\Muhammed\AppData\Local\Temp\avgnt.exe
C:\Users\Muhammed\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-13 11:22

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-12-2013 01
Ran by Muhammed at 2013-12-14 21:56:14
Running from C:\Users\Muhammed\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 10 Plugin (x32 Version: 10.3.181.14)
Adobe Reader X MUI (x32 Version: 10.0.0)
ASUS InstantOn (x32 Version: 3.0.5)
ASUS LifeFrame3 (x32 Version: 3.1.9)
ASUS Live Update (x32 Version: 3.1.9)
ASUS Power4Gear Hybrid (Version: 2.1.7)
ASUS Screen Saver (Version: 1.0.1)
ASUS Smart Gesture (x32 Version: 2.2.0)
ASUS Splendid Video Enhancement Technology (x32 Version: 2.01.0005)
ASUS USB Charger Plus (x32 Version: 2.1.5)
ASUS WebStorage Sync Agent (x32 Version: 1.1.18.159)
ASUSDVD (x32 Version: 10.0.4126.52)
AsusVibe2.0 (x32 Version: 2.0.12.309)
ATK Package (x32 Version: 1.0.0025)
Avira Free Antivirus (x32 Version: 14.0.2.286)
Borderlands 2 (x32)
CCleaner (Version: 4.08)
D3DX10 (x32 Version: 15.4.2368.0902)
Dropbox (HKCU Version: 2.4.6)
EPSON-Drucker-Software
Fotogalerie (x32 Version: 16.4.3505.0912)
Free YouTube to MP3 Converter version 3.12.16.1030 (x32 Version: 3.12.16.1030)
Galerie de photos (x32 Version: 16.4.3505.0912)
Google Chrome (x32 Version: 31.0.1650.63)
Google Update Helper (x32 Version: 1.3.22.3)
Hi-Rez Studios Authenticate and Update Service (x32 Version: 3.0.0.0)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2932)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
League of Legends (x32 Version: 3.0.1)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Math-Kernel-Bibliotheken (64 Bit) (Version: 1.0.31.0)
Math-Kernel-Bibliotheken (64 Bit) (Version: 13.0.13)
Math-Kernel-Bibliotheken (x32 Version: 1.0.31.0)
Math-Kernel-Bibliotheken (x32 Version: 13.0.13)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office (x32 Version: 15.0.4454.1510)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Silverlight 5.1 (x32 Version: 5.1.4001)
Microsoft SkyDrive (HKCU Version: 17.0.2015.0811)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3505.0912)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MyBitCast 2.0 (x32 Version: 2.0)
National Instruments - Software (x32 Version: )
NI .NET Framework 4.0 (x32 Version: 4.01.49152)
NI Assistant Framework (x32 Version: 9.0.143)
NI Assistant Framework 64-bit (Version: 9.0.143)
NI Assistant Framework LabVIEW 2013 Support (x32 Version: 9.0.107)
NI Assistant Framework LabVIEW Code Generator 2013 (x32 Version: 9.0.107)
NI Authentication 13.0.0 (64-bit) (Version: 13.0.326)
NI Authentication 13.0.0 (x32 Version: 13.0.326)
NI CodeSignAPI (x32 Version: 2.70.346)
NI Curl 13.0.0 (64-bit) (Version: 13.0.324)
NI Curl 13.0.0 (x32 Version: 13.0.324)
NI DataSocket 5.1 (64 Bit) (Version: 5.1.227)
NI DataSocket 5.1 (x32 Version: 5.1.227)
NI Error Reporting Interface Installer 5.5 (x32 Version: 5.50.49152)
NI Error Reporting Interface Installer 5.5 for Windows 64-bit (Version: 5.50.49152)
NI EulaDepot (x32 Version: 3.20.361)
NI Example Finder 13.0 (x32 Version: 13.0.324)
NI GMP Windows 32-bit Installer 13.0.0 (x32 Version: 13.0.45.0)
NI GMP Windows 64-bit Installer 13.0.0 (Version: 13.0.45.0)
NI Help Assistant 2.0 (64bit) (Version: 2.0.3)
NI Help Assistant 2.0 (x32 Version: 2.0.3)
NI Instrument IO Assistant for LabVIEW 2013 32-bit (x32 Version: 1.0.14.0)
NI LabVIEW 2011 Real-Time NBFifo (x32 Version: 11.0.250.0)
NI LabVIEW 2012 Real-Time NBFifo (x32 Version: 12.0.219.0)
NI LabVIEW 2012 Real-Time NBFifo (x32 Version: 13.0.336)
NI LabVIEW 2013 (32 Bit) (x32 Version: 13.0.105)
NI LabVIEW 2013 Deployable License (x32 Version: 13.0.303)
NI LabVIEW 2013 Deployment Framework (x32 Version: 13.0.330)
NI LabVIEW 2013 f2 (x32 Version: 13.0.339)
NI LabVIEW 2013 Help (x32 Version: 13.0.106)
NI LabVIEW 2013 Help File (x32 Version: 13.0.299)
NI LabVIEW 2013 License (x32 Version: 13.0.342)
NI LabVIEW 2013 Manuals (x32 Version: 13.0.105)
NI LabVIEW 2013 MeasAppChm File (x32 Version: 13.0.299)
NI LabVIEW 2013 Real-Time Error Dialog (x32 Version: 13.0.123)
NI LabVIEW 2013 Scripting Code Generator (x32 Version: 9.0.172)
NI LabVIEW 2013 Search (x32 Version: 13.0.16)
NI LabVIEW 2013 Simulation (x32 Version: 13.0.327)
NI LabVIEW 2013 Variable Web Service (x32 Version: 13.0.326)
NI LabVIEW 2013 Web Server (x32 Version: 13.0.327)
NI LabVIEW Broker (64 bit) (Version: 6.8.10.0)
