![]() |
|
Log-Analyse und Auswertung: Windows 7: Webseiten werden auf Werbung umgeleitet. Pc fährt sich herunterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() Windows 7: Webseiten werden auf Werbung umgeleitet. Pc fährt sich herunter Guten Tag, ich hoffe hier kann mir jemand helfen und mich durch diese ärgerliche Situation navigieren. Folgendes Problem, ich wurde über meinen Google Chrome permanent auf Redirect.ad-feed.net geleitet, dieser Zugriff wurde dann von meinem Virenprogramm Avast blockiert. Später öffnete sich dann auch noch eine Seite wo ich mir Spyhunter 4 ziehen soll, dies tat ich allerdings nicht! Ich benutze Windows 7 64, Avast freeware und Malwarebytes Anti-Malware. Ich habe danach Avast scannen lassen und die einzigen Funde wurden mit Fehler Archiv ist Kennwortgeschüzt tituliert, danach lies ich Malwarebytes durchlaufen und diese Funde wurden gelöscht. Nun werde ich zwar nicht mehr auf andere Seiten geleitete doch Aufbau beim surfen ist total verzögert und mehrmals am laden, es fühlt sich alles sehr merkwürdig an. Das ende vom Lied ist nun dass ich einen Bluescreen bekommen hab das sich Windows nun herunterfährt um Beschädigungen zu vermeiden. Ich lass alles momentan im abgesicherten Modus mit Netzwerkverbindung. Ich wäre wirklich sehr dankbar wenn sich jemand meinem Problem annehmen könnte und ich zukünftig wieder bedenkenlos online gehen kann. Gruß Dario Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 08:10 on 23/12/2013 (Dario) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-12-2013 01 Ran by Dario (administrator) on DARIO-PC on 23-12-2013 07:29:41 Running from C:\Users\Dario\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AMD) C:\Windows\System32\atieclxx.exe () C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe () C:\Windows\SysWOW64\HsMgr.exe () C:\Windows\system\HsMgr64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6846096 2012-11-19] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation) HKLM\...\Run: [kX Mixer] - C:\Program Files\kX Audio Driver\3550\kxmixer.exe [677896 2009-09-17] (Eugene Gavrilov) HKLM\...\Run: [Cmaudio8788] - C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd HKLM\...\Run: [Cmaudio8788GX] - C:\Windows\SysWOW64\HsMgr.exe [200704 2008-07-11] () HKLM\...\Run: [Cmaudio8788GX64] - C:\Windows\system\HsMgr64.exe [282112 2008-07-11] () HKCU\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Dario\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] () HKCU\...\Run: [Remote Control Server] - C:\Program Files (x86)\Remote Control Server\Remote Control Server.exe MountPoints2: {9cd3c3ca-27b3-11e3-aca0-806e6f6e6963} - D:\Player.exe MountPoints2: {fc66464e-27af-11e3-980f-806e6f6e6963} - D:\Bin\ASSETUP.exe HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation) HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968 2013-08-30] (AVAST Software) HKLM-x32\...\Run: [PowerDVD13Agent] - "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [Razer Synapse] - C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442200 2013-10-17] (Razer Inc.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-29] (Advanced Micro Devices, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x57011A71C1BBCE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Dario\AppData\Roaming\Mozilla\Firefox\Profiles\xl82jkab.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Dario\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Plus-HD-3.8 - C:\Users\Dario\AppData\Roaming\Mozilla\Firefox\Profiles\xl82jkab.default\Extensions\c17236e8-fd66-44bc-aeef-1e00981cbb64@0a4ee0fe-5356-4fd3-b37c-5cd5671a315c.com FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF Chrome: ======= CHR HomePage: CHR DefaultSearchKeyword: google.de CHR DefaultSearchProvider: Google CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding} CHR Extension: (Google Docs) - C:\Users\Dario\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 CHR Extension: (YouTube) - C:\Users\Dario\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\Dario\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Google Wallet) - C:\Users\Dario\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 CHR Extension: (Plus-HD-3.8) - C:\Users\Dario\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofjgnhihlklpobkaloamkankaaoclfjh\1.23.19_0 CHR Extension: (Gmail) - C:\Users\Dario\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 ==================== Services (Whitelisted) ================= R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [927232 2012-10-29] () R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-11-02] () ==================== Drivers (Whitelisted) ==================== R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-21] () R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] () R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software) R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] () S3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [1257472 2009-10-19] (C-Media Inc) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation) S3 kxwdmdrv; C:\Windows\System32\drivers\kx.sys [765448 2009-09-17] (Eugene Gavrilov) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2013-10-14] (Razer Inc) S3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) S1 ArcCtrl; system32\drivers\ArcCtrl.