| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: HiddenObject.Multi.Generic und PC verhält sich merkwürdigWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
25.12.2013, 18:43
| #1 |
 |  HiddenObject.Multi.Generic und PC verhält sich merkwürdig Guten Tag, ich habe einen alltäglichen Suchlauf mit Kaspersky gemacht und das Programm hat mir dann eine Bedrohung angezeigt und zwar diese: ads-in-clientCAQ213L4.js Nicht desinfizierte Objekte: HiddenObject.Multi.Generic 25.12.2013 17:22:46 c:\Documents and Settings\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50L7JD41\ Zurückgestellt Untersuchung des Computers ads-in-clientCAQ213L4.js Gefunden: HiddenObject.Multi.Generic 25.12.2013 17:22:46 c:\Documents and Settings\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50L7JD41\ Protokolliert Untersuchung des Computers Ich habe auch Boot probleme mit Windows gehabt, das beim Hochfahren die Meldung kommt, "windows lädt dateien" und der Ladebalken. PC konnte nicht gestartet werden ohne die Reperatur (welche nichts repariert hat). Heute den PC angemacht und windows explorer ist nach der Kennwort eingabe abgestürtzt, etc. Bekomme zahlreiche Bluescreens und ich weis nicht mehr was ich machen kann. Ich lasse gerade noch einen Full-Scan mit MBAM machen und dort wird mir auch schon ein infiziertes Objekt angezeigt. Ich habe keine Ahnung wo die Sachen herkommen, ich habe mir vorgestern Oblivion gekauft und ein paar Mods dazu heruntergeladen, diese aber alle wieder deinstalliert + das Spiel auch weil es nicht so ging wie ich es wollte. Daten wurden von der Offizielen Mod-Seite heruntergeladen. Ich surfe abundzu auf reddit umher und das warsdann auch. Ich besuche keine pornografischen websites bzw. streaming websites etc. EDIT: der MBAM-Log Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.23.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16750 alex :: ALEX-PC [Administrator] 25.12.2013 18:06:15 MBAM-log-2013-12-25 (18-25-37).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 394378 Laufzeit: 19 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2E55JHTF\PFPortChecker3Offers_8007[1].exe (PUP.Optional.InstallMonetizer.A) -> Keine Aktion durchgeführt. (Ende) FRST-Log: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-12-2013
Ran by alex (administrator) on ALEX-PC on 25-12-2013 18:40:36
Running from C:\Users\alex\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel(R) Corporation) C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-29] (NVIDIA Corporation)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @t.garena.com/garenatalk - C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Flashblock - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
FF Extension: WOT - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: NoScript - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: CookieCuller - C:\Users\alex\AppData\Roaming\Mozilla\Firefox\Profiles\l3fiemti.default\Extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}.xpi
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
Chrome:
=======
CHR DefaultSearchProvider: Delta Search
CHR Plugin: (Shockwave Flash) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\alex\AppData\Local\Google\Chrome\Application\27.0.1453.94\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Google Update) - C:\Users\alex\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Raidcall plugin) - C:\Users\alex\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Docs) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Safe Money) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Gmail) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\alex\AppData\LocalLow\proxtube\CHROME\proxtube.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-29] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-29] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-11-09] ()
R2 XTU3SERVICE; C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe [15888 2013-02-11] (Intel(R) Corporation)
==================== Drivers (Whitelisted) ====================
R3 AcpiCtlDrv; C:\Windows\System32\DRIVERS\AcpiCtlDrv.sys [25880 2012-07-17] (Intel Corporation)
S3 bulkadi; C:\Windows\System32\DRIVERS\bulkrazer_x64.sys [25088 2011-02-09] (Windows (R) Codename Longhorn DDK provider)
S3 EfiVariable; C:\Windows\SysWOW64\Drivers\variable64.sys [18200 2010-10-28] (Windows (R) Server 2003 DDK provider)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [29672 2013-01-19] (REALiX(tm))