NI LabVIEW Broker (x32 Version: 6.8.10.0)
NI LabVIEW C Interface (x32 Version: 1.0.1)
NI LabVIEW Compare Utility 13.0.0 (x32 Version: 13.0.340)
NI LabVIEW MAX XML (x32 Version: 9.0.6.0)
NI LabVIEW Merge Utility 13.0.0 (x32 Version: 13.0.339)
NI LabVIEW Run-Time Engine 2011 SP1 (x32 Version: 11.0.448.0)
NI LabVIEW Run-Time Engine 2012 SP1 f3 (x32 Version: 12.1.58.0)
NI LabVIEW Run-Time Engine Interop 2011 (x32 Version: 11.0.449.0)
NI LabVIEW Run-Time Engine Interop 2012 SP1 (x32 Version: 12.1.58.0)
NI LabVIEW Run-Time Engine Interop 2013 (x32 Version: 13.0.337)
NI LabVIEW Run-Time Engine Webserver 2012 (x32 Version: 12.5.198.0)
NI LabVIEW Run-Time Engine Webserver 2013 (x32 Version: 13.0.321)
NI LabVIEW Runtime-Engine 2013 f2 (x32 Version: 13.0.337)
NI LabVIEW Web Server for Run-Time Engine (x32 Version: 11.0.375.0)
NI LabVIEW Web Services Runtime (x32 Version: 13.0.314)
NI LabWindows/CVI 2010 SP1 Analysis Library (64-bit) (Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 Analysis Library (x32 Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 Code Generator (x32 Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 Low-Level Driver (Original) (x32 Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 Low-Level Driver (Updated) (x32 Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 Network Variable Library (64-bit) (Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 Network Variable Library (x32 Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 Run-Time Engine (64-bit) (Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 TDM Streaming Library (64-bit) (Version: 10.0.1434)
NI LabWindows/CVI 2010 SP1 TDM Streaming Library (x32 Version: 10.0.1434)
NI LabWindows/CVI 2012 LabVIEW DLL Builder (x32 Version: 12.0.0422)
NI LabWindows/CVI Run-Time Engine 2010 SP1 (Updated) (x32 Version: 10.0.1434)
NI LabWindows/CVI Run-Time Engine 2010 SP1 (x32 Version: 10.0.1434)
NI Launcher (x32 Version: 3.20.351)
NI License Manager (x32 Version: 3.7.53)
NI Logos 5.5 (64 Bit) (Version: 5.5.293)
NI Logos 5.5 (x32 Version: 5.5.293)
NI Logos LabVIEW 2013 Support (x32 Version: 13.0.106)
NI Logos XT Support (x32 Version: 5.5.294)
NI Logos64 XT Support (Version: 5.5.294)
NI Math Kernel Libraries (64-bit) (Version: 1.0.10.0)
NI Math Kernel Libraries (x32 Version: 1.0.10.0)
NI MAX Remote Configuration 64-bit Installer 5.5 (Version: 5.50.49152)
NI MAX Remote Configuration Installer 5.5 (x32 Version: 5.50.49152)
NI MAX Support for 64 Bit Windows (Version: 5.50.49152)
NI MDF Support (x32 Version: 3.20.361)
NI mDNS Responder 2.2 for Windows 64-bit (Version: 2.20.49152)
NI mDNS Responder 2.2.0 (x32 Version: 2.20.49152)
NI Measurement & Automation Explorer 5.5.0 (x32 Version: 5.50.49152)
NI Measurement Studio ComponentWorks 3D Graph (x32 Version: 8.6.10603)
NI Measurement Studio ComponentWorks UI (x32 Version: 8.6.10603)
NI Measurement Studio Recipe Processor (x32 Version: 8.0.0101)
NI MetaSuite Installer (x32 Version: 3.20.351)
NI MXS 5.5.0 (x32 Version: 5.50.49152)
NI MXS 5.5.0 for 64 Bit Windows (Version: 5.50.49152)
NI Network Discovery 5.5 (x32 Version: 5.50.49152)
NI Network Discovery 5.5 for Windows 64-bit (Version: 5.50.49152)
NI OPC Support (x32 Version: 13.0.296)
NI OPCEnum Shared (x32 Version: 5.5.2018)
NI Portable Configuration 5.5.0 (x32 Version: 5.50.49152)
NI Portable Configuration for 64 Bit Windows 5.5.0 (Version: 5.50.49152)
NI Registration Wizard (x32 Version: 1.3.97.0)
NI Remote Provider for MAX 5.5.0 (x32 Version: 5.50.49152)
NI Remote PXI Provider for MAX 5.5.0 (x32 Version: 5.50.49152)
NI Search Shared (x32 Version: 13.0.13)
NI Security Update (KB 67L8LCQW) (64-bit) (Version: 1.0.29.0)
NI Security Update (KB 67L8LCQW) (x32 Version: 1.0.29.0)
NI Service Locator 13.0 (x32 Version: 13.0.307)
NI SLCP 2.0 (x32 Version: 2.0.27)
NI Software Provider for MAX 5.5.0 (x32 Version: 5.50.49152)
NI SSL LabVIEW 2013 Support (x32 Version: 13.0.328)
NI SSL LabVIEW RTE 2012 SP1 Support (x32 Version: 12.5.8.0)
NI SSL LabVIEW RTE 2013 Support (x32 Version: 13.0.317)
NI System API .NET 5.5.0 (x32 Version: 5.50.157)
NI System API Client for WIF 5.5.0 (x32 Version: 5.50.419)
NI System API Web-Service 32-bit 5.5.0 (x32 Version: 5.50.405)
NI System API Windows 32-bit 5.5.0 (x32 Version: 5.50.589)
NI System API Windows 64-bit 5.5.0 (Version: 5.50.588)