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-12-23 07:29 - 2013-12-23 07:30 - 00012024 _____ C:\Users\Dario\Desktop\FRST.txt 2013-12-23 07:29 - 2013-12-23 07:29 - 00000000 ____D C:\FRST 2013-12-23 07:22 - 2013-12-23 07:22 - 01928280 _____ (Farbar) C:\Users\Dario\Desktop\FRST64.exe 2013-12-23 07:19 - 2013-12-23 07:19 - 00000472 _____ C:\Users\Dario\Desktop\defogger_disable.log 2013-12-23 07:19 - 2013-12-23 07:19 - 00000000 _____ C:\Users\Dario\defogger_reenable 2013-12-23 07:16 - 2013-12-23 07:16 - 00050477 _____ C:\Users\Dario\Desktop\Defogger.exe 2013-12-23 06:57 - 2013-12-23 07:29 - 00014698 _____ C:\Users\Dario\Desktop\Unbenannt 1.odt 2013-12-22 16:55 - 2013-12-22 16:56 - 00000033 _____ C:\Users\Dario\Desktop\Hijacker.txt 2013-12-20 23:54 - 2013-12-20 23:54 - 00001123 _____ C:\Users\Public\Desktop\Audiograbber.lnk 2013-12-20 23:54 - 2013-12-20 23:54 - 00000000 ____D C:\Users\Dario\AppData\Roaming\dlg 2013-12-20 23:54 - 2013-12-20 23:54 - 00000000 ____D C:\Program Files (x86)\Audiograbber 2013-12-20 23:45 - 2013-12-20 23:45 - 00419840 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00413696 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00111616 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00102400 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00000004 _____ C:\Windows\SysWOW64\('^w*dpw 2013-12-20 23:45 - 2013-12-20 23:45 - 00000000 ____D C:\Users\Dario\AppData\Roaming\ASUS 2013-12-20 23:45 - 2013-12-20 23:45 - 00000000 ____D C:\Program Files (x86)\OpenAL 2013-12-20 23:44 - 2013-12-20 23:44 - 00046237 _____ C:\Windows\Cmicnfgp.ini.cfl 2013-12-20 23:44 - 2013-12-20 23:44 - 00001006 _____ C:\Windows\Cmicnfgp.ini.imi 2013-12-20 23:44 - 2013-12-20 23:44 - 00000945 _____ C:\Windows\system\Cmicnfgp.ini 2013-12-20 23:44 - 2013-12-20 23:44 - 00000142 _____ C:\Windows\system\Dlap.pfx 2013-12-20 23:44 - 2013-12-20 23:44 - 00000000 ____D C:\Program Files\ASUS Xonar Essence STX Audio 2013-12-20 23:44 - 2013-12-20 23:44 - 00000000 ____D C:\Program Files\7-Zip 2013-12-20 23:44 - 2009-11-11 15:03 - 00792064 ____N C:\Windows\system32\Cmeauoxy.exe 2013-12-20 23:44 - 2009-10-30 10:30 - 08151040 ____N (C-Media Corporation) C:\Windows\SysWOW64\CmiCnfgp.dll 2013-12-20 23:44 - 2009-10-19 17:10 - 01257472 _____ (C-Media Inc) C:\Windows\system32\Drivers\cmudaxp.sys 2013-12-20 23:44 - 2009-09-22 20:00 - 00000486 ____N C:\Windows\cmudaxp.ini 2013-12-20 23:44 - 2009-09-03 16:03 - 00120832 ____N (C-Media Electronics Inc.) C:\Windows\system\HsSrv642.dll 2013-12-20 23:44 - 2009-09-03 16:03 - 00120832 ____N (C-Media Electronics Inc.) C:\Windows\system\HsSrv64.dll 2013-12-20 23:44 - 2009-09-03 15:56 - 00208896 ____N (C-Media Electronics Inc.) C:\Windows\SysWOW64\HsSrv2.dll 2013-12-20 23:44 - 2009-09-03 15:56 - 00208896 ____N (C-Media Electronics Inc.) C:\Windows\SysWOW64\HsSrv.dll 2013-12-20 23:44 - 2009-08-19 16:00 - 00359424 ____N C:\Windows\system32\CmiInstallResAll64.dll 2013-12-20 23:44 - 2009-04-02 16:59 - 00143360 ____N C:\Windows\SysWOW64\VmixP8.dll 2013-12-20 23:44 - 2008-11-05 14:10 - 00457728 ____N (C-Media Electronics Inc.) C:\Windows\system32\cmasiopx.dll 2013-12-20 23:44 - 2008-11-05 12:28 - 00299008 ____N (C-Media Electronics Inc.) C:\Windows\SysWOW64\cmasiop.dll 2013-12-20 23:44 - 2008-10-02 15:44 - 00005024 ____N C:\Windows\Cmicnfgp.ini.cfg 2013-12-20 23:44 - 2008-09-09 19:30 - 00000067 ____N C:\Windows\system32\cmasiopx.ini 2013-12-20 23:44 - 2008-09-09 19:30 - 00000062 ____N C:\Windows\SysWOW64\cmasiop.ini 2013-12-20 23:44 - 2008-07-23 18:59 - 00389120 ____N () C:\Windows\system32\CmiCnfgp.cpl 2013-12-20 23:44 - 2008-07-11 15:04 - 00200704 ____N C:\Windows\SysWOW64\HsMgr.exe 2013-12-20 23:44 - 2008-07-11 15:03 - 00282112 ____N C:\Windows\system\HsMgr64.exe 2013-12-20 23:44 - 2007-12-13 17:12 - 00122880 ____N (CMedia Electronics Inc.) C:\Windows\SysWOW64\Cm_Oal.dll 2013-12-20 23:44 - 2007-12-13 17:12 - 00122880 ____N (CMedia Electronics Inc.) C:\Windows\system32\Cm_Oal.dll 2013-12-20 23:44 - 2007-11-05 01:30 - 01144983 ____N C:\Windows\KB936225x64.msu 2013-12-20 23:44 - 2007-04-19 15:12 - 00032768 _____ (C-Media Electronics Inc.) C:\Windows\system32\cmudaxp.dll 2013-12-20 23:44 - 2006-10-06 05:45 - 00524768 _____ (Microsoft Corporation) C:\Windows\difxapi.dll 2013-12-20 23:44 - 2006-09-13 10:21 - 00200704 ____N (C-Media) C:\Windows\SysWOW64\Cmpaoxy.dll 2013-12-20 23:44 - 2004-04-14 11:28 - 00315392 _____ (C-Media Electronics Inc.) C:\Windows\SysWOW64\CmiFltr.dll 2013-12-20 23:44 - 2004-04-14 11:28 - 00315392 _____ (C-Media Electronics Inc.) C:\Windows\system\CmiFltr.dll 2013-12-20 23:43 - 2013-12-20 23:43 - 01376768 _____ C:\Users\Dario\Downloads\7z920-x64.msi 2013-12-20 23:42 - 2013-12-20 23:42 - 00000000 ____D C:\Users\Dario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kX Audio Driver 2013-12-20 23:41 - 2013-12-20 23:41 - 00000000 ____D C:\Program Files\kX Audio Driver 2013-12-20 23:40 - 2013-12-20 23:41 - 10704856 _____ C:\Users\Dario\Downloads\PCI_STX_091126_7_12_8_1777_W73264.rar 2013-12-20 23:39 - 2013-12-20 23:40 - 06815648 _____ C:\Users\Dario\Downloads\kxdrv3550-x64-full.exe 2013-12-20 10:16 - 2013-12-20 11:22 - 00000000 ____D C:\Program Files (x86)\Steam 2013-12-20 10:16 - 2013-12-20 10:16 - 00000963 _____ C:\Users\Public\Desktop\Steam.lnk 2013-12-20 10:14 - 2013-12-20 10:15 - 01133552 _____ C:\Users\Dario\Downloads\SteamSetup.exe 2013-12-12 03:00 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-12-12 03:00 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-12-12 03:00 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-12-12 03:00 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-12-12 03:00 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-12-12 03:00 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-12-12 03:00 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-12-12 03:00 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-12-12 03:00 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-12-12 03:00 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-12-12 03:00 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-12-12 03:00 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-12-12 03:00 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-12-12 03:00 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-12-12 03:00 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-12-12 03:00 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-12-12 03:00 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-12-12 03:00 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-12-12 03:00 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-12-12 03:00 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-12-12 03:00 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-12-12 