R2 iocbios2; C:\Program Files (x86)\Intel\Extreme Tuning Utility\Drivers\IocDriver\64bit\iocbios2.sys [25448 2013-01-07] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-10-10] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-24] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-24] (Kaspersky Lab ZAO)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-10-30] (NVIDIA Corporation)
R3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-01-23] ()
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [22016 2012-09-18] (Razer USA Ltd)
S3 ALSysIO; \??\C:\Users\alex\AppData\Local\Temp\ALSysIO64.sys [x]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [x]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-07-24] (Kaspersky Lab ZAO)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-25 18:39 - 2013-12-25 18:40 - 00019289 _____ C:\Users\alex\Downloads\FRST.txt
2013-12-25 18:39 - 2013-12-25 18:39 - 00000470 _____ C:\Users\alex\Downloads\defogger_disable.log
2013-12-25 18:38 - 2013-12-25 18:38 - 01928716 _____ (Farbar) C:\Users\alex\Downloads\FRST64.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00377856 _____ C:\Users\alex\Downloads\gmer_2.1.19163.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00050477 _____ C:\Users\alex\Downloads\Defogger.exe
2013-12-23 22:20 - 2013-12-23 22:20 - 00000088 _____ C:\Windows\TweakOblivion.ini
2013-12-23 00:36 - 2013-12-24 01:19 - 00000023 _____ C:\Windows\BlendSettings.ini
2013-12-23 00:35 - 2013-12-23 22:20 - 00000000 ____D C:\Users\alex\AppData\Local\Oblivion
2013-12-22 11:41 - 2013-12-22 11:41 - 00000000 ____D C:\Users\alex\Desktop\file_61324072787_3470_0
2013-12-20 12:27 - 2013-12-20 12:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 00:36 - 2013-12-19 00:36 - 01958098 _____ C:\Users\alex\Downloads\2560x1080 NSFW - Imgur.zip
2013-12-18 09:27 - 2013-12-18 09:33 - 19545912 _____ C:\Users\alex\Downloads\MSIAfterburnerSetup300Beta15.zip
2013-12-16 13:34 - 2013-12-16 13:34 - 09819638 _____ C:\Users\alex\Downloads\Daniella Lanio - Imgur.zip
2013-12-16 13:31 - 2013-12-16 13:31 - 04640400 _____ C:\Users\alex\Downloads\ParisRoxanne - Imgur.zip
2013-12-15 00:30 - 2013-12-15 00:30 - 00000000 ____D C:\Users\alex\AppData\Local\Blizzard
2013-12-15 00:19 - 2013-12-15 01:32 - 00000000 ____D C:\Users\alex\AppData\Local\Battle.net
2013-12-15 00:19 - 2013-12-15 00:37 - 00000000 ____D C:\Users\alex\AppData\Roaming\Battle.net
2013-12-15 00:19 - 2013-12-15 00:19 - 00001150 _____ C:\Users\Public\Desktop\Battle.net.lnk
2013-12-15 00:19 - 2013-12-15 00:19 - 00000000 ____D C:\Program Files (x86)\Battle.net
2013-12-12 15:01 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 15:01 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 15:01 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 15:01 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-12 15:00 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 15:00 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 15:00 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-12 15:00 - 2013-10-25 07:17 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-12 15:00 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-12 15:00 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-12 15:00 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-12 15:00 - 2013-10-25 05:43 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-12 15:00 - 2013-10-25 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-12 15:00 - 2013-10-25 04:41 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-12 15:00 - 2013-10-25 04:17 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-12 15:00 - 2013-10-25 03:49 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-12 01:35 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-12 01:35 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-12 01:35 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-12 01:35 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-12 01:35 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-12 01:35 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-12 01:35 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-12 01:35 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-12 01:35 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-12 01:35 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-12 01:35 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-12 01:35 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-12 01:35 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-12 01:35 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-12 01:35 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-12 01:35 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-12 01:35 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-12 01:35 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-12 01:35 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-10 04:59 - 2013-12-10 04:59 - 05055530 _____ C:\Users\alex\Downloads\Non-Nude Sexy Wallpapers - Imgur.zip