NI System Configuration 5.5.0 LabVIEW Support (x32 Version: 5.50.186)
NI System Configuration LV2013 Support 5.5.0 (x32 Version: 5.50.178)
NI System Configuration Runtime 5.5.0 for Windows 64-bit (Version: 5.50.226)
NI System State Publisher (64-bit) (Version: 13.0.299)
NI System State Publisher (x32 Version: 13.0.304)
NI System Web Server 13.0 (x32 Version: 13.0.333)
NI System Web Server Base 13.0.0 (64-bit) (Version: 13.0.324)
NI System Web Server Base 13.0.0 (x32 Version: 13.0.324)
NI TDM Excel Add-In 3.5 (x32 Version: 3.5.9)
NI TDM Excel Add-In 3.5 64-bit (Version: 3.5.9)
NI TDM Streaming 2.5 (64 Bit) (Version: 2.5.36)
NI TDM Streaming 2.5 (x32 Version: 2.5.36)
NI Trace Engine (64-bit) (Version: 13.0.324)
NI Trace Engine (x32 Version: 13.0.324)
NI Uninstaller (x32 Version: 3.20.361)
NI Unterstützung für nicht englische Versionen der Runtime-Engine von LabVIEW 2011 SP1 (x32 Version: 11.0.302.0)
NI Update Service 2.3 (64-bit) (Version: 2.30.53)
NI USI 2.0.1 (x32 Version: 2.0.15249)
NI USI 2.0.1 64-Bit (Version: 2.0.15249)
NI Variable Engine (64-bit) (Version: 2.7.297)
NI Variable Engine 2.6.0 (x32 Version: 2.7.297)
NI Variable Engine LabVIEW 2013 Support (x32 Version: 13.0.106)
NI VC2005MSMs x64 (Version: 8.05.0)
NI VC2005MSMs x86 (x32 Version: 8.05.0)
NI VC2008MSMs x64 (Version: 9.0.401)
NI VC2008MSMs x86 (x32 Version: 9.0.401)
NI VC2010SP1MSMs x64 (Version: 10.0.100)
NI VC2010SP1MSMs x86 (x32 Version: 10.0.100)
NI VIPM Helper 2013 (x32 Version: 13.0.339)
NI Web Application Server 13.0 (64 Bit) (Version: 13.0.319)
NI Web Application Server 13.0 (x32 Version: 13.0.324)
NI Web Pipeline 3.3 (64-bit) (Version: 3.30.24)
NI Web Pipeline 3.3 (x32 Version: 3.30.24)
NI Xalan Delay Load 1.10.2 (x32 Version: 1.10.72.0)
NI Xalan Delay Load 1.10.2 64-bit (Version: 1.10.73.0)
NI Xerces Delay Load 2.7.3 (x32 Version: 2.7.180.0)
NI Xerces Delay Load 2.7.3 64-bit (Version: 2.7.190.0)
NI-ActiveX-Container (64-bit) (Version: 13.0.4)
NI-ActiveX-Container (x32 Version: 13.0.4)
NI-DAQmx/LabVIEW shared documentation 9.7.5 (x32 Version: 9.75.49152)
NI-DAQmx/LabVIEW shared documentation for 64 Bit Windows 9.7.5 (Version: 9.75.49152)
NI-DSM 2013 (x32 Version: 13.0.338)
NI-Fehlerprotokolle 2013 (x32 Version: 13.0.324)
NI-Mesa (Version: 12.0.7.0)
NI-Mesa (x32 Version: 12.0.7.0)
NI-Qualitätssteigerungsprogramm (x32 Version: 2.0.77)
NI-RPC 4.4.0f0 (x32 Version: 4.40.49152)
NI-RPC 4.4.0f0 for 64 Bit Windows (Version: 4.40.49152)
NI-RPC 4.4.0f0 for Phar Lap ETS (x32 Version: 4.40.49152)
NI-Update-Dienst 2.3 (x32 Version: 2.30.65)
NI-Webkonfiguration und Überwachung 2013 (x32 Version: 13.0.306)
NVIDIA Control Panel 311.93 (Version: 311.93)
NVIDIA Graphics Driver 311.93 (Version: 311.93)
NVIDIA HD Audio Driver 1.3.24.2 (Version: 1.3.24.2)
NVIDIA Install Application (Version: 2.1002.124.810)
NVIDIA Optimus 4.11.9 (Version: 4.11.9)
NVIDIA PhysX (x32 Version: 9.13.0604)
NVIDIA PhysX System Software 9.13.0604 (Version: 9.13.0604)
NVIDIA Update 4.11.9 (Version: 4.11.9)
NVIDIA Update Components (Version: 4.11.9)
Pando Media Booster (x32 Version: 2.6.0.7)
Photo Common (x32 Version: 16.4.3505.0912)
Photo Gallery (x32 Version: 16.4.3505.0912)
Qualcomm Atheros Client Installation Program (x32 Version: 10.0)
Raccolta foto (x32 Version: 16.4.3505.0912)
Realtek Ethernet Controller Driver (x32 Version: 8.7.1025.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6937)
Realtek PCIE Card Reader (x32 Version: 6.2.9200.27030)
Reset NI Config 5.5.0 (x32 Version: 5.50.227)
Runtime für den NI-Systemkonfigurator 5.5.0 (x32 Version: 5.50.226)
Shared C Run-time for x64 (Version: 10.0.0)
Smite (x32 Version: 0.1.1807.0)
Steam (x32)
TeamSpeak 3 Client (HKCU Version: 3.0.13)
Unterstützung für NI SSL (64 Bit) (Version: 13.0.319)
Unterstützung für NI SSL (x32 Version: 13.0.324)
Unterstützung für nicht englische Versionen der Runtime-Engine von LabVIEW 2012 SP1. (x32 Version: 12.1.52.0)
Unterstützung für nicht englische Versionen der Runtime-Engine von LabVIEW 2013. (x32 Version: 13.0.329)
VI Package Manager 2013 (x32 Version: 13.0.0)
VI Package Manager 2013 (x32 Version: 13.0.1879)
WIF Core Dependencies Windows 5.5.0 (x32 Version: 5.50.155)
Windows Driver Package - ASUS (ATP) Mouse  (05/09/2013 1.0.0.173) (Version: 05/09/2013 1.0.0.173)
Windows Live (x32 Version: 16.4.3505.0912)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)
WinFlash (x32 Version: 2.42.0)