03:00 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-12-12 03:00 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-12-12 03:00 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-12-12 03:00 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-12-12 03:00 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-12-12 03:00 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-12-12 03:00 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-12-12 03:00 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-12-12 03:00 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-12-12 03:00 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-12-11 22:54 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-12-11 22:54 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-12-11 22:54 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-12-11 22:54 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2013-12-11 22:54 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2013-12-11 22:54 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2013-12-11 22:54 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2013-12-11 22:54 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2013-12-11 22:54 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2013-12-11 22:54 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2013-12-11 22:54 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2013-12-11 22:54 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2013-12-11 22:54 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2013-12-11 22:54 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2013-12-11 22:54 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2013-12-11 20:58 - 2013-12-11 20:58 - 00007625 _____ C:\Users\Dario\AppData\Local\Resmon.ResmonCfg 2013-12-11 13:53 - 2013-12-11 14:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-12-09 14:07 - 2013-12-23 07:29 - 00023552 ___SH C:\Users\Dario\Desktop\Thumbs.db 2013-12-08 15:37 - 2013-12-08 15:37 - 00000000 ____D C:\ProgramData\Sun 2013-12-06 09:22 - 2013-12-06 09:22 - 00000000 ____D C:\Users\Dario\Documents\Kontoauszüge 2013-12-04 15:11 - 2013-12-04 15:11 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-12-04 15:11 - 2013-12-04 15:11 - 00000000 ____D C:\Users\Dario\AppData\Roaming\Malwarebytes 2013-12-04 15:11 - 2013-12-04 15:11 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-12-04 15:11 - 2013-12-04 15:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-12-04 15:11 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-12-03 23:06 - 2013-12-03 23:06 - 00000000 ____D C:\ProgramData\ATI 2013-12-03 23:05 - 2013-12-03 23:48 - 00000000 ____D C:\Users\Dario\AppData\Roaming\Raptr 2013-12-03 23:05 - 2013-12-03 23:05 - 00055445 _____ C:\Windows\SysWOW64\CCCInstall_201312032305432311.log 2013-12-03 23:05 - 2013-12-03 23:05 - 00000000 ____D C:\Program Files (x86)\AMD AVT 2013-11-29 18:59 - 2013-11-29 18:59 - 00157736 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\amdhcp64.dll 2013-11-29 18:59 - 2013-11-29 18:59 - 00142304 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\amdhcp32.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll 2013-11-29 18:55 - 2013-11-29 18:55 - 00143304 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll 2013-11-29 18:54 - 2013-11-29 18:54 - 00126336 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll 2013-11-29 18:50 - 2013-11-29 18:50 - 09764088 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll 2013-11-29 18:50 - 2013-11-29 18:50 - 08412680 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll 2013-11-29 18:39 - 2013-11-29 18:39 - 13201920 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys 2013-11-29 18:24 - 2013-11-29 18:24 - 00230912 _____ C:\Windows\system32\clinfo.exe 2013-11-29 18:24 - 2013-11-29 18:24 - 00100352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OpenVideo64.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 29363712 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 00086528 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OVDecode64.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 00083968 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OpenVideo.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OVDecode.dll 2013-11-29 18:21 - 2013-11-29 18:21 - 24846848 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll 2013-11-29 18:18 - 2013-11-29 18:18 - 00063488 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2013-11-29 18:18 - 2013-11-29 18:18 - 00057344 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2013-11-29 18:00 - 2013-11-29 18:00 - 26350592 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00547408 _____ C:\Windows\SysWOW64\atiapfxx.blb 2013-11-29 17:55 - 2013-11-29 17:55 - 00547408 _____ C:\Windows\system32\atiapfxx.blb 2013-11-29 17:55 - 2013-11-29 17:55 - 00368640 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe 2013-11-29 17:55 - 2013-11-29 17:55 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll 2013-11-29 17:54 - 2013-11-29 17:54 - 15716352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll 2013-11-29 17:51 - 2013-11-29 17:51 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll 2013-11-29 17:42 - 2013-11-29 17:42 - 22156288 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll 2013-11-29 17:35 - 2013-11-29 17:35 - 00585216 _____ (AMD) C:\Windows\system32\atieclxx.exe 2013-11-29 17:35 - 2013-11-29 17:35 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll 2013-11-29 17:35 - 2013-11-29 17:35 - 00031232 _____ (AMD) C:\Windows\system32\atimuixx.dll 2013-11-29 17:34 - 2013-11-29 17:34 - 00239616 _____ (AMD) C:\Windows\system32\atiesrxx.exe 2013-11-29 17:33 - 2013-11-29 17:33 - 00190976 _____ (AMD) C:\Windows\system32\atitmm64.dll 2013-11-29 17:22 - 2013-11-29 17:22 - 03399312 _____ C:\Windows\system32\atiumd6a.cap 2013-11-29 17:10 - 2013-11-29 17:10 - 03433360 _____ C:\Windows\SysWOW64\atiumdva.cap 2013-11-29 17:05 - 2013-11-29 17:05 - 01145344 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00825856 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00624128 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys 2013-11-29 17:04 - 2013-11-29 17:04 - 00100352 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00096768 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00074752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00096256 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdave64.