2013-12-09 02:11 - 2013-12-09 02:12 - 36773854 _____ C:\Users\alex\Downloads\Randoms - Imgur.zip
2013-12-08 12:08 - 2013-12-08 12:08 - 02017033 _____ C:\Users\alex\Downloads\Emma Glover - Imgur.zip
2013-12-07 20:41 - 2013-12-07 20:41 - 08868299 _____ C:\Users\alex\Desktop\CBS.7z
2013-12-07 20:41 - 2013-12-07 20:41 - 00000000 ____D C:\Users\alex\Desktop\CBS
2013-12-07 02:13 - 2013-12-07 02:13 - 00000000 ____D C:\Users\alex\Downloads\The Ass Gallery - Imgur
2013-12-06 21:59 - 2013-12-06 21:59 - 00128916 _____ C:\Users\alex\Desktop\Fehler1&2.7z
2013-12-06 08:03 - 2013-12-23 23:53 - 00000000 ____D C:\Users\alex\AppData\Roaming\Dropbox
2013-12-04 23:33 - 2013-12-04 23:33 - 00000000 ____D C:\Windows\CheckSur
2013-12-04 11:58 - 2013-12-04 11:58 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-12-04 11:47 - 2013-12-04 11:47 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ALEX-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-12-04 11:47 - 2013-12-04 11:47 - 00000000 ____D C:\RegBackup
2013-12-04 11:29 - 2013-12-04 14:23 - 00000134 _____ C:\Users\alex\Desktop\Internet Explorer-Problembehebung.url
2013-12-03 23:35 - 2013-12-03 23:35 - 00000825 _____ C:\Users\alex\Desktop\JRT.txt
2013-12-03 22:44 - 2013-12-03 22:56 - 00000000 ____D C:\Users\alex\Desktop\mbar
2013-12-03 22:44 - 2013-12-03 22:44 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-03 15:54 - 2013-12-04 19:06 - 00000000 ____D C:\Users\alex\Desktop\FRST
2013-12-03 06:40 - 2013-10-30 18:03 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-12-03 06:40 - 2013-10-30 18:02 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-12-03 01:28 - 2013-12-03 01:28 - 12999313 _____ C:\Users\alex\Downloads\Casey Connelly - Imgur.zip
2013-12-02 07:19 - 2013-12-02 07:19 - 16422740 _____ C:\Users\alex\Downloads\realbarbielifts - Imgur(1).zip
2013-12-02 06:29 - 2013-12-02 06:29 - 02520182 _____ C:\Users\alex\Downloads\Album 4HhzQ - Imgur.zip
2013-12-02 03:42 - 2013-12-02 03:42 - 01371376 _____ C:\Users\alex\Downloads\faucheer - Imgur.zip
2013-12-01 21:38 - 2013-12-01 21:38 - 00000000 ____D C:\Users\alex\AppData\Local\Ascaron Entertainment
2013-11-29 00:55 - 2013-11-29 00:55 - 01327845 _____ C:\Users\alex\Downloads\body so tight - Imgur.zip
2013-11-28 17:03 - 2013-11-28 17:04 - 242396304 _____ C:\Users\alex\Desktop\Jon Bellion - Jim Morrison.avi
2013-11-26 02:52 - 2013-12-25 01:04 - 00405186 _____ C:\Windows\IE11_main.log
==================== One Month Modified Files and Folders =======
2013-12-25 18:40 - 2013-12-25 18:39 - 00019289 _____ C:\Users\alex\Downloads\FRST.txt
2013-12-25 18:39 - 2013-12-25 18:39 - 00000470 _____ C:\Users\alex\Downloads\defogger_disable.log
2013-12-25 18:38 - 2013-12-25 18:38 - 01928716 _____ (Farbar) C:\Users\alex\Downloads\FRST64.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00377856 _____ C:\Users\alex\Downloads\gmer_2.1.19163.exe
2013-12-25 18:38 - 2013-12-25 18:38 - 00050477 _____ C:\Users\alex\Downloads\Defogger.exe
2013-12-25 18:38 - 2012-08-29 14:13 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-12-25 18:31 - 2012-11-25 18:01 - 00000000 ____D C:\Program Files (x86)\HP
2013-12-25 18:31 - 2012-10-22 13:58 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-25 18:30 - 2013-07-24 06:51 - 00000000 ____D C:\Program Files (x86)\Diablo II
2013-12-25 18:22 - 2012-06-02 02:35 - 00000000 ____D C:\Users\alex\AppData\Roaming\Skype
2013-12-25 18:00 - 2012-05-18 20:22 - 01310036 _____ C:\Windows\WindowsUpdate.log
2013-12-25 17:04 - 2012-05-18 20:36 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-25 16:26 - 2009-07-14 05:45 - 00021856 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-25 16:26 - 2009-07-14 05:45 - 00021856 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-25 16:25 - 2011-04-12 08:43 - 00685600 _____ C:\Windows\system32\perfh007.dat
2013-12-25 16:25 - 2011-04-12 08:43 - 00145432 _____ C:\Windows\system32\perfc007.dat
2013-12-25 16:25 - 2009-07-14 06:13 - 01620812 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-25 16:21 - 2013-10-17 23:25 - 00003018 _____ C:\Windows\System32\Tasks\MSIAfterburner
2013-12-25 16:21 - 2013-09-09 05:17 - 00030358 _____ C:\Windows\setupact.log