==================== Restore Points  =========================

12-12-2013 11:21:28 Wiederherstellungsvorgang

==================== Hosts content: ==========================

2012-07-26 06:26 - 2013-12-13 10:43 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {5C5F965A-5EDE-4A4F-84B5-03AB3DD4FC2D} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)
Task: {6DD106DA-8796-47B8-B383-28CBAF557584} - System32\Tasks\ASUS InstantOn Config => C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe [2012-10-24] (ASUS)
Task: {75AB77F8-E850-4C89-85BE-AEDCA68C734C} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2013-01-04] ()
Task: {7B8A02FD-FD3F-410D-AECE-6D3864176B05} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-02] (Google Inc.)
Task: {8F05E638-1904-4A78-A660-08C74FE456FE} - System32\Tasks\NIUpdateServiceCheckTask => D:\Labview\Shared\Update Service\NIUpdateService.exe [2013-05-28] (National Instruments)
Task: {8F72176A-8DE5-46A5-8FEF-37C5FC211056} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-02] (Google Inc.)
Task: {99F0E240-FA85-4831-B2D9-F7DBBA2C6F06} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)
Task: {A52E581E-2E5E-4E4E-9F45-00396A18669E} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2012-11-28] (ASUS)
Task: {A58AE704-9FF9-464B-8182-B036F75FAEBF} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {A939C099-471B-4510-82F4-2CBE48D662C1} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-09-18] (ASUSTek Computer Inc.)
Task: {C325D06D-73BF-459A-BF1A-A36EF4002886} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)
Task: {C569A4A4-6119-4DB4-85AE-8071FDE7C624} - System32\Tasks\JKIUpdateTask => C:\Program Files (x86)\JKI\VI Package Manager\support\JKIUpdate.exe [2013-05-23] (JKI)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D0C6D4BF-5023-4F1F-A147-3459FF53D233} - System32\Tasks\ASUS Splendid ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-02-26] (ASUSTeK Computer Inc.)
Task: {E805C5C7-E900-4BA4-9020-F65F830A84DB} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-06-28] (AsusTek)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-08-24 17:26 - 2012-08-24 17:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2013-07-22 03:52 - 2012-12-13 23:14 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2013-11-02 18:35 - 2013-10-10 19:14 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-10-09 13:11 - 2013-10-09 13:11 - 02214912 _____ () D:\Labview\Shared\LabVIEW Run-Time\2013\NIQtCore_2013.dll
2013-10-09 13:11 - 2013-10-09 13:11 - 08044544 _____ () D:\Labview\Shared\LabVIEW Run-Time\2013\NIQtGui_2013.dll
2012-01-26 10:36 - 2012-01-26 10:36 - 00278528 ____R () D:\Labview\Shared\License Manager\Bin\xerces-depdom_2_6.dll
2013-06-07 10:59 - 2013-06-07 10:59 - 01958560 _____ () D:\Labview\Shared\NI Error Reporting\niwsrp.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Muhammed\AppData\Roaming\Dropbox\bin\libcef.dll
2013-10-08 09:12 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-12-13 11:23 - 2013-12-04 03:47 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll
2013-12-13 11:23 - 2013-12-04 03:47 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll
2013-12-13 11:23 - 2013-12-04 03:48 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll
2013-12-13 11:23 - 2013-12-04 03:48 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll
2013-12-13 11:23 - 2013-12-04 03:47 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-12-13 10:43:37.450
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Percentage of memory in use: 23%
Total physical RAM: 8077.68 MB
Available physical RAM: 6153.88 MB
Total Pagefile: 9293.68 MB
Available Pagefile: 7062.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:218.2 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:398.07 GB) (Free:374.31 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 568814A2)

Partition: GPT Partition Type
==================== End Of Log ============================

schrauber · 15.12.2013, 08:15

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

prinzcharmin · 15.12.2013, 12:03

Erledigt! Ich würde gerne grob wissen was bisher geschah

Hier die neuen logs:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ed8320f05bdfd542967a70742ecfc170
# engine=16274
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-15 10:52:38
# local_time=2013-12-15 11:52:38 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT 
# compatibility_mode=1799 16775165 100 94 54587 5675916 48120 0
# compatibility_mode=5893 16776574 100 94 259796 20141263 0 0
# scanned=235890
# found=0
# cleaned=0
# scan_time=3897

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.77  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
Avira Desktop      
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Adobe Flash Player 10 Flash Player out of Date! 
  Adobe Flash Player 	10.3.181.14 Flash Player out of Date!  
 Google Chrome 31.0.1650.57  
 Google Chrome 31.0.1650.63  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