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00090112 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdave32.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atisamu64.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atisamu32.dll 2013-11-29 17:00 - 2013-11-29 17:00 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll 2013-11-29 12:34 - 2013-11-29 12:34 - 00051200 _____ C:\Windows\system32\kdbsdk64.dll 2013-11-29 12:29 - 2013-11-29 12:29 - 00038912 _____ C:\Windows\SysWOW64\kdbsdk32.dll ==================== One Month Modified Files and Folders ======= 2013-12-23 07:30 - 2013-12-23 07:29 - 00012024 _____ C:\Users\Dario\Desktop\FRST.txt 2013-12-23 07:29 - 2013-12-23 07:29 - 00000000 ____D C:\FRST 2013-12-23 07:29 - 2013-12-23 06:57 - 00014698 _____ C:\Users\Dario\Desktop\Unbenannt 1.odt 2013-12-23 07:29 - 2013-12-09 14:07 - 00023552 ___SH C:\Users\Dario\Desktop\Thumbs.db 2013-12-23 07:22 - 2013-12-23 07:22 - 01928280 _____ (Farbar) C:\Users\Dario\Desktop\FRST64.exe 2013-12-23 07:19 - 2013-12-23 07:19 - 00000472 _____ C:\Users\Dario\Desktop\defogger_disable.log 2013-12-23 07:19 - 2013-12-23 07:19 - 00000000 _____ C:\Users\Dario\defogger_reenable 2013-12-23 07:19 - 2013-09-27 21:09 - 00000000 ____D C:\Users\Dario 2013-12-23 07:16 - 2013-12-23 07:16 - 00050477 _____ C:\Users\Dario\Desktop\Defogger.exe 2013-12-23 07:14 - 2013-11-10 10:00 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-12-23 07:08 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF 2013-12-23 06:54 - 2013-09-27 21:09 - 02036971 _____ C:\Windows\WindowsUpdate.log 2013-12-23 06:43 - 2013-09-27 22:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-12-23 06:39 - 2009-07-14 05:45 - 00021840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-12-23 06:39 - 2009-07-14 05:45 - 00021840 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-12-23 06:36 - 2011-04-12 08:43 - 00700130 _____ C:\Windows\system32\perfh007.dat 2013-12-23 06:36 - 2011-04-12 08:43 - 00149768 _____ C:\Windows\system32\perfc007.dat 2013-12-23 06:36 - 2009-07-14 06:13 - 01622706 _____ C:\Windows\system32\PerfStringBackup.INI 2013-12-23 06:32 - 2013-11-10 10:00 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-12-23 06:32 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-12-23 06:32 - 2009-07-14 05:51 - 00072537 _____ C:\Windows\setupact.log 2013-12-22 16:56 - 2013-12-22 16:55 - 00000033 _____ C:\Users\Dario\Desktop\Hijacker.txt 2013-12-22 16:35 - 2010-11-21 04:47 - 00027016 _____ C:\Windows\PFRO.log 2013-12-22 12:27 - 2013-09-27 21:47 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update 2013-12-21 05:00 - 2013-10-11 18:47 - 00000000 ____D C:\Users\Dario\AppData\Roaming\Spotify 2013-12-21 03:39 - 2013-09-27 21:58 - 00000000 ____D C:\Users\Dario\AppData\Roaming\vlc 2013-12-21 02:03 - 2013-09-27 21:33 - 00000000 ____D C:\Program Files (x86)\Origin 2013-12-20 23:55 - 2013-09-27 21:09 - 00000000 ____D C:\Users\Dario\AppData\Local\VirtualStore 2013-12-20 23:54 - 2013-12-20 23:54 - 00001123 _____ C:\Users\Public\Desktop\Audiograbber.lnk 2013-12-20 23:54 - 2013-12-20 23:54 - 00000000 ____D C:\Users\Dario\AppData\Roaming\dlg 2013-12-20 23:54 - 2013-12-20 23:54 - 00000000 ____D C:\Program Files (x86)\Audiograbber 2013-12-20 23:45 - 2013-12-20 23:45 - 00419840 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00413696 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00111616 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00102400 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll 2013-12-20 23:45 - 2013-12-20 23:45 - 00000004 _____ C:\Windows\SysWOW64\('^w*dpw 2013-12-20 23:45 - 2013-12-20 23:45 - 00000000 ____D C:\Users\Dario\AppData\Roaming\ASUS 2013-12-20 23:45 - 2013-12-20 23:45 - 00000000 ____D C:\Program Files (x86)\OpenAL 2013-12-20 23:45 - 2013-09-27 21:20 - 00064952 _____ C:\Users\Dario\AppData\Local\GDIPFONTCACHEV1.DAT 2013-12-20 23:45 - 2009-07-14 05:45 - 00320992 _____ C:\Windows\system32\FNTCACHE.DAT 2013-12-20 23:44 - 2013-12-20 23:44 - 00046237 _____ C:\Windows\Cmicnfgp.ini.cfl 2013-12-20 23:44 - 2013-12-20 23:44 - 00001006 _____ C:\Windows\Cmicnfgp.ini.imi 2013-12-20 23:44 - 2013-12-20 23:44 - 00000945 _____ C:\Windows\system\Cmicnfgp.ini 2013-12-20 23:44 - 2013-12-20 23:44 - 00000142 _____ C:\Windows\system\Dlap.pfx 2013-12-20 23:44 - 2013-12-20 23:44 - 00000000 ____D C:\Program Files\ASUS Xonar Essence STX Audio 2013-12-20 23:44 - 2013-12-20 23:44 - 00000000 ____D C:\Program Files\7-Zip 2013-12-20 23:44 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system 2013-12-20 23:43 - 2013-12-20 23:43 - 01376768 _____ C:\Users\Dario\Downloads\7z920-x64.msi 2013-12-20 23:42 - 2013-12-20 23:42 - 00000000 ____D C:\Users\Dario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\kX Audio Driver 2013-12-20 23:41 - 2013-12-20 23:41 - 00000000 ____D C:\Program Files\kX Audio Driver 2013-12-20 23:41 - 2013-12-20 23:40 - 10704856 _____ C:\Users\Dario\Downloads\PCI_STX_091126_7_12_8_1777_W73264.rar 2013-12-20 23:40 - 2013-12-20 23:39 - 06815648 _____ C:\Users\Dario\Downloads\kxdrv3550-x64-full.exe 2013-12-20 11:22 - 2013-12-20 10:16 - 00000000 ____D C:\Program Files (x86)\Steam 2013-12-20 10:16 - 2013-12-20 10:16 - 00000963 _____ C:\Users\Public\Desktop\Steam.lnk 2013-12-20 10:15 - 2013-12-20 10:14 - 01133552 _____ C:\Users\Dario\Downloads\SteamSetup.exe 2013-12-19 19:48 - 2013-10-11 18:48 - 00000000 ____D C:\Users\Dario\AppData\Local\Spotify 2013-12-19 00:34 - 2013-09-27 21:58 - 00000000 ____D C:\Users\Dario\AppData\Roaming\TS3Client 2013-12-19 00:01 - 2013-09-28 00:13 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe 2013-12-18 23:43 - 2013-09-28 00:13 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0 2013-12-15 09:53 - 2013-10-01 17:30 - 00000000 ____D C:\Windows\system32\MRT 2013-12-15 09:52 - 2013-09-28 16:45 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-12-12 03:41 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-12-12 03:16 - 2013-09-27 21:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-12-11 20:58 - 2013-12-11 20:58 - 00007625 _____ C:\Users\Dario\AppData\Local\Resmon.ResmonCfg 2013-12-11 14:40 - 2013-12-11 13:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-12-10 20:52 - 2013-09-27 22:00 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-12-10 20:52 - 2013-09-27 22:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-12-10 20:52 - 2013-09-27 22:00 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-12-08 23:03 - 2013-09-28 16:19 - 00000000 ____D C:\ProgramData\CyberLink 2013-12-08 23:03 - 2013-09-27 21:16 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-12-08 15:37 - 2013-12-08 15:37 - 00000000 ____D C:\ProgramData\Sun 2013-12-08 15:37 - 2013-11-21 23:45 - 00000000 ____D C:\ProgramData\Oracle 2013-12-07 11:11 - 2013-11-11 15:19 - 00000000 ____D C:\Users\Dario\AppData\Local\Splashtop 2013-12-07 11:11 - 2013-11-11 15:18 - 00000000 ____D C:\ProgramData\Splashtop 2013-12-06 23:09 - 2013-11-10 10:00 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-12-06 23:09 - 2013-11-10 10:00 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-12-06 09:22 - 2013-12-06 09:22 - 00000000 ____D C:\Users\Dario\Documents\Kontoauszüge 2013-12-04 15:11 - 2013-12-04 15:11 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-12-04 15:11 - 2013-12-04 15:11 - 00000000 ____D C:\Users\Dario\AppData\Roaming\Malwarebytes 2013-12-04 15:11 - 2013-12-04 15:11 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-12-04 15:11 - 2013-12-04 15:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-12-03 23:48 - 2013-12-03 23:05 - 00000000 ____D C:\Users\Dario\AppData\Roaming\Raptr 2013-12-03 23:48 - 2013-11-09 01:59 - 00000000 ____D C:\Program Files (x86)\Raptr 2013-12-03 23:48 - 2013-09-27 21:33 - 00000000 ____D C:\Program Files (x86)\Origin Games 2013-12-03 23:06 - 2013-12-03 23:06 - 00000000 ____D C:\ProgramData\ATI 2013-12-03 23:05 - 2013-12-03 23:05 - 00055445 _____ C:\Windows\SysWOW64\CCCInstall_201312032305432311.log 2013-12-03 23:05 - 2013-12-03 23:05 - 00000000 ____D C:\Program Files (x86)\AMD AVT 2013-12-03 23:05 - 2013-09-27 22:28 - 00000000 ____D C:\ProgramData\AMD 2013-12-03 23:05 - 2013-09-27 22:24 - 00000000 ____D C:\Program Files\ATI Technologies 2013-12-03 23:04 - 2013-09-27 21:20 - 01596050 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2013-12-03 23:02 - 2013-09-27 22:23 - 00000000 ____D C:\AMD 2013-11-29 18:59 - 2013-11-29 18:59 - 00157736 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\amdhcp64.dll 2013-11-29 18:59 - 2013-11-29 18:59 - 00142304 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\amdhcp32.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll 2013-11-29 18:58 - 2013-11-29 18:58 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll 2013-11-29 18:55 - 2013-11-29 18:55 - 00143304 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll 2013-11-29 18:54 - 2013-11-29 18:54 - 00126336 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll 2013-11-29 18:53 - 2013-11-07 18:39 - 00115512 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll 2013-11-29 18:53 - 2013-09-21 10:45 - 00098496 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll 2013-11-29 18:52 - 2013-11-07 18:39 - 01319064 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll 2013-11-29 18:51 - 2013-08-31 01:13 - 01100728 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll 2013-11-29 18:50 - 2013-11-29 18:50 - 09764088 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll 2013-11-29 18:50 - 2013-11-29 18:50 - 08412680 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll 2013-11-29 18:49 - 2013-09-21 10:44 - 08287008 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll 2013-11-29 18:48 - 2013-09-21 10:44 - 06630232 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll 2013-11-29 18:47 - 2013-11-07 18:39 - 08927704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll 2013-11-29 18:46 - 2013-11-07 18:39 - 07751920 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll 2013-11-29 18:39 - 2013-11-29 18:39 - 13201920 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys 2013-11-29 18:24 - 2013-11-29 18:24 - 00230912 _____ C:\Windows\system32\clinfo.exe 2013-11-29 18:24 - 2013-11-29 18:24 - 00100352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OpenVideo64.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 29363712 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 00086528 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OVDecode64.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 00083968 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OpenVideo.dll 2013-11-29 18:23 - 2013-11-29 18:23 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OVDecode.dll 2013-11-29 18:21 - 2013-11-29 18:21 - 24846848 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll 2013-11-29 18:18 - 2013-11-29 18:18 - 00063488 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2013-11-29 18:18 - 2013-11-29 18:18 - 00057344 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2013-11-29 18:13 - 2013-11-07 18:02 - 00129536 _____ (AMD) C:\Windows\system32\coinst_13.25.18.dll 2013-11-29 18:00 - 2013-11-29 18:00 - 26350592 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00547408 _____ C:\Windows\SysWOW64\atiapfxx.blb 2013-11-29 17:55 - 2013-11-29 17:55 - 00547408 _____ C:\Windows\system32\atiapfxx.blb 2013-11-29 17:55 - 2013-11-29 17:55 - 00368640 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe 2013-11-29 17:55 - 2013-11-29 17:55 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll 2013-11-29 17:55 - 2013-11-29 17:55 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll 2013-11-29 