2013-12-25 16:21 - 2013-04-16 08:32 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-25 16:21 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-25 16:18 - 2013-04-21 10:38 - 00369664 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-25 01:04 - 2013-11-26 02:52 - 00405186 _____ C:\Windows\IE11_main.log
2013-12-24 19:40 - 2013-09-10 18:34 - 00187774 _____ C:\Windows\PFRO.log
2013-12-24 01:19 - 2013-12-23 00:36 - 00000023 _____ C:\Windows\BlendSettings.ini
2013-12-24 01:19 - 2012-05-23 15:32 - 00000000 ____D C:\Users\alex\Documents\my games
2013-12-24 01:02 - 2012-09-15 11:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-24 00:53 - 2012-12-30 08:15 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2013-12-23 23:53 - 2013-12-06 08:03 - 00000000 ____D C:\Users\alex\AppData\Roaming\Dropbox
2013-12-23 22:20 - 2013-12-23 22:20 - 00000088 _____ C:\Windows\TweakOblivion.ini
2013-12-23 22:20 - 2013-12-23 00:35 - 00000000 ____D C:\Users\alex\AppData\Local\Oblivion
2013-12-23 22:20 - 2012-05-18 20:22 - 00000000 ____D C:\Users\alex
2013-12-23 02:06 - 2012-05-23 15:47 - 00000000 ____D C:\Users\alex\Documents\Nexus Mod Manager
2013-12-23 00:35 - 2013-09-09 12:15 - 00252330 _____ C:\Windows\DirectX.log
2013-12-23 00:35 - 2012-07-09 19:14 - 00000000 ____D C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-12-22 20:51 - 2013-09-24 22:55 - 00000000 ____D C:\Users\alex\Desktop\Unending wisdom of 氷の竜
2013-12-22 11:41 - 2013-12-22 11:41 - 00000000 ____D C:\Users\alex\Desktop\file_61324072787_3470_0
2013-12-21 14:57 - 2013-09-11 14:53 - 00000000 ____D C:\Program Files (x86)\Warcraft III
2013-12-21 04:51 - 2012-05-20 01:01 - 00000000 ____D C:\Users\alex\AppData\Roaming\TS3Client
2013-12-20 22:24 - 2012-05-20 01:01 - 00000000 ____D C:\Users\alex\AppData\Local\TeamSpeak 3 Client
2013-12-20 12:27 - 2013-12-20 12:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 00:36 - 2013-12-19 00:36 - 01958098 _____ C:\Users\alex\Downloads\2560x1080 NSFW - Imgur.zip
2013-12-18 09:33 - 2013-12-18 09:27 - 19545912 _____ C:\Users\alex\Downloads\MSIAfterburnerSetup300Beta15.zip
2013-12-17 22:37 - 2013-10-22 22:26 - 00001268 _____ C:\Users\alex\Desktop\rift shit.txt
2013-12-16 13:34 - 2013-12-16 13:34 - 09819638 _____ C:\Users\alex\Downloads\Daniella Lanio - Imgur.zip
2013-12-16 13:31 - 2013-12-16 13:31 - 04640400 _____ C:\Users\alex\Downloads\ParisRoxanne - Imgur.zip
2013-12-15 19:35 - 2012-06-23 20:35 - 00000000 ____D C:\Users\alex\AppData\Roaming\Mumble
2013-12-15 01:32 - 2013-12-15 00:19 - 00000000 ____D C:\Users\alex\AppData\Local\Battle.net
2013-12-15 00:37 - 2013-12-15 00:19 - 00000000 ____D C:\Users\alex\AppData\Roaming\Battle.net
2013-12-15 00:30 - 2013-12-15 00:30 - 00000000 ____D C:\Users\alex\AppData\Local\Blizzard
2013-12-15 00:19 - 2013-12-15 00:19 - 00001150 _____ C:\Users\Public\Desktop\Battle.net.lnk
2013-12-15 00:19 - 2013-12-15 00:19 - 00000000 ____D C:\Program Files (x86)\Battle.net
2013-12-13 18:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-13 05:06 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-11 12:31 - 2012-10-22 13:58 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-11 12:31 - 2012-05-18 23:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 12:31 - 2012-05-18 23:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 08:18 - 2012-08-02 14:09 - 00029792 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2013-12-11 08:18 - 2012-06-19 16:28 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2013-12-10 04:59 - 2013-12-10 04:59 - 05055530 _____ C:\Users\alex\Downloads\Non-Nude Sexy Wallpapers - Imgur.zip
2013-12-09 02:12 - 2013-12-09 02:11 - 36773854 _____ C:\Users\alex\Downloads\Randoms - Imgur.zip
2013-12-09 01:25 - 2013-08-08 16:40 - 00001961 _____ C:\Users\alex\Desktop\tatoos.txt
2013-12-08 12:08 - 2013-12-08 12:08 - 02017033 _____ C:\Users\alex\Downloads\Emma Glover - Imgur.zip
2013-12-07 20:41 - 2013-12-07 20:41 - 08868299 _____ C:\Users\alex\Desktop\CBS.7z
2013-12-07 20:41 - 2013-12-07 20:41 - 00000000 ____D C:\Users\alex\Desktop\CBS
2013-12-07 15:50 - 2013-08-18 00:18 - 00000000 ____D C:\Windows\pss
2013-12-07 15:50 - 2012-05-18 20:23 - 00000000 ___RD C:\Users\alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-07 15:46 - 2012-06-02 02:35 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-07 15:46 - 2012-06-02 02:35 - 00000000 ____D C:\ProgramData\Skype
2013-12-07 02:13 - 2013-12-07 02:13 - 00000000 ____D C:\Users\alex\Downloads\The Ass Gallery - Imgur