Neues FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-12-2013 01
Ran by Muhammed (administrator) on * on 15-12-2013 11:57:38
Running from C:\Users\Muhammed\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
() C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Hi-Rez Studios) D:\Programme\HiPatchService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(National Instruments Corporation) C:\Windows\SysWOW64\lkads.exe
(National Instruments Corporation) D:\Labview\MAX\nimxs.exe
(National Instruments Corporation) D:\Labview\Shared\Security\nidmsrv.exe
(National Instruments Corporation) D:\Labview\Shared\nisvcloc\nisvcloc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(National Instruments, Inc.) C:\Windows\SysWOW64\lkcitdl.exe
(National Instruments Corporation) C:\Windows\SysWOW64\lktsrv.exe
(National Instruments Corporation) D:\Labview\Shared\mDNS Responder\nimdnsResponder.exe
(National Instruments Corporation) D:\Labview\Shared\NI WebServer\SystemWebServer.exe
(National Instruments Corporation) D:\Labview\Shared\Tagger\tagsrv.exe
(National Instruments Corporation) D:\Labview\Shared\NI Network Discovery\niDiscSvc.exe
(National Instruments Corporation) D:\Labview\Shared\NI WebServer\ApplicationWebServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(National Instruments Corporation) D:\Labview\Shared\NI Error Reporting\nierserver.exe
(Dropbox, Inc.) C:\Users\Muhammed\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13550152 2013-05-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1308232 2013-05-20] (Realtek Semiconductor)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [NIRegistrationWizard] - D:\Labview\Shared\RegistrationWizard\Bin\RegistrationWizard.exe [847000 2013-04-19] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\aprp.exe [3187360 2013-04-26] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [NI Update Service] - D:\Labview\Shared\Update Service\NIUpdateService.exe [857888 2013-05-28] (National Instruments)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [245872 2013-07-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-07-08] (NVIDIA Corporation)
Startup: C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Muhammed\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Winsock: Catalog5 08 D:\Labview\Shared\mDNS Responder\nimdnsNSP.dll [26512] (National Instruments Corporation)
Winsock: Catalog5-x64 08 C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll [28560] (National Instruments Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome: 
=======
CHR DefaultSearchKeyword: google.de
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}
CHR Extension: (Google Docs) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Google Search) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Google Wallet) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Muhammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] ()
R2 HiPatchService; D:\Programme\HiPatchService.exe [9216 2013-10-25] (Hi-Rez Studios)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 LkCitadelServer; C:\Windows\SysWOW64\lkcitdl.exe [695136 2010-10-27] (National Instruments, Inc.)
R2 lkClassAds; C:\Windows\SysWOW64\lkads.exe [53544 2013-06-12] (National Instruments Corporation)
R2 lkTimeSync; C:\Windows\SysWOW64\lktsrv.exe [63792 2013-06-12] (National Instruments Corporation)
R2 mxssvr; D:\Labview\MAX\nimxs.exe [83768 2013-06-10] (National Instruments Corporation)
R2 NIApplicationWebServer; D:\Labview\Shared\NI WebServer\ApplicationWebServer.exe [57696 2013-06-08] (National Instruments Corporation)
S4 NIApplicationWebServer64; C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [81248 2013-06-08] (National Instruments Corporation)
R2 NIDomainService; D:\Labview\Shared\Security\nidmsrv.exe [380720 2013-06-12] (National Instruments Corporation)
S3 NILM License Manager; D:\Labview\Shared\License Manager\Bin\lmgrd.exe [1427688 2010-08-02] (Macrovision Corporation)
R2 nimDNSResponder; D:\Labview\Shared\mDNS Responder\nimdnsResponder.exe [260976 2013-05-11] (National Instruments Corporation)
R2 NINetworkDiscovery; D:\Labview\Shared\NI Network Discovery\niDiscSvc.exe [176512 2013-06-19] (National Instruments Corporation)
R2 NiSvcLoc; D:\Labview\Shared\niSvcLoc\nisvcloc.exe [90440 2013-06-07] (National Instruments Corporation)
R2 NISystemWebServer; D:\Labview\Shared\NI WebServer\SystemWebServer.exe [57680 2013-06-08] (National Instruments Corporation)
R2 NITaggerService; D:\Labview\Shared\Tagger\tagsrv.exe [687944 2013-06-15] (National Instruments Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-06-28] (ASUS Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-12] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-04-26] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U0 msahci; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-15 11:56 - 2013-12-15 11:56 - 00000976 _____ C:\Users\Muhammed\Desktop\securitycheck.txt
2013-12-15 11:55 - 2013-12-15 11:55 - 00891200 _____ C:\Users\Muhammed\Downloads\SecurityCheck.exe
2013-12-15 11:54 - 2013-12-15 11:54 - 00000697 _____ C:\Users\Muhammed\Desktop\eset.txt
2013-12-15 10:44 - 2013-12-15 10:44 - 02347384 _____ (ESET) C:\Users\Muhammed\Downloads\esetsmartinstaller_enu.exe
2013-12-14 21:55 - 2013-12-14 21:55 - 00000000 ____D C:\Users\Muhammed\Downloads\FRST-OlderVersion
2013-12-14 21:53 - 2013-12-14 21:53 - 00000685 _____ C:\Users\Muhammed\Desktop\JRT.txt
2013-12-14 21:50 - 2013-12-14 21:50 - 00000000 ____D C:\Windows\ERUNT
2013-12-14 21:48 - 2013-12-14 21:48 - 01034531 _____ (Thisisu) C:\Users\Muhammed\Downloads\JRT.exe
2013-12-14 21:45 - 2013-12-14 21:45 - 00001007 _____ C:\Users\Muhammed\Desktop\AdwCleaner[S0].txt
2013-12-14 21:40 - 2013-12-14 21:41 - 00000000 ____D C:\AdwCleaner
2013-12-14 21:39 - 2013-12-14 21:39 - 01226802 _____ C:\Users\Muhammed\Downloads\adwcleaner.exe
2013-12-14 21:29 - 2013-12-14 21:29 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-14 21:29 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-14 21:28 - 2013-12-14 21:28 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Muhammed\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-14 21:24 - 2013-12-14 21:24 - 00281248 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-14 21:24 - 2013-12-14 21:24 - 00000558 _____ C:\Windows\PFRO.log
2013-12-13 10:45 - 2013-12-13 10:45 - 00022797 _____ C:\ComboFix.txt