17:54 - 2013-11-29 17:54 - 15716352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll 2013-11-29 17:51 - 2013-11-29 17:51 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll 2013-11-29 17:42 - 2013-11-29 17:42 - 22156288 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll 2013-11-29 17:35 - 2013-11-29 17:35 - 00585216 _____ (AMD) C:\Windows\system32\atieclxx.exe 2013-11-29 17:35 - 2013-11-29 17:35 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll 2013-11-29 17:35 - 2013-11-29 17:35 - 00031232 _____ (AMD) C:\Windows\system32\atimuixx.dll 2013-11-29 17:34 - 2013-11-29 17:34 - 00239616 _____ (AMD) C:\Windows\system32\atiesrxx.exe 2013-11-29 17:33 - 2013-11-29 17:33 - 00190976 _____ (AMD) C:\Windows\system32\atitmm64.dll 2013-11-29 17:22 - 2013-11-29 17:22 - 03399312 _____ C:\Windows\system32\atiumd6a.cap 2013-11-29 17:10 - 2013-11-29 17:10 - 03433360 _____ C:\Windows\SysWOW64\atiumdva.cap 2013-11-29 17:05 - 2013-11-29 17:05 - 01145344 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00825856 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00624128 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys 2013-11-29 17:04 - 2013-11-29 17:04 - 00100352 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00096768 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00074752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll 2013-11-29 17:04 - 2013-11-29 17:04 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00096256 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdave64.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00090112 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdave32.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atisamu64.dll 2013-11-29 17:02 - 2013-11-29 17:02 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atisamu32.dll 2013-11-29 17:00 - 2013-11-29 17:00 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll 2013-11-29 12:34 - 2013-11-29 12:34 - 00051200 _____ C:\Windows\system32\kdbsdk64.dll 2013-11-29 12:29 - 2013-11-29 12:29 - 00038912 _____ C:\Windows\SysWOW64\kdbsdk32.dll 2013-11-28 19:59 - 2013-09-28 00:01 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins 2013-11-27 01:07 - 2013-10-04 19:14 - 00000000 ____D C:\Program Files (x86)\World of Warcraft 2013-11-26 12:54 - 2013-12-12 03:00 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-26 11:19 - 2013-12-12 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-26 11:18 - 2013-12-12 03:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-26 11:11 - 2013-12-12 03:00 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-26 10:48 - 2013-12-12 03:00 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-26 10:46 - 2013-12-12 03:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-26 10:41 - 2013-12-12 03:00 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-26 10:29 - 2013-12-12 03:00 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-26 10:27 - 2013-12-12 03:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-26 10:23 - 2013-12-12 03:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-26 10:21 - 2013-12-12 03:00 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-26 10:18 - 2013-12-12 03:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-26 10:18 - 2013-12-12 03:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-26 10:16 - 2013-12-12 03:00 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-26 09:57 - 2013-12-12 03:00 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-26 09:38 - 2013-12-12 03:00 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-26 09:38 - 2013-12-12 03:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-26 09:35 - 2013-12-12 03:00 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-26 09:32 - 2013-12-12 03:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-26 09:28 - 2013-12-12 03:00 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2013-11-26 09:16 - 2013-12-12 03:00 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-26 09:02 - 2013-12-12 03:00 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-26 08:48 - 2013-12-12 03:00 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-26 08:32 - 2013-12-12 03:00 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-11-26 08:26 - 2013-12-12 03:00 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-26 08:07 - 2013-12-12 03:00 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-26 07:40 - 2013-12-12 03:00 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-26 07:34 - 2013-12-12 03:00 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-26 07:34 - 2013-12-12 03:00 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-11-26 07:33 - 2013-12-12 03:00 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-26 07:27 - 2013-12-12 03:00 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll Some content of TEMP: ==================== C:\Users\Dario\AppData\Local\Temp\COMAP.EXE C:\Users\Dario\AppData\Local\Temp\fp_pl_pfs_installer.exe C:\Users\Dario\AppData\Local\Temp\installerdll148044.dll C:\Users\Dario\AppData\Local\Temp\installerdll175641.dll C:\Users\Dario\AppData\Local\Temp\install_reader11_de_mssd_aaa_aih.exe C:\Users\Dario\AppData\Local\Temp\raptrpatch.exe C:\Users\Dario\AppData\Local\Temp\raptr_stub.exe C:\Users\Dario\AppData\Local\Temp\rootsupd.exe C:\Users\Dario\AppData\Local\Temp\Setup.exe C:\Users\Dario\AppData\Local\Temp\sonarinst.exe C:\Users\Dario\AppData\Local\Temp\vcredist_x64.exe C:\Users\Dario\AppData\Local\Temp\vcredist_x86.exe C:\Users\Dario\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe C:\Users\Dario\AppData\Local\Temp\x2blapi.dll C:\Users\Dario\AppData\Local\Temp\_is3439.