2013-12-06 21:59 - 2013-12-06 21:59 - 00128916 _____ C:\Users\alex\Desktop\Fehler1&2.7z
2013-12-04 23:33 - 2013-12-04 23:33 - 00000000 ____D C:\Windows\CheckSur
2013-12-04 19:06 - 2013-12-03 15:54 - 00000000 ____D C:\Users\alex\Desktop\FRST
2013-12-04 14:23 - 2013-12-04 11:29 - 00000134 _____ C:\Users\alex\Desktop\Internet Explorer-Problembehebung.url
2013-12-04 12:01 - 2013-04-20 11:20 - 00087488 _____ C:\Users\alex\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-04 12:00 - 2013-06-26 10:52 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-12-04 11:58 - 2013-12-04 11:58 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-12-04 11:57 - 2009-07-14 03:34 - 00000439 _____ C:\Windows\win.ini
2013-12-04 11:47 - 2013-12-04 11:47 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ALEX-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-12-04 11:47 - 2013-12-04 11:47 - 00000000 ____D C:\RegBackup
2013-12-04 11:34 - 2012-09-02 20:40 - 01594156 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-03 23:35 - 2013-12-03 23:35 - 00000825 _____ C:\Users\alex\Desktop\JRT.txt
2013-12-03 23:28 - 2013-09-09 05:14 - 00000000 ____D C:\AdwCleaner
2013-12-03 22:56 - 2013-12-03 22:44 - 00000000 ____D C:\Users\alex\Desktop\mbar
2013-12-03 22:56 - 2013-06-19 15:45 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-03 22:44 - 2013-12-03 22:44 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-03 06:41 - 2013-05-20 14:12 - 00000000 ____D C:\Users\alex\AppData\Local\NVIDIA
2013-12-03 06:41 - 2012-06-03 00:18 - 00000000 ____D C:\Users\alex\AppData\Local\NVIDIA Corporation
2013-12-03 06:40 - 2013-04-16 08:28 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-03 06:40 - 2013-04-15 20:37 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-03 06:40 - 2012-05-18 20:48 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-03 01:28 - 2013-12-03 01:28 - 12999313 _____ C:\Users\alex\Downloads\Casey Connelly - Imgur.zip
2013-12-02 07:19 - 2013-12-02 07:19 - 16422740 _____ C:\Users\alex\Downloads\realbarbielifts - Imgur(1).zip
2013-12-02 06:29 - 2013-12-02 06:29 - 02520182 _____ C:\Users\alex\Downloads\Album 4HhzQ - Imgur.zip
2013-12-02 03:42 - 2013-12-02 03:42 - 01371376 _____ C:\Users\alex\Downloads\faucheer - Imgur.zip
2013-12-01 21:38 - 2013-12-01 21:38 - 00000000 ____D C:\Users\alex\AppData\Local\Ascaron Entertainment
2013-11-29 17:56 - 2013-11-05 23:43 - 01096480 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2013-11-29 17:56 - 2013-11-05 23:43 - 00979744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2013-11-29 00:55 - 2013-11-29 00:55 - 01327845 _____ C:\Users\alex\Downloads\body so tight - Imgur.zip
2013-11-28 17:05 - 2012-06-11 04:19 - 00000000 ____D C:\Users\alex\AppData\Roaming\DVDVideoSoft
2013-11-28 17:04 - 2013-11-28 17:03 - 242396304 _____ C:\Users\alex\Desktop\Jon Bellion - Jim Morrison.avi
2013-11-25 13:00 - 2012-05-19 00:35 - 00000000 ____D C:\Users\alex\Documents\Diablo III
Some content of TEMP:
====================
C:\Users\alex\AppData\Local\Temp\Plugins Vista.exe
C:\Users\alex\AppData\Local\Temp\Plugins XP.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-21 11:27
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-12-2013
Ran by alex at 2013-12-25 18:41:02
Running from C:\Users\alex\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AutoHotkey 1.1.13.01 (Version: 1.1.13.01)
Battle.net (x32)
Battlelog Web Plugins (x32 Version: 2.3.1)
CCleaner (Version: 4.02)
Core Temp 1.0 RC4 (Version: 1.0)
Counter-Strike: Global Offensive (x32)
CPUID CPU-Z 1.62
CrystalDiskInfo 5.6.2 (x32 Version: 5.6.2)
Debugging Tools for Windows (x86) (x32 Version: 6.10.3.233)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Diablo II (x32)
Dota 2 (x32)
ESN Sonar (x32 Version: 0.70.4)
GCFScape 1.8.4
GeForce Experience NvStream Client Components (Version: 1.6.28)
Hero Editor V0.96 (x32)
Intel Extreme Tuning Utility (x32 Version: 4.0.6.102)
Intel(R) Desktop Utilities (x32 Version: 1.0.0)
Intel(R) Extreme Tuning Utility (x32 Version: 1.0.0)
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0)
Intel(R) Integrator Assistant (x32 Version: 1.0.0)
Intel(R) Management Engine Components (x32 Version: 9.0.0.1287)
Intel(R) Network Connections 16.5.2.0 (Version: 16.5.2.0)
Intel® Watchdog Timer Driver (Intel® WDT) (x32)
Internet Explorer (Enable DEP)
Java 7 Update 45 (64-bit) (Version: 7.0.450)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.88.0)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server Compact 3.5 SP2 ENU (x32 Version: 3.5.8080.0)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (Version: 3.5.8080.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSI Afterburner 2.3.1 (x32 Version: 2.3.1)