2013-12-13 10:39 - 2013-12-13 10:45 - 00000000 ____D C:\Qoobox
2013-12-13 10:39 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-13 10:39 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-13 10:39 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-13 10:39 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-13 10:38 - 2013-12-13 10:44 - 00000000 ____D C:\Windows\erdnt
2013-12-13 10:36 - 2013-12-13 10:37 - 05154339 ____R (Swearware) C:\Users\Muhammed\Desktop\ComboFix.exe
2013-12-12 17:07 - 2013-12-12 17:07 - 00000472 _____ C:\Users\Muhammed\Desktop\LERNEN!!!!!!!.txt
2013-12-12 14:38 - 2013-12-12 14:38 - 00002778 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-12-12 14:38 - 2013-12-12 14:38 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-12 14:38 - 2013-12-12 14:38 - 00000000 ____D C:\Program Files\CCleaner
2013-12-12 14:38 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 14:38 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 14:38 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 14:37 - 2013-12-12 14:37 - 03541544 _____ (Piriform Ltd) C:\Users\Muhammed\Downloads\ccsetup408_slim.exe
2013-12-12 14:37 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-12 14:37 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 14:37 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 14:37 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 14:37 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 14:37 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-12 14:37 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-12 14:37 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-12 14:37 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-12 14:36 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 14:36 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2013-12-12 14:36 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 14:36 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-12 14:36 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-12 14:36 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-12 14:36 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-12 14:36 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-12 14:36 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-12 14:36 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-12 14:35 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-12 14:35 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2013-12-12 14:35 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2013-12-12 14:35 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2013-12-12 14:35 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2013-12-12 14:35 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-12 14:35 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-12 14:35 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-12 14:35 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2013-12-12 14:35 - 2013-10-03 23:09 - 00385528 _____ C:\Windows\system32\ApnDatabase.xml
2013-12-12 14:35 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2013-12-12 14:35 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-12-12 14:35 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-12-12 14:35 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-12-12 14:35 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\resutils.dll
2013-12-12 14:35 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2013-12-12 14:35 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2013-12-12 14:35 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2013-12-12 14:34 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 14:34 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 14:34 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 14:34 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 14:34 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 14:34 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrobj.dll
2013-12-12 14:34 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 14:34 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 14:34 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 14:34 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\scrobj.dll
2013-12-12 14:34 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 12:58 - 2013-12-12 13:05 - 00000375 _____ C:\Users\Muhammed\Downloads\gmer.log
2013-12-12 12:55 - 2013-12-12 12:55 - 00377856 _____ C:\Users\Muhammed\Downloads\e5pxbgxv.exe
2013-12-12 12:53 - 2013-12-15 11:57 - 00013825 _____ C:\Users\Muhammed\Downloads\FRST.txt
2013-12-12 12:53 - 2013-12-14 21:57 - 00021598 _____ C:\Users\Muhammed\Downloads\Addition.txt
2013-12-12 12:52 - 2013-12-14 21:55 - 01927796 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST64.exe
2013-12-12 12:52 - 2013-12-14 21:55 - 00000000 ____D C:\FRST
2013-12-12 12:51 - 2013-12-12 13:04 - 00000474 _____ C:\Users\Muhammed\Downloads\defogger_disable.log
2013-12-12 12:51 - 2013-12-12 12:51 - 00000000 _____ C:\Users\Muhammed\defogger_reenable
2013-12-12 12:50 - 2013-12-12 12:50 - 00050477 _____ C:\Users\Muhammed\Downloads\Defogger.exe
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare.url
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare Beta.url
2013-12-04 14:24 - 2013-12-04 14:27 - 00000000 ____D C:\Program Files\OpenVPN
2013-11-24 16:11 - 2013-11-24 17:22 - 00004754 _____ C:\Users\Muhammed\Documents\Kaffeeautomat.ctl
2013-11-22 19:09 - 2013-11-22 19:09 - 00000201 _____ C:\Users\Muhammed\Desktop\Borderlands 2.url
2013-11-22 19:09 - 2013-11-22 19:09 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-11-22 18:58 - 2013-11-22 18:58 - 00000530 _____ C:\Users\Public\Desktop\Steam.lnk
2013-11-22 18:57 - 2013-11-22 18:57 - 01123608 _____ C:\Users\Muhammed\Downloads\SteamSetup.exe
2013-11-20 11:00 - 2013-11-20 11:00 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\JKI
2013-11-20 09:45 - 2013-11-20 09:45 - 00001011 _____ C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2013-11-20 09:45 - 2013-11-20 09:45 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\DVDVideoSoft
2013-11-20 09:41 - 2013-11-20 09:42 - 32206488 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Muhammed\Downloads\FreeYouTubeToMP3Converter_3.12.16.1030.exe
2013-11-17 21:38 - 2013-12-04 13:13 - 00000133 _____ C:\Users\Muhammed\Desktop\Series.txt