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-20 00:02 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-12-2013 01 Ran by Dario at 2013-12-23 07:31:01 Running from C:\Users\Dario\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C} AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 7-Zip 9.20 (x64 edition) (Version: 9.20.00.0) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170) Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05) Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18) AMD Accelerated Video Transcoding (Version: 13.20.100.31129) AMD Catalyst Control Center (x32 Version: 2013.1129.1143.20969) AMD Catalyst Install Manager (Version: 8.0.915.0) AMD Drag and Drop Transcoding (Version: 2.00.0000) AMD Media Foundation Decoders (Version: 1.0.81129.1203) AMD Wireless Display v3.0 (Version: 1.0.0.14) ASUS Xonar Essence STX Audio Driver Audiograbber 1.83 SE (x32 Version: 1.83 SE ) avast! Free Antivirus (x32 Version: 8.0.1497.0) Battlefield 4™ (x32 Version: 1.0.0.1) Battlefield 4™ Beta (x32 Version: 1.0.0.0) Battlelog Web Plugins (x32 Version: 2.3.2) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1129.1143.20969) Catalyst Control Center InstallProxy (x32 Version: 2013.1129.1143.20969) Catalyst Control Center Localization All (x32 Version: 2013.1129.1143.20969) CCC Help Chinese Standard (x32 Version: 2013.1129.1142.20969) CCC Help Chinese Traditional (x32 Version: 2013.1129.1142.20969) CCC Help Czech (x32 Version: 2013.1129.1142.20969) CCC Help Danish (x32 Version: 2013.1129.1142.20969) CCC Help Dutch (x32 Version: 2013.1129.1142.20969) CCC Help English (x32 Version: 2013.1129.1142.20969) CCC Help Finnish (x32 Version: 2013.1129.1142.20969) CCC Help French (x32 Version: 2013.1129.1142.20969) CCC Help German (x32 Version: 2013.1129.1142.20969) CCC Help Greek (x32 Version: 2013.1129.1142.20969) CCC Help Hungarian (x32 Version: 2013.1129.1142.20969) CCC Help Italian (x32 Version: 2013.1129.1142.20969) CCC Help Japanese (x32 Version: 2013.1129.1142.20969) CCC Help Korean (x32 Version: 2013.1129.1142.20969) CCC Help Norwegian (x32 Version: 2013.1129.1142.20969) CCC Help Polish (x32 Version: 2013.1129.1142.20969) CCC Help Portuguese (x32 Version: 2013.1129.1142.20969) CCC Help Russian (x32 Version: 2013.1129.1142.20969) CCC Help Spanish (x32 Version: 2013.1129.1142.20969) CCC Help Swedish (x32 Version: 2013.1129.1142.20969) CCC Help Thai (x32 Version: 2013.1129.1142.20969) CCC Help Turkish (x32 Version: 2013.1129.1142.20969) ccc-utility64 (Version: 2013.1129.1143.20969) ESN Sonar (x32 Version: 0.70.4) Google Chrome (x32 Version: 31.0.1650.63) Google Update Helper (x32 Version: 1.3.22.3) Intel(R) Management Engine Components (x32 Version: 9.0.0.1323) Intel(R) Rapid Storage Technology (Version: 12.0.0.1083) Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 2.5.0.19) Intel® Trusted Connect Service Client (Version: 1.27.798.1) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft .NET Framework 4.5 (Version: 4.5.50709) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610) Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727) Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610) Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727) Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610) Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0) Mozilla Maintenance Service (x32 Version: 24.2.0) Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0) OpenAL (x32) OpenOffice 4.0.1 (x32 Version: 4.01.9714) Origin (x32 Version: 9.2.1.4399) PunkBuster Services (x32 Version: 0.993) Razer Synapse 2.0 (x32 Version: 1.15.4) Realtek Ethernet Controller Driver (x32 Version: 7.67.1226.2012) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6782) Skype™ 6.9 (x32 Version: 6.9.106) Splashtop Software Updater (x32 Version: 1.5.6.14) Splashtop Streamer (x32 Version: 2.4.5.2) Spotify (HKCU Version: 0.9.6.81.gd359a796) Steam (x32) TeamSpeak 3 Client (Version: 3.0.13.1) Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1) Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1) Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1) VLC media player 2.1.0 (x32 Version: 2.1.0) World of Warcraft (x32) ==================== Restore Points ========================= 11-12-2013 21:53:31 Windows Update 12-12-2013 02:00:22 Windows Update 15-12-2013 08:52:30 Windows Update 20-12-2013 22:40:05 Windows Update 20-12-2013 22:41:32 Gerätetreiber-Paketinstallation: Eugene Gavrilov Audio-, Video- und Gamecontroller 20-12-2013 22:43:46 Installed 7-Zip 9.20 (x64 edition) 20-12-2013 22:44:43 Gerätetreiber-Paketinstallation: ASUSTeK Audio-, Video- und Gamecontroller ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {5614B73F-FCE1-4A58-ADA5-2044A925A3A7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated) Task: {D9A91528-CCF3-4CD5-B3E5-89C3E301923F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-10] (Google Inc.) Task: {DB4802EE-D475-4E6C-B628-062A5EDFC67C} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software) Task: {F89EECDB-D380-461C-B8F8-4E890360DF0D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-10] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2013-12-23 06:54 - 2013-12-22 17:59 - 02246144 _____ () C:\Program Files\AVAST Software\Avast\defs\13122201\algo.dll 2013-09-27 21:12 - 2013-12-23 06:32 - 00025600 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\PEbiosinterface32.dll 2013-09-27 21:12 - 2012-05-07 17:04 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.01\ATKEX.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (12/23/2013 06:34:19 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/22/2013 04:37:45 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/22/2013 00:28:36 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/20/2013 11:47:23 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/20/2013 11:44:08 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/20/2013 11:36:23 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/19/2013 07:46:41 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2013 07:54:37 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2013 09:51:18 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/16/2013 06:17:19 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (12/23/2013 07:29:20 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:22:43 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:21:55 