MSI Kombustor 2.4.2 (x32)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Mumble 1.2.4 (x32 Version: 1.2.4)
Nexus Mod Manager (Version: 0.45.7)
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82)
NVIDIA GeForce Experience 1.8 (Version: 1.8)
NVIDIA Grafiktreiber 331.82 (Version: 331.82)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4)
NVIDIA Install Application (Version: 2.1002.142.992)
NVIDIA LED Visualizer 1.0 (Version: 1.0)
NVIDIA Network Service (Version: 1.0)
NVIDIA PhysX (x32 Version: 9.13.0725)
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725)
NVIDIA ShadowPlay 10.10.5 (Version: 10.10.5)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)
NVIDIA Systemsteuerung 331.82 (Version: 331.82)
NVIDIA Update 10.10.5 (Version: 10.10.5)
NVIDIA Update Core (Version: 10.10.5)
NVIDIA Virtual Audio 1.2.12 (Version: 1.2.12)
Origin (x32 Version: 9.0.13.2142)
Pando Media Booster (x32 Version: 2.6.0.8)
Path of Exile (x32)
PunkBuster Services (x32 Version: 0.993)
Rainmeter (x32 Version: 2.4 r1678)
Razer Mamba (x32 Version: 2.01.05)
Razer Megalodon Firmware Updater (x32 Version: 2.12.02)
Razer Synapse 2.0 (x32 Version: 1.5.18)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6449)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.27.0)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32)
SHIELD Streaming (Version: 1.6.75)
Skype Click to Call (x32 Version: 5.10.9560)
Skype™ 6.11 (x32 Version: 6.11.102)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32)
Warcraft III (x32)
==================== Restore Points =========================
24-12-2013 03:22:25 Windows Update
25-12-2013 00:04:24 Windows Update
25-12-2013 17:30:43 Removed I.R.I.S. OCR
25-12-2013 17:30:53 Removed HP Officejet 6600 Hilfe
25-12-2013 17:31:05 Removed HP Officejet 6600 - Grundlegende Software für das Gerät
25-12-2013 17:31:41 Removed Studie zur Verbesserung von HP Officejet 6600 Produkten
25-12-2013 17:31:52 Removed HP Update.
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-12-04 11:57 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0FBDAA31-E66F-4320-B674-1ACAC1C4E177} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-05-11] (Adobe Systems Incorporated)
Task: {5083AA73-3729-411E-B68E-F1380F658960} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
Task: {5D1FF4F8-1C34-4DA9-9E32-4A842C2C4F4A} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe [2013-01-23] ()
Task: {8C9467D8-2271-466B-8874-51B4DDA76F29} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {A1E29D82-9CB9-4A34-A4F1-DC80B70FAFB8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {B4D70004-CEA2-4D20-BF2E-C595D989E33E} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {B859BC22-EDAF-42AC-9D6C-D21C89B622CD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {C74E41DC-8BB7-4D28-A603-23FD324EDB60} - System32\Tasks\{8988545C-562D-413A-BC86-6818C950A893} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/en/abandoninstall?page=tsBing
Task: {DE144AFD-ABFC-4428-8ED3-E5261FA200A4} - System32\Tasks\Google Updater and Installer => C:\Users\alex\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-11-04 15:25 - 2012-11-04 15:25 - 00736968 _____ () C:\Program Files\Rainmeter\Rainmeter.dll
2012-11-04 15:24 - 2012-11-04 15:24 - 00499712 _____ () C:\Program Files\Rainmeter\Plugins\NowPlaying.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\RecycleManager.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00011776 _____ () C:\Program Files\Rainmeter\Plugins\PowerPlugin.dll
2012-11-04 15:23 - 2012-11-04 15:23 - 00056832 _____ () C:\Program Files\Rainmeter\Plugins\WebParser.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00069632 _____ () C:\Program Files (x86)\MSI Afterburner\RTMUI.dll
2013-01-16 17:00 - 2013-01-16 17:00 - 00061440 _____ () C:\Program Files (x86)\MSI Afterburner\RTFC.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00229376 _____ () C:\Program Files (x86)\MSI Afterburner\RTCore.dll
2013-01-16 17:00 - 2013-01-16 17:00 - 00143360 _____ () C:\Program Files (x86)\MSI Afterburner\RTUI.dll
2013-01-16 17:01 - 2013-01-16 17:01 - 00348160 _____ () C:\Program Files (x86)\MSI Afterburner\RTHAL.dll
2011-04-30 20:04 - 2011-04-30 20:04 - 00013312 _____ () C:\Program Files (x86)\MSI Afterburner\RTTSH.dll
2013-12-20 12:27 - 2013-12-20 12:27 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-12-11 12:31 - 2013-12-11 12:31 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