==================== One Month Modified Files and Folders =======

2013-12-15 11:57 - 2013-12-12 12:53 - 00013825 _____ C:\Users\Muhammed\Downloads\FRST.txt
2013-12-15 11:56 - 2013-12-15 11:56 - 00000976 _____ C:\Users\Muhammed\Desktop\securitycheck.txt
2013-12-15 11:55 - 2013-12-15 11:55 - 00891200 _____ C:\Users\Muhammed\Downloads\SecurityCheck.exe
2013-12-15 11:54 - 2013-12-15 11:54 - 00000697 _____ C:\Users\Muhammed\Desktop\eset.txt
2013-12-15 11:22 - 2013-11-02 16:07 - 00001130 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-15 11:22 - 2013-11-02 16:07 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-15 11:00 - 2013-10-08 09:15 - 01303243 _____ C:\Windows\WindowsUpdate.log
2013-12-15 11:00 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2013-12-15 10:47 - 2012-08-03 00:02 - 00753134 _____ C:\Windows\system32\perfh007.dat
2013-12-15 10:47 - 2012-08-03 00:02 - 00155826 _____ C:\Windows\system32\perfc007.dat
2013-12-15 10:47 - 2012-07-26 08:28 - 01745416 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-15 10:44 - 2013-12-15 10:44 - 02347384 _____ (ESET) C:\Users\Muhammed\Downloads\esetsmartinstaller_enu.exe
2013-12-15 10:43 - 2013-11-03 10:29 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Dropbox
2013-12-15 10:42 - 2013-11-03 10:31 - 00000000 ___RD C:\Users\Muhammed\Dropbox
2013-12-15 10:41 - 2013-11-02 16:02 - 00000062 _____ C:\Users\Muhammed\AppData\Roaming\sp_data.sys
2013-12-15 10:36 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-15 01:05 - 2013-11-02 18:01 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\TS3Client
2013-12-14 22:57 - 2013-11-02 16:13 - 00000000 ____D C:\Users\Muhammed\AppData\Local\PMB Files
2013-12-14 21:57 - 2013-12-12 12:53 - 00021598 _____ C:\Users\Muhammed\Downloads\Addition.txt
2013-12-14 21:55 - 2013-12-14 21:55 - 00000000 ____D C:\Users\Muhammed\Downloads\FRST-OlderVersion
2013-12-14 21:55 - 2013-12-12 12:52 - 01927796 _____ (Farbar) C:\Users\Muhammed\Downloads\FRST64.exe
2013-12-14 21:55 - 2013-12-12 12:52 - 00000000 ____D C:\FRST
2013-12-14 21:53 - 2013-12-14 21:53 - 00000685 _____ C:\Users\Muhammed\Desktop\JRT.txt
2013-12-14 21:50 - 2013-12-14 21:50 - 00000000 ____D C:\Windows\ERUNT
2013-12-14 21:48 - 2013-12-14 21:48 - 01034531 _____ (Thisisu) C:\Users\Muhammed\Downloads\JRT.exe
2013-12-14 21:45 - 2013-12-14 21:45 - 00001007 _____ C:\Users\Muhammed\Desktop\AdwCleaner[S0].txt
2013-12-14 21:41 - 2013-12-14 21:40 - 00000000 ____D C:\AdwCleaner
2013-12-14 21:39 - 2013-12-14 21:39 - 01226802 _____ C:\Users\Muhammed\Downloads\adwcleaner.exe
2013-12-14 21:29 - 2013-12-14 21:29 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-14 21:29 - 2013-12-14 21:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-14 21:28 - 2013-12-14 21:28 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Muhammed\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-14 21:24 - 2013-12-14 21:24 - 00281248 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-14 21:24 - 2013-12-14 21:24 - 00000558 _____ C:\Windows\PFRO.log
2013-12-13 11:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2013-12-13 11:23 - 2013-11-02 16:08 - 00002137 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-13 11:17 - 2013-11-02 16:07 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-13 11:17 - 2013-11-02 16:07 - 00003866 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-13 10:45 - 2013-12-13 10:45 - 00022797 _____ C:\ComboFix.txt
2013-12-13 10:45 - 2013-12-13 10:39 - 00000000 ____D C:\Qoobox
2013-12-13 10:45 - 2012-07-26 06:37 - 00000000 __RHD C:\Users\Default
2013-12-13 10:44 - 2013-12-13 10:38 - 00000000 ____D C:\Windows\erdnt
2013-12-13 10:44 - 2012-07-26 06:26 - 00000215 _____ C:\Windows\system.ini
2013-12-13 10:37 - 2013-12-13 10:36 - 05154339 ____R (Swearware) C:\Users\Muhammed\Desktop\ComboFix.exe
2013-12-12 18:18 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2013-12-12 18:17 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2013-12-12 17:07 - 2013-12-12 17:07 - 00000472 _____ C:\Users\Muhammed\Desktop\LERNEN!!!!!!!.txt
2013-12-12 15:23 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\oobe
2013-12-12 14:40 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-12-12 14:38 - 2013-12-12 14:38 - 00002778 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-12-12 14:38 - 2013-12-12 14:38 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-12-12 14:38 - 2013-12-12 14:38 - 00000000 ____D C:\Program Files\CCleaner
2013-12-12 14:38 - 2012-08-02 23:24 - 00000000 ____D C:\Windows\Panther
2013-12-12 14:37 - 2013-12-12 14:37 - 03541544 _____ (Piriform Ltd) C:\Users\Muhammed\Downloads\ccsetup408_slim.exe
2013-12-12 13:09 - 2013-11-02 18:35 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-12 13:09 - 2013-11-02 18:35 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-12 13:09 - 2013-11-02 18:35 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-12 13:05 - 2013-12-12 12:58 - 00000375 _____ C:\Users\Muhammed\Downloads\gmer.log
2013-12-12 13:04 - 2013-12-12 12:51 - 00000474 _____ C:\Users\Muhammed\Downloads\defogger_disable.log
2013-12-12 12:55 - 2013-12-12 12:55 - 00377856 _____ C:\Users\Muhammed\Downloads\e5pxbgxv.exe
2013-12-12 12:51 - 2013-12-12 12:51 - 00000000 _____ C:\Users\Muhammed\defogger_reenable
2013-12-12 12:51 - 2013-11-02 15:59 - 00000000 ____D C:\Users\Muhammed
2013-12-12 12:50 - 2013-12-12 12:50 - 00050477 _____ C:\Users\Muhammed\Downloads\Defogger.exe
2013-12-12 12:44 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\servicing
2013-12-12 12:42 - 2012-07-26 10:45 - 00000000 ____D C:\Windows\ShellNew
2013-12-12 12:42 - 2012-07-26 10:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\SysWOW64\ras
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\ras
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\L2Schemas
2013-12-12 12:42 - 2012-07-26 09:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-12 12:42 - 2012-07-26 06:38 - 00000000 ____D C:\Windows\system32\Dism
2013-12-12 12:36 - 2013-11-12 22:45 - 00000000 ____D C:\Users\Muhammed\Downloads\openvpn-extern-Win8
2013-12-12 12:35 - 2013-11-02 16:13 - 00000000 ____D C:\ProgramData\PMB Files
2013-12-12 12:35 - 2013-10-08 09:28 - 00000000 ____D C:\ProgramData\P4G
2013-12-12 12:33 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\registration
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare.url
2013-12-05 15:39 - 2013-12-05 15:39 - 00000202 _____ C:\Users\Muhammed\Desktop\Chivalry Medieval Warfare Beta.url
2013-12-04 14:27 - 2013-12-04 14:24 - 00000000 ____D C:\Program Files\OpenVPN
2013-12-04 13:13 - 2013-11-17 21:38 - 00000133 _____ C:\Users\Muhammed\Desktop\Series.txt
2013-12-04 01:53 - 2013-11-05 09:32 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-04 01:53 - 2013-11-05 09:32 - 00078304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-24 17:22 - 2013-11-24 16:11 - 00004754 _____ C:\Users\Muhammed\Documents\Kaffeeautomat.ctl
2013-11-24 16:04 - 2013-11-09 16:49 - 00000000 ____D C:\Users\Muhammed\Documents\LabVIEW Data
2013-11-23 07:43 - 2013-12-12 14:34 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-23 06:05 - 2013-12-12 14:34 - 00368640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-22 21:05 - 2013-11-05 22:41 - 00000000 ____D C:\Users\Muhammed\Documents\My Games
2013-11-22 19:09 - 2013-11-22 19:09 - 00000201 _____ C:\Users\Muhammed\Desktop\Borderlands 2.url
2013-11-22 19:09 - 2013-11-22 19:09 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2013-11-22 18:58 - 2013-11-22 18:58 - 00000530 _____ C:\Users\Public\Desktop\Steam.lnk
2013-11-22 18:57 - 2013-11-22 18:57 - 01123608 _____ C:\Users\Muhammed\Downloads\SteamSetup.exe
2013-11-20 11:00 - 2013-11-20 11:00 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\JKI
2013-11-20 09:45 - 2013-11-20 09:45 - 00001011 _____ C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2013-11-20 09:45 - 2013-11-20 09:45 - 00000000 ____D C:\Users\Muhammed\AppData\Roaming\DVDVideoSoft
2013-11-20 09:42 - 2013-11-20 09:41 - 32206488 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Muhammed\Downloads\FreeYouTubeToMP3Converter_3.12.16.1030.exe
2013-11-17 22:12 - 2012-07-26 09:12 - 00000000 ___RD C:\Windows\ToastData
2013-11-17 18:25 - 2013-11-02 21:55 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 18:24 - 2013-11-02 21:55 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\ProgramData\SetStretch.exe