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:21:42 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:21:38 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:21:23 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:21:18 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:20:12 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:20:09 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Error: (12/23/2013 07:20:08 AM) (Source: DCOM) (User: Dario-PC) Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Dario-PCDarioS-1-5-21-430033498-3639492437-679756840-1000LocalHost (unter Verwendung von LRPC) Microsoft Office Sessions: ========================= Error: (12/23/2013 06:34:19 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/22/2013 04:37:45 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/22/2013 00:28:36 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/20/2013 11:47:23 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/20/2013 11:44:08 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/20/2013 11:36:23 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/19/2013 07:46:41 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2013 07:54:37 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/17/2013 09:51:18 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/16/2013 06:17:19 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2013-09-28 17:45:24.830 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.798 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.740 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.675 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.625 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.589 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.558 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.511 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.439 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-09-28 17:45:24.371 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 10% Total physical RAM: 16322.26 MB Available physical RAM: 14569.6 MB Total Pagefile: 32642.7 MB Available Pagefile: 30752.16 MB Total Virtual: 8192 MB Available Virtual: 8191.79 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:232.79 GB) (Free:123.46 GB) NTFS Drive f: (Hotel) (Fixed) (Total:1863.01 GB) (Free:1855.64 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: E7BDFE66) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 6E1BD8BE) Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.16.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Dario :: DARIO-PC [Administrator] 22.12.2013 12:52:48 mbam-log-2013-12-22 (12-52-48).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 325633 Laufzeit: 22 Minute(n), 40 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 13 HKCR\CrossriderApp0039030.BHO (PUP.Optional.CrossRider) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0039030.Sandbox.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0039030.Sandbox (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{44444444-4444-4444-4444-440344904430} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{55555555-5555-5555-5555-550355905530} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{11111111-1111-1111-1111-110311901130} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110311901130} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311901130} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0039030.BHO.1 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311901130} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstalledBrowserExtensions\Plus HD (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Plus-HD-3.8 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-3.8 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Program Files (x86)\Plus-HD-3.8 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 26 C:\Users\Dario\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QKLEWXK6\plus-hd-3-8[1].exe (PUP.Optional.CrossRider) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-bg.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-buttonutil.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-buttonutil64.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-bho.dll (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-enabler.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-firefoxinstaller.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-updater.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\utils.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Temp\39030_updater.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-3.8-chromeinstaller.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-3.8-enabler.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-3.8-firefoxinstaller.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-3.8-updater.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-chromeinstaller.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-codedownloader.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\39030.crx (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\39030.xpi (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\background.html (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Installer.log (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-buttonutil.dll (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-buttonutil64.dll (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-helper.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8.ico (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-3.8\Uninstall.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
Themen zu Windows 7: Webseiten werden auf Werbung umgeleitet. Pc fährt sich herunter |
antivirus, bluescreen, branding, browser, defender, flash player, google, install.exe, installation, mozilla, programm, pup.optional.crossrider, pup.optional.crossrider.a, pup.optional.plushd.a, remote control, rundll, services.exe, software, svchost.exe, system, vcredist, webseiten werden auf werbung umgeleitet., windows |