2013-03-12 17:10 - 2013-11-06 22:48 - 00691200 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2013-01-01 20:33 - 2013-12-11 20:40 - 01135016 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-01-01 20:33 - 2013-11-06 22:48 - 20625832 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2013-01-01 20:33 - 2013-06-15 00:49 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
2013-01-01 20:33 - 2013-06-15 00:49 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
2013-01-01 20:33 - 2013-06-15 00:49 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/25/2013 04:20:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskmgr.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79737
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x12f8
Startzeit der fehlerhaften Anwendung: 0xtaskmgr.exe0
Pfad der fehlerhaften Anwendung: taskmgr.exe1
Pfad des fehlerhaften Moduls: taskmgr.exe2
Berichtskennung: taskmgr.exe3
Error: (12/25/2013 04:20:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: nvtray.exe, Version: 7.17.13.3182, Zeitstempel: 0x5280e916
Name des fehlerhaften Moduls: NvBackendAPI64.DLL, Version: 10.10.5.1, Zeitstempel: 0x5298c667
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000007f5ef
ID des fehlerhaften Prozesses: 0x1080
Startzeit der fehlerhaften Anwendung: 0xnvtray.exe0
Pfad der fehlerhaften Anwendung: nvtray.exe1
Pfad des fehlerhaften Moduls: nvtray.exe2
Berichtskennung: nvtray.exe3
Error: (12/25/2013 04:20:52 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskmgr.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce79737
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x11ec
Startzeit der fehlerhaften Anwendung: 0xtaskmgr.exe0
Pfad der fehlerhaften Anwendung: taskmgr.exe1
Pfad des fehlerhaften Moduls: taskmgr.exe2
Berichtskennung: taskmgr.exe3
Error: (12/25/2013 04:19:52 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x880
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (12/25/2013 04:18:36 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: rundll32.exe_Shell32.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc9e0
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0xbdc
Startzeit der fehlerhaften Anwendung: 0xrundll32.exe_Shell32.dll0
Pfad der fehlerhaften Anwendung: rundll32.exe_Shell32.dll1
Pfad des fehlerhaften Moduls: rundll32.exe_Shell32.dll2
Berichtskennung: rundll32.exe_Shell32.dll3
Error: (12/23/2013 09:06:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1ff4
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 09:05:24 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1ae4
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 09:03:59 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1eec
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 07:09:18 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x10bc
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
Error: (12/23/2013 06:34:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Name des fehlerhaften Moduls: Oblivion.exe, Version: 1.2.0.416, Zeitstempel: 0x462392c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018dc7c
ID des fehlerhaften Prozesses: 0x1340
Startzeit der fehlerhaften Anwendung: 0xOblivion.exe0
Pfad der fehlerhaften Anwendung: Oblivion.exe1
Pfad des fehlerhaften Moduls: Oblivion.exe2
Berichtskennung: Oblivion.exe3
System errors:
=============
Error: (12/25/2013 04:21:39 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (12/25/2013 04:21:33 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0080) zurückgegeben.
Error: (12/25/2013 04:21:33 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0040) zurückgegeben.
Error: (12/25/2013 04:21:32 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (FFFFFFFFFFFFFFFF00) zurückgegeben.
Error: (12/25/2013 04:21:32 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (UBA870010B5DF0E0000) zurückgegeben.
Error: (12/25/2013 04:18:37 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a45\??\C:\System Volume Information\Syscache.hve
Error: (12/25/2013 04:18:26 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0080) zurückgegeben.
Error: (12/25/2013 04:18:26 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (BA870010B5DF0E0040) zurückgegeben.
Error: (12/25/2013 04:18:25 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (FFFFFFFFFFFFFFFF00) zurückgegeben.
Error: (12/25/2013 04:18:25 PM) (Source: Application Popup) (User: )
Description: Treiber PCI hat eine ungültige ID für das untergeordnete Gerät (UBA870010B5DF0E0000) zurückgegeben.