Some content of TEMP:
====================
C:\Users\Muhammed\AppData\Local\Temp\avgnt.exe
C:\Users\Muhammed\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-13 11:22

==================== End Of Log ============================

--- --- ---

--- --- ---

Gruß!

schrauber · 15.12.2013, 19:40

Wir haben Adware und Kram entfernt

Flash Player updaten.

Fertig

Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

prinzcharmin · 16.12.2013, 14:04

Vielen Dank Schrauber!! Ich hatte meinen Laptop neu gekauft und war voller Sorge als ich wusste, dass er infiziert ist. Ich kann dir gar nicht sagen wie dankbar ich bin !

Hätte da noch eine Frage: Ist Google Chrome ein "sicherer" Browser? Weil du Opera und Mozilla empfiehlst.

Gruß!!

schrauber · 17.12.2013, 09:39

Joah, Firefox und IE sind sicherer

prinzcharmin · 17.12.2013, 17:38

Okay, das wars dann mit meinen Fragen, nochmals danke für die Behandlung + Beratung

Gruß!

schrauber · 18.12.2013, 10:22

Gern Geschehen

17.12.2013, 09:39	#12
schrauber /// the machine /// TB-Ausbilder	Windows 8: Rechnung.zip von vermeitlichen Telefonanbieter geöffnet und Antivir schlägt Alarm Joah, Firefox und IE sind sicherer __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

18.12.2013, 10:22	#14
schrauber /// the machine /// TB-Ausbilder	Windows 8: Rechnung.zip von vermeitlichen Telefonanbieter geöffnet und Antivir schlägt Alarm Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 8: Rechnung.zip von vermeitlichen Telefonanbieter geöffnet und Antivir schlägt Alarm

Log-Analyse und Auswertung: Windows 8: Rechnung.zip von vermeitlichen Telefonanbieter geöffnet und Antivir schlägt Alarm