Microsoft Office Sessions:
=========================
Error: (12/25/2013 04:20:57 PM) (Source: Application Error)(User: )
Description: taskmgr.exe6.1.7601.175144ce79737unknown0.0.0.000000000c0000005000000000000000012f801cf0184e8e7615cC:\Windows\system32\taskmgr.exeunknown26ad021f-6d78-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:20:55 PM) (Source: Application Error)(User: )
Description: nvtray.exe7.17.13.31825280e916NvBackendAPI64.DLL10.10.5.15298c667c0000005000000000007f5ef108001cf0184d4f5c848C:\Program Files\NVIDIA Corporation\Display\nvtray.exeC:\Program Files\NVIDIA Corporation\Update Core\NvBackendAPI64.DLL25974c45-6d78-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:20:52 PM) (Source: Application Error)(User: )
Description: taskmgr.exe6.1.7601.175144ce79737unknown0.0.0.000000000c0000005000000000000000011ec01cf0184e5b274d1C:\Windows\system32\taskmgr.exeunknown2382c3f4-6d78-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:19:52 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4unknown0.0.0.000000000c0000005000000000000000088001cf0184c21d1186C:\Windows\Explorer.EXEunknownffeaefaa-6d77-11e3-bad6-e0cb4e8b8e4b
Error: (12/25/2013 04:18:36 PM) (Source: Application Error)(User: )
Description: rundll32.exe_Shell32.dll6.1.7600.163854a5bc9e0unknown0.0.0.000000000c00000050000000000000000bdc01cf018494989516C:\Windows\system32\rundll32.exeunknownd285e21c-6d77-11e3-bad6-e0cb4e8b8e4b
Error: (12/23/2013 09:06:57 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c1ff401cf001a874490cbC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exec612cc31-6c0d-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 09:05:24 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c1ae401cf001a4fba602bC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe8e85dc67-6c0d-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 09:03:59 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c1eec01cf001a1bf61f4fC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe5bdad7da-6c0d-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 07:09:18 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c10bc01cf000a175ac226C:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe567570fc-6bfd-11e3-bcde-e0cb4e8b8e4b
Error: (12/23/2013 06:34:55 PM) (Source: Application Error)(User: )
Description: Oblivion.exe1.2.0.416462392c7Oblivion.exe1.2.0.416462392c7c00000050018dc7c134001cf00054a26406bC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exeC:\Program Files (x86)\Steam\steamapps\common\Oblivion\Oblivion.exe88ec3e53-6bf8-11e3-bcde-e0cb4e8b8e4b
CodeIntegrity Errors:
===================================
Date: 2013-12-25 18:16:20.231
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:16:20.230
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:16:20.229
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.463
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.462
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-25 18:11:34.461
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-24 20:28:45.845
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 40%
Total physical RAM: 8116.18 MB
Available physical RAM: 4868.82 MB
Total Pagefile: 16230.55 MB
Available Pagefile: 12603.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:25.74 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 983FA1FB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Und das GMER-logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-25 18:47:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP5T0L0-5 Corsair_Force_GT rev.1.3.3 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\alex\AppData\Local\Temp\kxldrpog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800037f8000 8 bytes [00, 00, 43, 00, 46, 4D, 69, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800037f8010 29 bytes [A0, A1, BE, 0A, 80, FA, FF, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072c81a22 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072c81ad0 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072c81b08 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072c81bba 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072c81bda 2 bytes [C8, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe[3960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\Skype\Phone\Skype.exe[2488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\Skype\Phone\Skype.exe[2488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000074f6549c 5 bytes JMP 0000000100080800
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_packet_split_side_data + 972 000000005bf32a9c 4 bytes [20, 8D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_packet_split_side_data + 987 000000005bf32aab 4 bytes [20, 8D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!init_vlc_sparse + 289 000000005bf33151 4 bytes [20, 8D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!init_vlc_sparse + 299 000000005bf3315b 4 bytes [20, 8D, B3, 70]
.text ... * 7
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_get_chroma_sub_sample + 13 000000005bf7fced 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!ff_is_hwaccel_pix_fmt + 10 000000005bf7fd2a 4 bytes [47, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avpicture_layout + 85 000000005bf7fef5 4 bytes [44, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avpicture_layout + 115 000000005bf7ff13 4 bytes [48, 9D, B3, 70]
.text ... * 3
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_get_pix_fmt_loss + 108 000000005bf800ac 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_get_pix_fmt_loss + 114 000000005bf800b2 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_find_best_pix_fmt + 90 000000005bf8025a 4 bytes [44, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_find_best_pix_fmt + 107 000000005bf8026b 4 bytes [46, 9D, B3, 70]
.text ... * 2
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_picture_crop + 51 000000005bf80823 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!av_picture_pad + 750 000000005bf80bfe 4 bytes [40, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_pix_fmt_to_codec_tag + 497 000000005bf87121 4 bytes [47, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_align_dimensions + 30 000000005bf8aabe 4 bytes [45, 9D, B3, 70]
.text C:\Program Files (x86)\Steam\Steam.exe[4404] C:\Program Files (x86)\Steam\bin\avcodec-53.dll!avcodec_default_get_buffer + 796 000000005bf8ce5c 4 bytes [48, 9D, B3, 70]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5768] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000074f6549c 5 bytes JMP 00000001001c0800
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5768] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076381465 2 bytes [38, 76]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5768] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000763814bb 2 bytes [38, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [2420:3512] 000007fef4b49688
---- EOF - GMER 2.1 ----
Geändert von Lyzzi (25.12.2013 um 18:51 Uhr) |
| Themen zu HiddenObject.Multi.Generic und PC verhält sich merkwürdig |
| appdata, bluescreens, boot, cpu-z, dateien, daten, ebanking, explorer, files, gekauft, guten, hochfahren, internet, kaspersky, klelam.sys, launch, lädt, mbam, meldung, merkwürdig, microsoft, nexus, nicht mehr, nichts, officejet, plug-in, probleme, programm, spielen, temporary, websites, windows, windows explorer |
Baum-Darstellung